How to handle object name collisions during large ODM AD migrations (4371923)

How to handle object name collisions during large ODM AD migrations

When migrating into an existing Active Directory environment, there can be object collisions for the source environment (or multiple source environments during domain consolidation scenario) that already exist in the target. Before setting up On Demand Migration for Active Directory (ODM AD) Workflows and Templates, a decision will need to be made on a policy for how the customer wants the migration to handle these name collisions for duplicate objects.  Then configure the ODM AD Templates and Workflows to handle the object renaming requirements.

The following AD user attributes are most common for experiencing an name collision, and using that decided policy on how changes will occur when attribute collisions are found so new objects are synchronized to the target AD domain instead of overwriting existing objects.

• UserPrincipalName
• mail
• sAMAccountName
• displayName
• cn

Note: This is not a complete list of attributes that could have a name collision during a migration. 

Ensure the customer environments are reviewed and prepared for any name collisions with the objects copied attributes. While this is a manual process to compare the source objects to the target that will require an attribute (ex. ExtensionAttribute11) to be populated with a value (ex Collision). This will allow the first Stage Data ODM AD Workflow to filter on that attribute and those objects will then be processed by the second Stage Data Workflow.

Following information is for planning out what needs to be taken into account based on the customer requirements of handing of name collisions, along with examples of what in ODM AD needs to be performed.

Matching
Care will need to be taken to ensure that the matching attributes (ex. ExtensionAttribute11) chosen in the ODM AD Workflow do not result in a match between the source and target objects when there is an already existing target object. This will result in the target object being overwritten and updated with the source object details. An object match must not made so that the ODM AD will create a new user object in Target.

Templates
If no changes are made to the ODM AD default template used to create objects in the target, there is a likelihood of errors being produced when running the workflow. The Workflow's attempt to write will produce Active Directory constraint errors during the object's creation in the target; reporting the same UPN as an existing object. The error reported will be similar to this error:
Write: Unable to create CN=xxxxxxxxxx,OU=xxx,OU=xxx,DC=xxx,DC=local, object already exists.

To ensure that a new objects are created with the correct attributes in target, a new template needs to be created with the required amendments to the mappings of the duplicate attributes. These will be done in line with the decision made to handle these as identified earlier. 

Warning: These are example policies based on customer requirements to rename a list of object's attributes identified as name collisions.  This is not a list of steps to ensure all object attributes are renamed.  

Create a template for Name Collisions and update the Mapping section for the necessary changes.  Example:

Template Advanced Mappings:
Userprincipalname
Example Policy Requirement

• Source UPN is firstname.surname@domain.com Target UPN for duplicate objects should be firstname.surname1@targetdomain.com 
• If the Source object does not have a Surname Value, then use the source sAMAccountName as the Target UPN with the number 1 appended to it and the target domain names as the suffix
• All UPN characters in Target must be lowercase

Advanced Mapping Value
if(s.sn = Null, lower(s.samaccountname) + "1" + "@target.com", lower(s.givenName) + "." + lower(s.sn) + "1" + "@target.com")

displayName
Example Policy Requirement

• Append “(Source)” to displayname for user's name collision.

Advanced Mapping Value
displayName + "(Source)"

sAMAccountname
Example Policy Requirement

• Append 1 to the end of the sAMAccountName for user's attribute collision.

Advanced Mapping Value
sAMAccountName + "1"

CN
Example Policy Requirement

• Append 1 to the end of the CN for user's attribute collision.

Advanced Mapping Value
CN + "1"

Prepare Workflows
Prepare three ODM AD Workflows to perform these changes. 

• First Workflow is a Read of source and target Active Directory. 
• Second Workflow is the Matching and Staging as it can be run multiple times to confirm the attributes are correctly prepared to be written to Active Directory. Review the logs to confirm the data is prepared as needed.
• Third Workflow will perform the Write of the data into the target Active Directory.

Staging Steps

• Add an additional Staging step to the Workflow using the AD attribute ExtensionAttribute11 as the Filter.
• Use the Name Collisions Template with the changes made to the Advanced Mappings.
• Move all the duplicate objects to a Staging Collisions OU instead of the object's Staging OU to audit the process. 

Note: This may require additional steps for the post migration steps that the administrator will have to perform to ensure all objects are moved to the correct OU in Target environment.
 

2. Select Source Organization Unit  

3. Double Click on the OU to add Filtering Options

4. Select Target OU