Return
-
Title
Requirement to clean up legacy resource permissions (outside of current migration project) on a server. Is this possible? -
Description
Is it possible to configure RUM / Vmover to remove and cleanup permissions from a legacy migration project (where a cleanup had not been performed)?
Default behaviour appears to be that only permissions and SID history from the current migration manager project are processed.
-
Cause
Default behaviour is that RUM / Vmover will only cleanup permissions it is aware of through the current migration manager project. -
Resolution
A method can be implemented to allow RUM to remove legacy project permissions from server resources. Please note the creation of the Accounts files referenced below is the responsibility of customers. Support also strongly recommend that cleanup processing tasks are run at the time of the original migration projects.
1) Initially a processing file is required. The account matching file must contain a list of migration pairs in the following format, one pair per line:SourceNetBIOSDomainName\SourceUserName,SourceUserSID,SourceUPN,SourceDomainDNSName,
TargetNetBIOSDomainName\TargetUserName,TargetUserSID,TargetUPN,TargetDomainDNSName
The following is an example of possible account matching file:SOURCE1\user1.name,S-1-5-21-sourceUser1SID,user1@source1.principal.name,source1.com,TARGET1\user1.name,S-1-5-21-targetUser1SID,user1@target1.principal.name,target1.comSOURCE2\user2.name,S-1-5-21-sourceUser2SID,user2@source2.principal.name,source2.local,TARGET2\user2.name,S-1-5-21-targetUser2SID,user2@target2.principal.name,target2.local
NB. the details of the source SID are a customer responsibility, support cannot directly assist with this step. SID values can be extracted using powershell eg.get-adgroup "group name" -properties sidhistory
get-aduser is a further command that may be requiredThen the "historic" SID reference needs to be distinguished from the migrating domain SID eg. by knowing the domain values S-1-5-21-xxxxxxxxxx.
Then the required load file can be constructed in the format of:SOURCEDOMAIN\groupname,historicsid,groupname,sourceUPN,TARGETDOMAIN\groupname,targetsid,
groupname,targetUPN
2) Specifying Accounts from File.To specify an account matching file with accounts to process resources for, right-click the collection or category node in the console management tree and click Operate with Accounts from File. In the opened dialog box click Browse and select the account matching file created in step 1.
3) Create a cleanup task based on the account file created in step 2. In the case of vmover the scheduling of this task will allow for the Export of settings to an ini file