Is there a necessity to migrate machine accounts to the target domain using Dirsync workflow? Will it affect machines in ODMAD, Devices+Servers, Ready/Not Ready lists?
In a standard Quest On Demand Migration for Active Directory (ODMAD) workflow, migrating computer accounts is generally not required and is typically not recommended.
Instead, computer objects should be discovered (read-only) by the workflow while ensuring that the associated template for Stage is adjusted so that no new computer accounts are created during synchronization. Additionally, the ODMAD migration profile should be configured with “Join to existing” = No.
Simply reading computer accounts from the source through the ODMAD workflow is sufficient to have them appear under Devices+Servers → Not Ready in ODMAD. These entries act as placeholders only and do not represent active or fully provisioned objects.
Their purpose is to track devices until the Device Agent is executed on each machine. Once the agent performs registration, the corresponding entries are transitioned from the Not Ready state to the Ready list, indicating that the device is ready for further actions by migration admin.
Additionally, it is recommended to exclude the target environment from device discovery (reading Devices). This not only helps prevent duplicate or conflicting entries, but also avoids conditions that could trigger Password Propagation Service (PPS)–related issues, as explained later in this document.
The rationale behind this approach is that computer accounts are automatically created during the Cutover process. When a device is joined to the target domain as part of Cutover, the corresponding computer account is natively generated in Active Directory. This ensures:
Because of this behavior, pre-creating or migrating computer accounts is unnecessary in most scenarios.
A critical point is that computer accounts should remain in a "Not Matched" state in ODMAD prior to Cutover.
This requirement is important because:
Maintaining computer accounts as unmatched ensures PPS operates correctly and avoids unintended password updates that could disrupt domain trust.
The primary scenario where migrating computer accounts may be considered is when:
In such cases, pre-creating or migrating computer objects may help maintain organizational consistency. However, this should be carefully evaluated, as it introduces additional risk around password synchronization and trust relationships.
