Chatee ahora con Soporte
Chat con el soporte

On Demand Migration Current - Entra ID for Devices User Guide

Migrate and Navigate

Devices and Servers

What is the Devices + Servers page used for?  

The Servers + Devices screen allows the administrator to register devices and servers, set the ReACL profile, upload migration logs, and manage the device Discovery, ReACL, Cutover, and Cleanup processes.

Select the gear icon above the "Ready Devices" list to select the columns to display for the current session.

 

What is the difference between a "Ready Device" and a "Not Ready Device?"  

"Ready Devices" are devices that have the necessary agent installed, are communicating, and are ready for actions to be scheduled. "Not Ready Devices" are devices which that have not yet had an agent installed and communicating.

Note: Initial agent registration is uniformly distributed over a four hour interval from agent start time.

 

What actions can be performed on Devices and Servers?  

The following actions can be performed on devices by selecting the devices in the list, selecting an action from the drop-down list, and then clicking the Apply Action button.

  • Discovery

    The Discovery process gathers properties (OS versions, network properties, and so on) from the device to allow additional future functionality. The first discovery process begins for a device when the device becomes registered with On Demand Migration which will automatically occur after the Device Agent has been installed, as long as the environment is properly configured.

    To select when the process will begin check Do not start before and then enter or select a date and time. If using the Do not start before option, the Discovery Status will be displayed as Queued in the Devices table and the "Do Not Start Before" column in the Device Jobs table will be populated with the selected date.

  • Set Target Environment

    The Set Target Environment action provides the ability to specify the target environment for the selected devices. The ReACL, Cache Credential, Offline Domain Join, Cutover, Cleanup, Rollback, and ReACL Rollback actions cannot be started for the selected devices if the target environment is not set.

    To set to the target environment, select a target environment for the selected devices from the list and click Save. The target environment can be cleared by selecting None from the list.

  • ReACL

    The ReACL process updates the Device’s domain user profiles for use by the matching target user after cutover.

    Note: It is recommended to remove or disable anti-virus software immediately prior to the ReACL process and only after a recent clean scan has been completed.

    Note: At least one group must be migrated to populate the map.gg file or the ReACL process will fail.

    Before ReACL can occur, the target Users and Groups which have permissions set on the Device must be migrated to the target.

    To select when the process will begin check Do not start before and then enter or select a date and time. If using the Do not start before option, the ReACL Status will be displayed as Queued in the Devices table and the "Do Not Start Before" column in the Device Jobs table will be populated with the selected date.

    Note: Two checks are performed at the start of the ReACL process. The first check is for invalid Source Profiles, which will be logged as a WARNING and those profiles will be skipped. The second check is for invalid Target Profiles, where a user may have created a profile with the target account before their machine is ReACL’d and cutover. By default, this is logged as a FATAL ERROR and will halt the ReACL process. However, it can be changed to a WARNING with the –t switch passed by editing the command in SQL.

    The ReACL Agent will automatically create two files on the device being ReACL’d, map.usr and map.gg. These files are used to find the source permissions and add the appropriate target permissions during the ReACL process. System groups, such as Domain\Domain Admins and Domain\Domain Users are included in the map.gg file for updating the group permissions during the ReACL process. If the Active Directory environment is non-English, the values in the sAMAccountName column of the BT_SystemGroup table in the SQL database will need to be changed after Directory Sync is installed to have the appropriate non-English values.

    If the Mapped Network Drive is being mapped via GPO or using an integrated credential such as the current Windows logon session, ReACL will create a warning entry in the log “…WARNING: The UserName value for drive U was empty and could not be mapped to the target user.” This warning does not mean that the mapped drive cannot be accessed after Cutover.

    Note: The user profile ReACL process is decoupled from actions against files and folders.

    ReACL will update all files and folders entries found on the machine except for the user profile folders, ntuser.dat, and usrclass.dat even if the user profiles option is selected in the ReACL profile.

