Return
-
Title
Active Directory objects retain their source domain ownership after migration -
Description
When migrating a user or group to a target domain the "owner" is still retained as Domain Admins (<Source>\Domain Admins). What is needed to update objects' ownership in the target domain to change "owner" to target domain's entities. -
Cause
Objects permissions, including ownership are copied from the source as is during the migration. -
Resolution
To resolve the ownership issue please perform the following steps:
1. Identify the AD object's owner. Usually, owner is a Domain Admins group.
2. Migrate/merge the owning AD object to target domain
3. Use Active Directory Processing Wizard in QMM console, MMAD tab, Resource Updating Tasks to update target objects' permissions with:
- reassign group membership and permissions. Uncheck "Leave source users' group memberships and permissions"
- process these objects: group membership, linked attributes, permissionsNote: please test on specific objects/owners prior to deployment in the production environment. This can be done in ADPW task, Select Objects to Process Resources