Chat now with support
Chat with Support

On Demand Migration Current - Entra ID for Devices User Guide

Repositories

What are the Repositories?  

Repositories are storage locations (network shares) which you configure on your network used for four specific job types: Agent Logs, Custom Downloads, Offline Domain Join, and Microsoft Entra Device Join. These job types access or create files in the defined locations. If you are not using these job types you do not need to configure Repositories.

 

How do I manage Repositories?  

Repositories are managed from the Repositories section of the Configurations page. There you can view and copy the currently defined share path for each job type. You can update and save the configuration. Make sure that the defined network share path is routable from the devices being migrated.

 

What can I do with a Repository?  

Repositories are used to locate files for four job types:

  • Agent Logs – Agent logs are maintained on individual workstations. To centralize them so that review does not require logging into each machine, the Upload Logs Action can be applied to the Devices of interest. This will create a copy of the Device’s logs in the defined network share.

  • Custom Downloads – Custom Actions with a Download File Task can be used to download a specified file from the defined network share to the workstation. A common use of this job type is distributing a new VPN client to workstations after Cutover.

    A Custom Download Repository should not be used with the Offline Domain Join Action type when configuring custom actions.

  • Microsoft Entra Bulk Enrollment – The Microsoft Entra ID Cutover Action relies on access to an Azure bulk enrollment package which has been created by a client administrator using the Windows Configuration Designer as described in the Microsoft Entra Device Join Quick Start Guide.

Migrate and Navigate

Devices and Servers

What is the Devices + Servers page used for?  

The Servers + Devices screen allows the administrator to register devices and servers, set the ReACL profile, upload migration logs, and manage the device Discovery, ReACL, Cutover, and Cleanup processes.

Select the gear icon above the "Ready Devices" list to select the columns to display for the current session.

 

What is the difference between a "Ready Device" and a "Not Ready Device?"  

"Ready Devices" are devices that have the necessary agent installed, are communicating, and are ready for actions to be scheduled. "Not Ready Devices" are devices which that have not yet had an agent installed and communicating.

Note: Initial agent registration is uniformly distributed over a four hour interval from agent start time.

 

What actions can be performed on Devices and Servers?  

The following actions can be performed on devices by selecting the devices in the list, selecting an action from the drop-down list, and then clicking the Apply Action button.

  • Discovery

    The Discovery process gathers properties (OS versions, network properties, and so on) from the device to allow additional future functionality. The first discovery process begins for a device when the device becomes registered with On Demand Migration which will automatically occur after the Device Agent has been installed, as long as the environment is properly configured.

    To select when the process will begin check Do not start before and then enter or select a date and time. If using the Do not start before option, the Discovery Status will be displayed as Queued in the Devices table and the "Do Not Start Before" column in the Device Jobs table will be populated with the selected date.

  • Set Target Environment

    The Set Target Environment action provides the ability to specify the target environment for the selected devices. The ReACL, Cache Credential, Offline Domain Join, Cutover, Cleanup, Rollback, and ReACL Rollback actions cannot be started for the selected devices if the target environment is not set.

    To set to the target environment, select a target environment for the selected devices from the list and click Save. The target environment can be cleared by selecting None from the list.

  • ReACL

    The ReACL process updates the Device’s domain user profiles for use by the matching target user after cutover.

    Note: It is recommended to remove or disable anti-virus software immediately prior to the ReACL process and only after a recent clean scan has been completed.

    Note: At least one group must be migrated to populate the map.gg file or the ReACL process will fail.

    Before ReACL can occur, the target Users and Groups which have permissions set on the Device must be migrated to the target.

    To select when the process will begin check Do not start before and then enter or select a date and time. If using the Do not start before option, the ReACL Status will be displayed as Queued in the Devices table and the "Do Not Start Before" column in the Device Jobs table will be populated with the selected date.

    Note: Two checks are performed at the start of the ReACL process. The first check is for invalid Source Profiles, which will be logged as a WARNING and those profiles will be skipped. The second check is for invalid Target Profiles, where a user may have created a profile with the target account before their machine is ReACL’d and cutover. By default, this is logged as a FATAL ERROR and will halt the ReACL process. However, it can be changed to a WARNING with the –t switch passed by editing the command in SQL.

    The ReACL Agent will automatically create two files on the device being ReACL’d, map.usr and map.gg. These files are used to find the source permissions and add the appropriate target permissions during the ReACL process. System groups, such as Domain\Domain Admins and Domain\Domain Users are included in the map.gg file for updating the group permissions during the ReACL process. If the Active Directory environment is non-English, the values in the sAMAccountName column of the BT_SystemGroup table in the SQL database will need to be changed after Directory Sync is installed to have the appropriate non-English values.

    If the Mapped Network Drive is being mapped via GPO or using an integrated credential such as the current Windows logon session, ReACL will create a warning entry in the log “…WARNING: The UserName value for drive U was empty and could not be mapped to the target user.” This warning does not mean that the mapped drive cannot be accessed after Cutover.

    Note: The user profile ReACL process is decoupled from actions against files and folders.

    ReACL will update all files and folders entries found on the machine except for the user profile folders, ntuser.dat, and usrclass.dat even if the user profiles option is selected in the ReACL profile.

    Remaining ReACL activities against user profiles and registry are processed by a separate ReACL task when a cutover operation is performed.

