Migration Manager for AD 8.15 - Resource Processing Guide

Configure Processing Settings

You can configure the following using the Create Processing Task wizard:

Task Action

On the Task Action step, select the action you want to perform:

• Reassign local group membership, user rights, and object permissions to target users
  This will update resources to conform to the domain reconfiguration.
  

  NOTE: The Leave source accounts' permissions check box allows you to add newly created users and groups from the target domain to object DACLs and SACLs, rather than replace the entries with the current source account SIDs.

• Clean up legacy local group membership, user rights, and permissions of migrated users
  Remove references to the original source accounts after migration. See the Resource Cleanup topic.
• Revert to the original local group membership, user rights, and object permissions
  Select this option to undo the update.

  NOTE: If two source users were merged to one target user, and if only one of them had permissions on some objects, then, after resource update and reverting the permissions, both users would have common permissions on these objects.

If you select the Reassign local group membership, user rights, and object permissions to target users option, the next step will be Account Matching. On this step, you have the following options:

• Use only the matching information from the project configuration
• Match accounts by analyzing the SID history in the target domain in addition to existing matches

If you select to match accounts by SID history data, the Vmover.exe utility will be used automatically for that. You only need to specify the target domain where to examine SID history data.

For access to the domain, the utility will use the credentials configured for the project (Project | Manage Domain Credentials in the main menu) or for the particular collection or category (the Manage Domain Credentials button in the toolbar when the collection or category is selected). Make sure that valid credentials are specified.

Handling Rights and Resources

On the Handling Rights and Resources step, select what accounts should be updated:

• Local Group Membership
  Adds target accounts to the local groups that contained the corresponding source accounts. If the Leave source accounts' permissions check box is not selected, the source accounts will be removed from the groups.
• User Rights
  Grants target accounts the user rights which belonged to the corresponding source accounts. If the Leave source accounts' permissions check box is not selected, the source accounts will be denied the rights they had.
• Service Accounts
  The Service Accounts check box allows you to update service accounts and permissions affected by the migration. For example, if a service runs as SOURCE\User1 and User1 is moved to the target domain, the service account credentials will be changed to those of TARGET\User1.
  

• Scheduled Tasks
  The Scheduled Tasks check box allows you to update scheduled task accounts and permissions affected by the migration. For example, if a task runs as SOURCE\User1 and User1 is moved to the target domain, the task account credentials will be changed to those of TARGET\User1.
  

Then select the check boxes next to the objects whose permissions should be re-assigned to target users. Permissions on the following objects can be updated:

• Registry
• Local profiles
• Roaming profiles
• Shares
• Printers
• File system
• IIS
• DCOM
• COM+
• File ownership

If you select the IIS check box, Resource Updating Manager will update the permissions of the Internet Information Services (IIS) if it is installed on the selected computers. The following IIS properties are processed by default:

• Microsoft Windows discretionary access control list (DACL) (the AdminACL property)
• Name of the registered local user that is used for anonymous users (the AnonymousUserName property)

For the full list of processed IIS properties, see the IIS section of Vmover Processing Options.

Advanced Options

On the Advanced Options step, you can configure additional options for the task:

• Select the Process resources remotely (without agents) check box to force Resource Processing Manager to process only remote resources.
  

  NOTE: In this case only several types of objects will be processed, for example, shares. This option is needed for NAS processing.

• Whether any script should be run on the processed machines before or after processing. Click Browse to specify the script file (the following file types are supported: *.vbs, *.js, *.bat, *.cmd, *.ps1).

  NOTE: Resource Updating Manager agent is a 32-bit application. So, when Resource Updating Manager agent runs scripts on a processed computer running a 64-bit operating system, all scripts will be launched in 32-bit mode.

Moving Computers to Another Domain

Once you have completed the migration of users and collections, you can choose to move the source computers to another target domain. Actions that must be performed in these cases are described in the related topics:

• Start Moving Computers
• Configure Move Computers to Domain Settings
• Moving Exchange Servers to Another Domain
• Moving Cluster Servers to Another Domain

Start Moving Computers

Follow these steps to move computers to another domain in Resource Updating Manager:

1. In the Resource Updating Manager console management tree right-click the computer you want to move.
2. Select Create Task | Move in the shortcut menu.
3. On the Move Options step, specify where and how to move computers. For more details, see Configure Move Computers to Domain Settings.
4. On the Grant Local Administrator Privileges step, select the accounts that will be added to the local Administrators group on the computers you are going to move.
5. On the next step, specify when the computer will be restarted to complete the move operation. For more details, see Configure Move Computers to Domain Settings.
6. On the Advanced Options step, you can use the Perform the task remotely (without agents) option to specify whether you want to use Resource Updating Manager agents for this task. Selecting this option will make sure that agents are not used on the computers where they are installed; instead, the task will be performed directly from the computer where this instance of Resource Updating Manager is installed. If the option is cleared, agents will be used; they will be installed on computers that do not have them.
   If you use agents, you also have the option of running custom scripts locally on the computers before and after the task.
7. On the next step you can specify when the task starts. You can start the task immediately by selecting the Start now option or select the Start at option to specify the date and time to start the operation.
   

   NOTE: If you are not using agents (the Perform the task remotely (without agents) option is selected on the Advanced Options step), the same step lets you specify the pending timeout for the task operation in case some computers are not accessible at the task start time (some computers may be turned off, or behind the firewall, or you just deploy an agent to the host via Group Policy, Systems Management Server or manually). If the task is not able to start before the deadline you set, then Resource Updating Manager will cancel this task and all subsequent queued tasks for the inaccessible computers.

8. On the Task Description step you can specify an optional task description.
9. Click Finish to start processing.

You can review and edit the schedule and other settings for any task that has not started. For that, right-click the task and select Edit Properties. In addition, you can run any task immediately, regardless of its schedule (see the Running Tasks Immediately topic).

If there are any shared folders or printers published in Active Directory on the computer being moved to the target domain, they should first be migrated to the target domain along with the computer account they are pointing to using Migration Manager. This will allow Resource Updating Manager to automatically update the resources that reside in the source and target domains after moving the computer to point to the target computer account.

Configure Move Computers to Domain Settings

On the Move Options page, select the target domain from the list and the target organizational unit (optional). In addition, you have the following options:

• Change last logged-in domain to the target domain
  If you want the last logged-in domain in the logon window to be changed to the target domain after moving the computer, select this check box.
• Preserve computer account in source domain
  To ensure that valid accounts are available for logon in case of problems, select this check box. This option will cause the source accounts to be kept, but disabled.

On the Computer Restart Options page, the following additional settings are available:

• The message to show to the currently logged-on user when the computer is about to restart.
• The delay between the message and the actual restart (that is, how much time users have for saving their work).
• Whether to forcibly close applications with unsaved data during restart.

If you select not to restart the computers after they join a different domain, you will need to tell the users to restart manually.