This section describes which resources or rights can be processed by Vmover.
Parameters that define processing options for Vmover are specified under the [Options] section of the Vmover INI file. For example of Vmover INI file, see the What do the parameters and data stored in the vmover.ini mean KB article.
|
TIP: For more details on using the Vmover, see the Command-Line Resource Update article. |
The following table lists resources and rights that can be processed by Vmover on local and remote computers:
Parameter in Vmover INI | Processed rights/resources |
---|---|
LocalGroups=Yes/No |
Local group membership |
UserPrivileges=Yes/No |
User rights |
Services=Yes/No |
Service accounts |
ScheduledTasks=Yes/No |
Scheduled tasks |
Profiles=Yes/No |
Local profiles |
RoamingProfiles=Yes/No |
Roaming profiles |
Registry=Yes/No |
Registry |
FileSystem=Yes/No |
File system |
ProcessFileSystemOwner=Yes/No |
File ownership |
Shares=Yes/No |
Shares |
Printers=Yes/No |
Printers |
COMPlus=Yes/No |
COM+ |
DCOM=Yes/No |
DCOM |
IIS=Yes/No |
IIS |
Vmover adds target accounts to the local groups that contain the corresponding source accounts.
Vmover assigns target accounts exactly the same user rights as the corresponding source accounts have.
For each Windows service Vmover updates the account that the service uses to log on. For example, if a service runs under SOURCE\User1 and User1 is migrated to the target domain, the account will be changed to TARGET\User1.
|
NOTE:
|
Vmover processes scheduled task accounts and permissions. For example, if a task runs as SOURCE\User1 and User1 is migrated to the target domain, the task account will be changed to TARGET\User1.
For each scheduled task Vmover performs the following:
|
NOTE:
|
Vmover processes local profiles of source users.
For each local profile, Vmover performs the following steps:
|
NOTE:The paths to user profile files are stored in the ProfileImagePath values of HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList sub-keys. |
Vmover updates roaming user profiles.
For each roaming profile found on a computer, Vmover performs the following steps:
Vmover processes permissions for all keys in the HKEY_LOCAL_MACHINE subtree of Windows Registry. If processed computer is not a Windows cluster, keys from the HKEY_USERS subtree are processed as well.
Vmover grants target account exactly the same permissions as the corresponding source account has. The following properties are updated:
|
NOTE: Owner and primary group are replaced whether or not the Leave source accounts' permissions option is turned on. |
Vmover updates permissions for files and folders located on local hard disk drives with NTFS or ReFS format.
Vmover grants target account exactly the same permissions on files and folders as the corresponding source account has. The following properties are updated for files and folders:
|
NOTE:
|
The ownership of the files and folders in the file system is changed from the source account to the corresponding target account. For example, if a file owner is SOURCE\User1 and User1 is migrated to the target domain, the file owner will be changed to TARGET\User1.
The file owner is specified on the Owner tab of Advanced Security Settings dialog in the file or folder Properties.
|
NOTE: File ownership is replaced whether or not the Leave source accounts' permissions option is turned on. |
Vmover updates share permissions.
|
NOTE: Local file system permissions for shares are not processed. |
Vmover processes permissions for local printers and for network printer connections.
Vmover grants target account exactly the same permissions as the corresponding source account has.
The following properties are updated:
|
NOTE:
|
Vmover processes settings for all COM+ application installed on a computer.
For each installed COM+ application the following items are processed:
|
NOTE: Account under which the application runs is replaced in the application properties whether or not the Leave source accounts' permissions option is turned on. |
Vmover processes the DCOM security settings.
The following computer-wide settings are processed:
The following settings are processed for each DCOM application:
Corresponding registry entries processed by Vmover are
|
NOTE: User account (RunAs registry value) is replaced whether or not the Leave source accounts' permissions option is turned on. |
Vmover processes IIS 6.0 metabase properties and IIS 7.x/8.x/10.0 settings.
IIS 6.0 metabase properties
The following IIS metabase properties are processed:
|
NOTE: All properties except AdminAcl are replaced whether or not the Leave source accounts' permissions option is turned on. |
IIS 7 or higher settings
For IIS version 7.0 or higher the following settings are updated:
IIS Manager Permissions
Shared Configuration
Centralized Certificates
|
IMPORTANT: If IIS Metabase Compatibility component is installed for IIS 7 or higher, properties listed in the IIS 6.0 metabase properties above will be processed as well. |
|
NOTE: All settings except rules (such as .Net Authorization Rules, etc.) are replaced whether or not the Leave source accounts' permissions option is turned on. |
Vmover should be run using the following command-line syntax:
Vmover.exe /c [/ini=IniFile] [/roaming=UserDatPath] [/volume=Path]
[/system=Computer]
Explanation
/c—Mandatory parameter for command-line usage.
/ini—Optional parameter. Name of the INI file that contains the parameters for the update.
For more information on creating INI files for processing resources, refer to the Delegating Resource Update topic.