  • Cache Credential

    The Cache Credentials process assigns a Cache Credentials job to workstation(s). See the Credential Cache and Offline Domain Join topic for more information.

  • Offline Domain Join

    The Offline Domain Join process is similar to the Cutover process for machines that are directly connected to the network. See the Credential Cache and Offline Domain Join topic for more information.

    Warning: Do not perform the Cutover process on Offline Domain Join workstations. The Offline Domain Join process takes the place of Cutover for workstations connecting via VPN.

  • Cutover

    The Cutover process moves a Device from the source domain to the new target domain.

    Check Ignore ReACL Status to cutover the device regardless of the ReACL status (otherwise the cutover process will not proceed if there is an error with ReACL process).

    Check Do not start before and then enter or select a date and time when the process will begin. If using the Do not start before option, the Cutover Status will be displayed as Queued in the devices table and the "Do Not Start Before" column in the Device Jobs table will be populated with the selected date. The Cutover process will begin as soon as possible if not using this option.

    Note: Devices should not be ReACL'd once they have been cutover to the Target. This is not a best practice and is not supported as this can cause problems with the registry and user profiles.

    Note: Certificates are not migrated with Device Cutover.

  • Microsoft Entra ID Cutover

    The Microsoft Entra ID Cutover process moves a Device from the source domain to an Azure target environment.

    Check Ignore ReACL Status to cutover the device regardless of the ReACL status (otherwise the cutover process will not proceed if there is an error with ReACL process).

    Check Do not start before and then enter or select a date and time when the process will begin. If using the Do not start before option, the Cutover Status will be displayed as Queued in the devices table and the "Do Not Start Before" column in the Device Jobs table will be populated with the selected date. The Cutover process will begin as soon as possible if not using this option.

    Note: Devices should not be ReACL'd once they have been cutover to the target. This is not a best practice and is not supported as this can cause problems with the registry and user profiles.

    Note: If the Entra ID Join profile has the Auto-Pilot/Intune Cleanup option selected, the Autopilot remove status must be completed before the Microsoft Entra ID Cutover action can be used.

  • AutoPilot Cleanup

    The AutoPilot Cleanup action clears existing Auto-Pilot/Intune provisioning information from the device. This must be done before the cutover if the source Entra ID Joined device is Autopilot-provisioned and the Entra ID Join Profile has the Autopilot/Intune Cleanup option selected.

  • Set Intune Primary User

    The Set Intune Primary User action is used after the Device Cutover is completed to set the primary user.

  • Cleanup

    The Cleanup process removes the Source SIDs after the Cutover process completes.

    Note: Cleanup should be done when the migration project is completed. Before running the Cleanup process if a trust is in place, the trust can be broken to test if any application permissions are broken.

    In the Job Options window, click Apply to begin the Cleanup process as soon as possible. To select when the process will begin check Do not start before and then enter or select a date and time. If using the Do not start before option, the Cleanup Status will be displayed as Queued in the Devices table and the "Do Not Start Before" column in the Device Jobs table will be populated with the selected date.

  • Upload Logs

    Log files from the Active Directory Agent can be uploaded to the Active Directory Web Server using Microsoft BITS. To enable this functionality, the installer enables BITS Server Extensions for IIS and create a virtual directory called DeviceLogs where all uploaded files will be stored.

    In the Job Options window, click Apply to begin the Upload Logs process as soon as possible. To select when the process will begin check Do not start before and then enter or select a date and time. If using the Do not start before option, the Do Not Start Before column in the Device Jobs table will be populated with the selected date.

    The logs will be stored in the configured Agent Logs Repository

    The device logs will be zipped, and the file names will be in the following format with a unique file name: SMART-WIN7X86-1_201573111235.zip

  • Rollback

    The Rollback process moves a Device back to the original source domain and restores any modified network settings. The Device must have attempted Cutover for this explicit Rollback process to work.

    In the Job Options window, click Apply to begin the Rollback process as soon as possible. To select when the process will begin check Do not start before and then enter or select a date and time. If using the Do not start before option, the "Do Not Start Before" column in the Device Jobs table will be populated with the selected date.

    Note: Rollback is not supported for Entra ID Device Cutover.

  • ReACL Rollback

    The ReACL Rollback process rolls back all changes made by the ReACL process. ReACL Rollback can be performed on Devices that have completed the ReACL process.

    In the Job Options window, click Apply to begin the ReACL Rollback process as soon as possible. To select when the process will begin check Do not start before and then enter or select a date and time when the process will begin. If using the Do not start before option, the "Do Not Start Before" column in the Device Jobs table will be populated with the selected date.

  • Status Resets

    Use the Status Resets action to reset the statuses of the selected devices.

  • Set Device ReACL Profile

    Use the Set Device ReACL Profile action to assign a Device ReACL profile to the selected devices.

  • Set Migration Wave

    Use the Set Migration Wave action to set a migration wave to the selected devices.

  • View Jobs

    Use the View Jobs action to view the device jobs of the selected devices.

    Note: Jobs can be canceled when the Status or Rollback Status is either Queued, Scheduled, Started, or In Progress.

  • View Profiles

    Use the View Profiles action to view the profiles of the selected devices.

  • View Properties

    After the Discovery process has been completed for a Device, you can view the properties of that Device.

    Click the Export All button to export the content of the window in Excel, text, CSV, or HTML format.

FAQs

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating