-
Title
"Add source members to the corresponding target groups" and what this feature does. -
Description
What needs to be done during migration in order to populate the groups with members? Should the checkbox "Add source members to the corresponding target groups" be selected when migrating users?
-
Resolution
Group population occurs automatically during migration and no additional steps or selections are needed if:
1. Users and groups are migrated together in the same migration session
2. Users have been migrated first and groups are migrated afterwards
3. Users and groups have been migrated in the past (order is irrelevant), directory synchronization has been configured and working and objects are included in the synchronization scope.
The checkbox "Add source members to the corresponding target groups" belongs to Groups options and affects only groups being migrated, one doesn't need to select this checkbox when migrating users only.
User Guide explains on page 53:
When you migrate accounts and groups, target group membership is automatically updated for the target users. In other words, the target group will have target user accounts as members corresponding to the source user accounts (members of the source group) migrated by that time. If you also want to add source accounts (the members of the source groups) to the corresponding target groups, select the "Add source members to the corresponding target groups" checkbox.
This will do exactly what it promises and as an end-result target groups will be populated with both source and target users. Populating target groups with source users is seldom required, e.g. when Distribution Groups are being used in the target domain and e-mails sent in target to the DL should also reach the source users.IMPORTANT:
1. For the group to be able to have members from the other domain it needs to be either Local or Universal Group. If you are migrating Global Group no source users will be added as members.
2. If the source group members are FSPs (Foreign Security Principals) representing users from the other domains, DSA (Directory Synchronization Agent) still tries to resolve its SID in the SIDHistory of the target domain to find matching user. If no matching user was found then FSPs will be explicitly added to the target groups. Please also see Quest KB SOL57885. -
Additional Information
For more information please also see SOL14335:
"Considerations for Group Migration"
https://support.quest.com/SUPPORT/index?page=solution&id=SOL14335