The Migrator Pro for Active Directory suite consists of Binary Tree Migrator Pro for Active Directory, which includes both the console and the Web service, and Directory Sync Pro for Active Directory software packages. Both packages will require access to Microsoft SQL Server. In most environments, all of these components will be installed on the same server.
Supported Operating Systems |
|
SQL Server Requirements |
|
Minimum Hardware Requirements |
|
Additional Components |
|
Migrator Pro for Active Directory is scalable and supports segregating components and can be installed in a multi-server configuration to support larger or complex environments.
If required in larger installations, remote SQL Servers may be used for the primary database and the logging database. Additionally, the primary database and the logging database can be segregated onto separate SQL Server instances.
Each of the following roles/functions may be separated onto different servers as required in advanced configurations:
When installed independently, the components require the following resources:
Supported Operating Systems |
|
Migrator Pro for Active Directory Split Role Minimum Hardware Requirements |
|
Directory Sync Pro for Active Directory Hardware Requirements |
|
SQL Server |
|
Additional Components |
|
SQL Server Requirements |
|
Supported Operating Systems |
|
PowerShell Requirements |
|
.NET Framework Requirements |
|
Operating System Requirements |
|
Supported Operating Systems |
|
Additional Requirements |
|
For most scenarios, Migrator Pro for Active Directory requires access to at least one read/write domain controller running Windows 2003 SP2 or newer in each source and target Active Directory domain. For fault tolerance, at least two domain controllers in each source and target domain is recommended.
If SID History will be synchronized, any domain controller listed in the Target DCs tab within a Directory Sync Pro for Active Directory profile will require access to the domain controller holding the PDC Emulator Active Directory FSMO role in the source. Keep in mind that even if the domain controller holding the PDC Emulator Active Directory FSMO role is not listed in the Source DCs tab, any SID History migration attempts will require a DC in the target to communicate with the PDC Emulator domain controller. For this reason, it is a best practice to ensure that all domain controllers specified in the Target DCs tab within a Directory Sync Pro for Active Directory profile has the appropriate networks access to communicate with the source domain controller holding the PDC Emulator Active Directory FSMO role before a SID History migration is attempted.
In limited scenarios, it is possible that Migrator Pro for Active Directory will not be responsible for creating or updating any accounts in the source or the target domains. In this scenario, Migrator Pro for Active Directory can be configured to communicate with Read Only Domain Controllers (RODCs).
Migrator Pro for Active Directory requires the following network ports to enable full functionality:
Source | Target | Port/Protocol |
---|---|---|
Workstations and Member Servers | Migrator Pro for Active Directory Server |
443 (TCP) or 80 (TCP) |
Migrator Pro for Active Directory Server | Source and Target Domain Controllers running Windows 2003 |
135, 137, 389, 445, 1024-5000 (TCP) 389 (UDP) |
Migrator Pro for Active Directory Migrator Server | Source and Target Domain Controllers running Windows 2008 or newer |
135, 137, 389, 445, 49152-65535 (TCP) 389 (UDP) |
Target domain controllers listed in the Target DCs tab | Domain controller in the source environment holding the PDC Emulator Active Directory FSMO role |
135, 137, 139, 389, 445, 3268 and 49152-65535 (TCP) 389 (UDP) |
The following ports need to be opened between workstations/servers and writable domain controllers for a successful domain join operation:
Type of Traffic | Protocol and Port |
---|---|
DNS |
TCP/UDP 53 |
Kerberos |
TCP/UDP 88 |
EPM | TCP 135 |
NetLogon, NetBIOS Name Resolution | UDP 137 |
DFSN, NetLogon, NetBIOS Datagram Service | UDP 138 |
DFSN, NetBIOS Session Service, NetLogon | TCP 139 |
C-LDAP | TCP/UDP 389 |
DFS, LsaRpc, NbtSS, NetLogonR, SamR, SMB, SrvSvc | TCP/UDP 445 |
LDAP SSL | TCP 636 |
Random RPC | TCP 1024-5000 |
GC | TCP 3268 |
GC | TCP 3269 |
DFS-R | TCP 5722 |
Random RPC | TCP 49152-65535 |
Migrator Pro for Active Directory does not require HTTPS (HTTP with SSL), and can operate using HTTP. However, it is strongly recommended to implement Migrator Pro for Active Directory using HTTPS to secure communications between the computers to be migrated and the AD Migrator Server. In order to activate HTTPS on the IIS component in Windows, the Migrator Pro for Active Directory system will require that a SSL certificate is present.
An SSL Certificate as part of the installation is not provided. For the most secure installation, purchasing a SSL Certificate from a Windows supported 3rd party provider is recommended.
In scenarios where this is not possible, self-signed SSL Certificate can be generated in Windows following these directions: https://technet.microsoft.com/en-us/library/cc753127(v=ws.10).aspx
If using a self-signed certificate, it should be noted that the agent component would utilize the operating system’s certificate trust list. Due to the security nature of Active Directory migrations, there is no method of implementing an override and forcing the agent to use an untrusted certificate. If a self-signed certificate is used, that certificate will need to be added to the trusted root certificate list for all computer objects to be migrated. This can be accomplished via group policy: https://technet.microsoft.com/en-us/library/cc738131(v=ws.10).aspx
Binary Tree Migrator Pro for Active Directory requires the following user account permissions and privileges to support Active Directory Migrations:
Migrator Pro for Active Directory's Reporting feature requires credentials in the following places:
Content credential: Credential for accessing the report server content.
You must set the securities in two different places in the SSRS ‘Report Manager’ web interface (http://<servername>/Reports) to connect to the report server and upload reports from the installation program.
In the Site Settings, you MUST enable the ‘System Administrator’ role during installation. After installation is complete, you may change this user’s role to ‘System User’ if desired.
In the Folder Settings, you must add the same user with (at least) ‘Browser’ permission.
Data Source Credential: The Data Source is used to access queries in the ADM database. These credentials and roles are set in the SQL server with SSMS
The user must have public, db_reader, and db_executor roles on the ADM database.
The user must have the public role on the report server and report server temp databases.
In each source domain, a SRV DNS record must be created to enable autodiscover for Migrator Pro for Active Directory Agents.
Microsoft requires an administrative account in the source domain.
SID History intra-forest migration is supported (with SMART AD Migrator 9.0.2.0) with the use of an out-of-the-box script available from Support.
The source and target domains must not have the same NETBIOS name to allow the required trust between the two environments.
To prepare each source and target domain for SID History Synchronization, the following configuration steps must be completed:
In the source domain, create a local group called SourceDomain$$$, where SourceDomain is the NetBIOS name of your source domain. For example, if your domain's NetBIOS name is ADM, you must create a domain local group named ADM$$$.
SID History synchronization will fail if members are added to this local group. |
In Registry Editor, navigate to the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA
It may also be necessary to reboot the domain controller to have auditing take effect. Even with group policy applied on the default domain controller for the domain audit, the server audit setting on the primary domain controller (PDC) may not be enabled. Please confirm this setting is enabled for the local security policy on the PDC server. If not enabled, use the local security policy to enable this setting. Advanced security auditing can be configured instead of standard auditing if additional granularity is required. |
A trust is not required to synchronize SID History in Migrator Pro for Active Directory. However, when a trust is present, it is necessary to ensure that the trust is properly configured to permit cross-domain verification. To do so, first identify if the trust between the source and target domain is an external trust or a forest trust. Next, following commands must be run from an administrative command prompt:
If the trust between the source and target is an external trust:
If the trust between the source and target is a forest trust:
Directory Sync Pro for Active Directory does not validate the password policies present within your domains. Verify that the password entered as the Default Password complies with the password policy of your target environment. Objects will fail to be created if the password violates that policy.
If planning to use the Password Copy functionality of Directory Sync Pro for Active Directory, PsExec must be installed in the Directory Sync Pro for Active Directory program directory (C:\Program Files\Binary Tree\DirSync). Ignore the PSExec Installation Guide concerning the proper installation location. PsExec is available at: https://technet.microsoft.com/en-us/sysinternals/bb897553
In order to successfully facilitate the new Cached Credentials job (which supports the Offline Domain Join feature) a one-way external trust must be configured from the source domain to the target domain.
The computers that the ODJ process is being run on must have network connectivity to BOTH the source and target environments at the same time in order to have the Cached Credentials function work properly.
Be aware that Microsoft's Djoin.exe utility only supports the Windows 7, Windows 8, Windows 8.1, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 operating systems. Offline domain join files must be created prior to running the Offline Domain Join process. A full explanation of Microsoft’s Djoin.exe utility and how to create these files can be found here:
https://technet.microsoft.com/en-us/library/offline-domain-join-djoin-step-by-step%28v=ws.10%29.aspx
© 2024 Quest Software Inc. ALL RIGHTS RESERVED. Feedback Termini di utilizzo Privacy Cookie Preference Center