/roaming—Processes roaming profiles. If the /roaming parameter is specified, Vmover will process only profile on which the parameter's value indicates. Recursive bypass through the subfolders with profiles will not be performed.
|
Caution: If you specify the /volume or /roaming parameter, Vmover will not update other resource types in the INI file (such as group membership or user rights). |
/volume—Processes file system permissions in the specified location
|
Caution: If you specify the /volume or /roaming parameter, Vmover will not update other resource types in the INI file (such as group membership or user rights). |
/system—Specifies the computer name. By default, the local computer is updated.
/log—Specifies the location of the log file by means of overriding the LogFile key in the INI file.
/exclude—Sets exclude masks. Use the | symbol as a divider and the * symbol as a wildcard. During processing Vmover skips files and directories if their names match one of the specified exclude masks.
/excludepath—Sets exclude paths. Use the | symbol as a divider. During processing Vmover skips directories if their names match one of the specified exclude paths. This parameter should specify network paths, not local file system paths.
/recursion—Sets the recursion level. Vmover processes file system to the depth specified in this parameter, starting either from the path given in the /volume parameter (if specified) or from the root drive path.
/affinity—Sets the CPU affinity mask in a view of a bit mask that indicates what processors are eligible to be selected for work. The value of 1 means that only first processor will be used, the value of 2 means that only second processor will be used, the value of 3 allows to use only first and second processors and so on. If the mask specifies the number of processor, that exceeds the real number of processors in the system, Vmover will exit with an error displayed.
/priority—Sets the priority for Vmover.exe for the resource updating process, allowing you to avoid overloading the client computers when resource processing is running during working hours. The following priority values are used:
|
NOTE: To study examples of using of these parameters, run Vmover.exe with parameter /?. To perform recursive bypass through the subfolders with profiles, create the INI file with the Roaming profiles option enabled and run Vmover from the command line without the /roaming parameter. For example: Vmover.exe /c [/INI=IniFile] [/system=Computer] |
By default, Vmover applies the changes specified in the INI file on the local computer. To make Vmover update a remote computer, use the /system command-line parameter or add the /System=TargetComputerName key to the INI file. The following example shows how to use the /system command-line parameter:
Vmover /c /system=Mars
When Vmover is updating a remote computer, it locates all the system shares of the computer (such as c$ and d$) and updates all the files and folders located in the shares.
To update a specific share of the computer, use the /volume command-line parameter. In this case, no other shares will be affected. The following example shows how to use the /volume parameter:
Vmover /c /volume=\\Mars\Deimos
|
Caution: If you use the /volume parameter, Vmover will not process any other options in the INI file (such as group membership or user rights). Only file system permissions of the specified share will be processed. |
For a successful remote update, the account under which Vmover is started must be administrative and have the following privileges on the remote and local computers (granted explicitly or by establishing a net use connection):
|
NOTE: For successful IIS permissions processing on the remote computer, IIS must also be installed on the computer on which Vmover is running and the account under which Vmover is started must be a local administrator on the computer being processed. |
By default, Vmover’s INI file contains source-target account pairs migrated by the moment when the file was generated.
Alternatively, Vmover can automatically locate and append to the INI file the pairs by analyzing the SID history of the accounts in the target domain. This lets you use the tool even if the object migration was performed not by Migration Manager but by another tool capable of adding sIDHistory.
|
NOTE: If Vmover was already run with the same INI file, it will locate and append to the INI file the information about the newly migrated accounts. |
To use sIDHistory mapping, the following parameters need to be added to the [options] section:
Parameter | Description |
---|---|
SIDHistory=Yes/No |
Set this parameter to Yes to enable SIDHistory mapping. |
hostName=Host_Name | Specify the target domain controller to use for LDAP queries. This should be a Global Catalog server. |
ldapUser=UserName | The username to be used for LDAPrequests. |
ldapDomain=UserDomain | The name of the target domain. |
ldapPsw=Password | The password for the ldapUser user account. |
The source domains are specified in a separate section [SourceDomains]. Each line of the section should contain a source domain name and its SID, separated by a semicolon character (;).
The following is an example of an INI file with SIDHistory mapping:
[dmw4]
[Options]
FileSystem=No
Shares=Yes
LocalGroups=No
UserPrivileges=No
Printers=No
Registry=No
Profiles=No
InstallProfilesAgent=Yes
Services=No
ScheduledTasks=No
Clone=Yes
CleanUp=No
Undo=No
AutoRemove=No
MaxErrors=10
LogMask=-1
LogFile=Vmover.log
StateFile=Vmover.txt
Version=400
MaxCriticalErrors=10
MaxRegUsage=95
ProcessRegGroupOwner=No
UpdateStateSec=1
SetArchiveBit=No
sidHistory=Yes
hostName=pdc-target2000:389
ldapUser=administrator
ldapDomain=target2000
ldapPsw=‘adminpswd’
[SourceDomains]
TRUST;S-1-5-21-750286249-1451910610-2033415169
If SIDHistory mapping is used but the source-target pairs are also listed, both the SIDHistory pairs and the explicitly set pairs are used.
|
NOTE: For troubleshooting purposes, you can enable extended logging. To do this, set the LogMask parameter value to 255 (default value is 15). Note that enabling extended logging may lead to the generation of huge log files. |
© ALL RIGHTS RESERVED. Feedback 이용 약관 개인정보 보호정책 Cookie Preference Center