In Active Directory, permissions are assigned to users via Access Control Lists (ACLs). The list contains references to security identifiers (SIDs) of the accounts to which the rights are granted.
To ensure that resources will still be available to users when they start using their target accounts and when you have cleaned up SIDHistory, permissions granted to source accounts to access the resources must be re-assigned to the target accounts. This means that ACLs of all the resources in the network need to be processed to refer to the new SIDs.
Service accounts and accounts used to run scheduled tasks must also be changed to the corresponding target accounts to ensure that services and scheduled tasks will run correctly after the source accounts are disabled. This is done during the resource update phase.
The resources can be divided in two groups:
To make the migration transparent to users, Migration Manager for Active Directory uses a set of tools to provide automated resource processing to reflect the domain reconfiguration. These tools are described in the table below.
|Resource Update Task||Description||Tool Used||Reference|
|Distributed resource update||Update ACLs for distributed resources, service accounts, user profiles, etc., including those residing on cluster servers||Resource Updating Manager||See the Delegating Resource Update topic.|
|Active Directory update||Update security descriptors for Active Directory objects in selected domains||Active Directory Processing Wizard||See the Active Directory Processing topic.|
|Exchange Server update||Update permissions set on Exchange 2000–2013 servers||Exchange Processing Wizard||See theExchange Server Processing topic.|
|Systems Management Server update||Update permissions on Systems Management Server and System Center Configuration Manager||SMS Processing Wizard||See the SMS Processing topic.|
|SQL Server update||Update permissions on SQL servers||SQL Processing Wizard||See the SQL Server Processing topic.|
|SharePoint permissions update||Reassign SharePoint permissions after your migration||SharePoint Permissions Processing Wizard||See theSharePoint Processing topic.|
Distributed resource update is the most time-consuming and requires the most planning. It is performed in the Resource Updating Manager console.
The typical scenario for working with Resource Updating Manager is as follows:
For details about using Resource Updating Manager, see the Distributed Updates in Resource Updating Manager topic.
Resource Updating Manager can be used centrally on the Migration Manager Console computer. You can also package and use a standalone Resource Updating Manager console. This lets you delegate the task to other administrators. For details, see the Delegating Resource Update topic.
Production server-related tasks that do not involve Resource Updating Manager can be performed in two ways:
For more details, see the related topics:
Resource update is among the most challenging tasks of a migration. While directory data is usually centralized, the resources (servers and end-user workstations) may be spread over domains, sites, buildings, offices, and countries. Resource Updating Manager is the main tool that lets you automate the update of various resources in your network.
After performing a directory migration, Resource Updating Manager is used to update resources so that the new users have the same permissions in the target domain as the corresponding users have in the source domain.
Resource Updating Manager facilitates resource update by automating the following tasks:
The actual processing is done by Resource Updating Manager agents, which are deployed on the computers you need to process and controlled from the Resource Updating Manager console. To handle large, geographically dispersed networks, the agents can be distributed using Group Policy or SMS. One of the main features of Resource Updating Manager is parallel processing during resource migration: the actual resource processing is performed locally on each migrated computer. Because all the selected computers are updated simultaneously, 1000 resource servers can be updated in the same time required to update 10 servers.
NOTE: Legacy Components under the COM+ node are processed by Resource Updating Manager only if you select the DCOM option before starting resource processing.
To start Resource Updating Manager, in Migration Manager console management tree expand the Resource Processing node and click Tasks. In the right pane of the Migration Manager console click Resource Updating Manager. Alternatively, run the application directly from the Start menu.