    Remaining ReACL activities against user profiles and registry are processed by a separate ReACL task when a cutover operation is performed.

  • Cache Credential

    The Cache Credentials process assigns a Cache Credentials job to workstation(s). See the Credential Cache and Offline Domain Join topic for more information.

  • Offline Domain Join

    The Offline Domain Join process is similar to the Cutover process for machines that are directly connected to the network. See the Credential Cache and Offline Domain Join topic for more information.

    Warning: Do not perform the Cutover process on Offline Domain Join workstations. The Offline Domain Join process takes the place of Cutover for workstations connecting via VPN.

  • Cutover

    The Cutover process moves a Device from the source domain to the new target domain.

    Check Ignore ReACL Status to cutover the device regardless of the ReACL status (otherwise the cutover process will not proceed if there is an error with ReACL process).

    Check Do not start before and then enter or select a date and time when the process will begin. If using the Do not start before option, the Cutover Status will be displayed as Queued in the devices table and the "Do Not Start Before" column in the Device Jobs table will be populated with the selected date. The Cutover process will begin as soon as possible if not using this option.

    Note: Devices should not be ReACL'd once they have been cutover to the Target. This is not a best practice and is not supported as this can cause problems with the registry and user profiles.

    Note: Certificates are not migrated with Device Cutover.

  • Microsoft Entra ID Cutover

    The Microsoft Entra ID Cutover process moves a Device from the source domain to an Azure target environment.

    Check Ignore ReACL Status to cutover the device regardless of the ReACL status (otherwise the cutover process will not proceed if there is an error with ReACL process).

    Check Do not start before and then enter or select a date and time when the process will begin. If using the Do not start before option, the Cutover Status will be displayed as Queued in the devices table and the "Do Not Start Before" column in the Device Jobs table will be populated with the selected date. The Cutover process will begin as soon as possible if not using this option.

    Note: Devices should not be ReACL'd once they have been cutover to the target. This is not a best practice and is not supported as this can cause problems with the registry and user profiles.

    Note: If the Entra ID Join profile has the Auto-Pilot/Intune Cleanup option selected, the Autopilot remove status must be completed before the Microsoft Entra ID Cutover action can be used.

  • AutoPilot Cleanup

    The AutoPilot Cleanup action clears existing Auto-Pilot/Intune provisioning information from the device. This must be done before the cutover if the source Entra ID Joined device is Autopilot-provisioned and the Entra ID Join Profile has the Autopilot/Intune Cleanup option selected.

  • Set Intune Primary User

    The Set Intune Primary User action is used after the Device Cutover is completed to set the primary user.

  • Cleanup

    The Cleanup process removes the Source SIDs after the Cutover process completes.

    Note: Cleanup should be done when the migration project is completed. Before running the Cleanup process if a trust is in place, the trust can be broken to test if any application permissions are broken.

    In the Job Options window, click Apply to begin the Cleanup process as soon as possible. To select when the process will begin check Do not start before and then enter or select a date and time. If using the Do not start before option, the Cleanup Status will be displayed as Queued in the Devices table and the "Do Not Start Before" column in the Device Jobs table will be populated with the selected date.

  • Upload Logs

    Log files from the Active Directory Agent can be uploaded to the Active Directory Web Server using Microsoft BITS. To enable this functionality, the installer enables BITS Server Extensions for IIS and create a virtual directory called DeviceLogs where all uploaded files will be stored.

    In the Job Options window, click Apply to begin the Upload Logs process as soon as possible. To select when the process will begin check Do not start before and then enter or select a date and time. If using the Do not start before option, the Do Not Start Before column in the Device Jobs table will be populated with the selected date.

    The logs will be stored in the configured Agent Logs Repository

    The device logs will be zipped, and the file names will be in the following format with a unique file name: SMART-WIN7X86-1_201573111235.zip

  • Rollback

    The Rollback process moves a Device back to the original source domain and restores any modified network settings. The Device must have attempted Cutover for this explicit Rollback process to work.

    In the Job Options window, click Apply to begin the Rollback process as soon as possible. To select when the process will begin check Do not start before and then enter or select a date and time. If using the Do not start before option, the "Do Not Start Before" column in the Device Jobs table will be populated with the selected date.

    Note: Rollback is not supported for Entra ID Device Cutover.

  • ReACL Rollback

    The ReACL Rollback process rolls back all changes made by the ReACL process. ReACL Rollback can be performed on Devices that have completed the ReACL process.

    In the Job Options window, click Apply to begin the ReACL Rollback process as soon as possible. To select when the process will begin check Do not start before and then enter or select a date and time when the process will begin. If using the Do not start before option, the "Do Not Start Before" column in the Device Jobs table will be populated with the selected date.

  • Status Resets

    Use the Status Resets action to reset the statuses of the selected devices.

  • Set Device ReACL Profile

    Use the Set Device ReACL Profile action to assign a Device ReACL profile to the selected devices.

  • Set Migration Wave

    Use the Set Migration Wave action to set a migration wave to the selected devices.

  • View Jobs

    Use the View Jobs action to view the device jobs of the selected devices.

    Note: Jobs can be canceled when the Status or Rollback Status is either Queued, Scheduled, Started, or In Progress.

  • View Profiles

    Use the View Profiles action to view the profiles of the selected devices.

  • View Properties

    After the Discovery process has been completed for a Device, you can view the properties of that Device.

    Click the Export All button to export the content of the window in Excel, text, CSV, or HTML format.

FAQs

General FAQs

What ports does the agent use to connect?  

The Active Directory Agent uses three outbound ports

  • TCP 443/80
  • UDP 3030

 

I’ve installed the agent and the device isn’t ready, what do I do?  

On startup the Active Directory agent will phone home sometime in the first four hours. This communication offset time is an agent specific random and evenly distributed offset so the initial communications of a large number of devices set up at once will be spaced out and not overload the servers. If your device has the agent installed but you haven’t waited up to four hours yet, wait up to four hours and then re-check the Ready Devices list to see if your device shows up before proceeding to other network troubleshooting operations.

 

How do I adjust the agent polling interval?  

In Entra ID for Devices, the agent polling interval is not end user adjustable. The polling interval is every two minutes over UDP and every four hours over TCP. Should this amount of network traffic be an issue contact Support to investigate reducing the polling interval. Note that reducing the polling interval will cause queued migration actions to take longer to be picked up by the agents.

 

How many migration actions can I queue at once?  

In Entra ID for Devices you can queue as many migration actions at once as you would like. There is a hard limit of 600 agents per each two minutes who will be notified by the job availability cache that they have a job waiting for them. Therefore the minimum amount of time which could be required for those queued migration actions to be picked up will be the number of queued migration actions divided by 600 and multiplied by two minutes.

 

Agent last contact time isn’t updating every two minutes is something wrong?  

In Entra ID for Devices, the Agent last contact time is updated based on the TCP connection with the back end. This will occur if a job is retrieved or every 4 hours as a fall back. It is not expected that the agent last contact time will update every two minutes even if the UDP requests to the job availability cache are functioning correctly.

 

The machine name was changed during the migration project, will it keep working?  

Changing the machine name during a migration project may have unexpected implications. We recommend that you avoid doing so if possible. If not, you will need to delete the device from Entra ID for Devices and reinstall the agent. Use the Status Resets action to reset the registration status of the device, then set the Workflow to reconcile on next run and run it. This will delete the old device from the database. Finally, reinstall the Active Directory Agent on that device and run the Workflow again to read it in.

 

How do I remove Devices from Entra ID for Devices?  

To delete registered Devices from Entra ID for Devices, first use the Status Resets action to clear their registration status, then run the related Workflow with the setting ‘Reconcile on next run’ enabled. Any unregistered device records in scope of the Workflow will be removed from the database during a reconcile.

Documentos relacionados

The document was helpful.

Seleccionar calificación

I easily found the information I needed.

Seleccionar calificación