Migration Manager for AD 8.15 - Resource Processing Guide

Post-Processing Operations

After successful resource processing, you can remove any references to the source accounts and then disable or delete the source accounts. Also, you can remove the Resource Updating Manager agent from the processed computers.

Resource Cleanup

Once your users have started to log on under their new accounts in the target domain and are not experiencing any problems with access to resources, you may want to remove unnecessary references to the original source accounts in collections, user rights, and object security descriptors. Take the following steps:

1. In the Resource Updating Manager console management tree right-click the node of the collection or category you want to process.
2. Select the Create Task | Processing option in the shortcut menu.
3. On the Task Action step, select the Clean up legacy local group membership, user rights, and permissions of migrated users option.
4. Select the required items and settings to process in the Handling Rights and Resources dialog box.
   

   NOTE: The Leave Source accounts' permissions check box will have no effect on this operation.

5. In the Task Schedule dialog box you can specify when the task starts. You can start the task immediately by selecting the Start now option or select the Start task at option to specify the date and time to start processing. On the same step, you can specify the pending timeout for the task operation if some computers are not accessible at the task start time (some computers may be turned off, or behind the firewall, or you just deploy an agent to the host via Group Policy, Systems Management Server or manually).
6. On the Task Description step you can specify an optional task description.
7. Click Finish.

Computer Cleanup

Follow these steps to remove the Resource Updating Manager agent from the processed computers:

1. In the Resource Updating Manager console management tree right-click the node of the collection or category you want to clean up.
2. Select Create Task | Cleanup in the shortcut menu.
3. On the Task Description step, specify the task description for further reference, and then click Next.
4. In the Task Schedule dialog box you can specify when the task starts. You can start the task immediately by selecting the Start now option or select the Start task at option to specify the date and time to start processing. On the same step, you can specify the pending timeout for the task operation in case some computers are not accessible at the task start time (some computers may be turned off, or behind the firewall, or you just deploy an agent to the host via Group Policy, Systems Management Server or manually).
5. Click Finish.

You can review and edit the schedule and other settings for any task that has not started. For that, right-click the task and select Edit Properties. In addition, you can run any task immediately, regardless of its schedule (see the Running Tasks Immediately topic).

Running Tasks Immediately

Assigning a schedule is one of the steps to create a Resource Updating Manager task. In some situations, you may need to run a task immediately instead of waiting for its scheduled time. For that, right-click the task and select Start Now.

Note that tasks are one-off operations. Using the Start Now command resets the task's current schedule so that the task starts straight away. Once the task has started, it cannot be rescheduled any more. If you want to repeat the task later, use a copy of it.

Processing Algorithm

Objects are processed according to the following algorithm:

• If a source user account is the current owner, ownership is transferred to the target user account.
• If there is no reference to the source user account in the Access Control List, then permissions and auditing are left unchanged. If Source\User1 or Source\Group1 is found in the corresponding ACL, then:
  1. All entries of Target\User1 are removed.
  2. The ACE is cloned and assigned to Target\User1 or Target\Group1.

If you choose to process local profiles, user profiles will be shared between source and target user. No copying of profiles ever occurs.

The processing of Access Control Lists is comprehensive: not only permissions, but also ownership and auditing are processed, which ensures the completeness of the update. A relevant example would be Mac volumes that use ownership to control client access. These volumes are handled correctly by Resource Updating Manager.

Another notable Resource Updating Manager feature is that it will traverse and process all child directories and files, regardless of the ownership and permissions of the parent directory.

Managing Categories

The Categories node of the Resource Updating Manager console management tree contains several pre-installed categories which might help you to sort computers and find a particular computer among the processed resources. After a computer was added to any collection under the collections node, discovered, processed (successfully or not), it immediately appears under the corresponding category.

Creating Categories

To create your own category, right-click the Categories node and select the Create Category option. In the Create Category dialog box provide the name and optional description for new category and configure query settings and node properties.

When creating a category, you actually create an LDAP filter for the ADAM or AD LDS database.