logo active directory

Migrating User and Password Objects between Active Directory Forests

As part of some internal lab work, I had to move the user objects with their passwords to a new forest. It was key to migrate the passwords to ensure that disruption to the users was minimized.

To migrate the users, I used the Microsoft Active Direction Migration Tool (ADMT + documentation) alongside the Password Migration Service.

migrate users between forests overview

In this blog post I am going to cover;

  • Create connectivity between both AD Forests
  • Installing the ADMT software + Password Migration Service
  • Creating a user list for migration
  • Migrating User objects + Passwords between AD Forests

Create connectivity between both AD Forests

There must be IP network connectivity between the DC’s in your Forests.

DNS setup

You need to configure conditional forwarders between your forests, so they can resolve one another.

On the source domain controller;

  1. Open up the DNS console, and right click the Conditional Forwarder folder to create a new record.
  2. Enter your target domain name and IP address/es of your domain controllers in the target domain. Select “store this conditional forwarder in active directory”, to replicate to other DCs in the source domain.

MIgrate users between a forests create conditional forwarder MIgrate users between a forests create conditional forwarder 2

It is also a good idea to add the target domain DNS suffix to your Source DC network adapter, this allows for short name resolution.

MIgrate users between a forests append DNS suffixes

Repeat the same steps on the target domain controllers, pointing the conditional forwarder to your source domain.

After this, ensure you can successfully look up the domains from another with the correct Domain controller IP addresses being returned. Also check short name resolution works.

MIgrate users between a forests DNS lookup tests MIgrate users between a forests DNS lookup tests 2

Create Active Directory Forest Two-Way Trust

Next you need to create a forest trust

  • You can read about the different options here

I will create a two-way forest trust which means we are able to authenticate users between domains, and this trust will be removed after I’ve migrated the users.

On the source domain controller

  1. Open Active Directory Domains and Trusts. right click your domain name and go to properties
  2. Click the trusts tab, and click the new trust button
  3. Enter the name of your target domain
  4. Select forest trust
  5. Select two-way trust
  6. Select forest wide trust
  7. Enter trust password (you will use this when you create the trust on the target domain side)
  8. Click next x2
  9. If you click to confirm the trust at this point, it will fail as it does not exist on the target domain side yet. (See screenshots)

MIgrate users between a forests Create Forest Trust MIgrate users between a forests Create Forest Trust 11 MIgrate users between a forests Create Forest Trust 10 MIgrate users between a forests Create Forest Trust 9 MIgrate users between a forests Create Forest Trust 8 MIgrate users between a forests Create Forest Trust 7 MIgrate users between a forests Create Forest Trust 6 MIgrate users between a forests Create Forest Trust 5 MIgrate users between a forests Create Forest Trust 4 MIgrate users between a forests Create Forest Trust 3

Installing the ADMT software

Install this on your Target domain controller, or a machine in target domain. There is a requirement for an SQL server to host a database. I used SQL Express for the lab setup.

Installing the Password Migration Service

First you must generate an encryption key from a DC in your target domain. Open CMD as administrator and run;

admt /key option:create /sourcedomain:{source domain name} /keyfile:{folder path to save the file} /Keypassword:*

Using * for the pwd flag, will then prompt you for the password when the command is run

MIgrate users between a forests Install Password Migration Service Create encryption key

On your source domain, in the built-in Administrators group, add in the domain administrator from your target domain.

MIgrate users between a forests Install Password Migration Service Add target domain admin to source domain

On the domain controller in your source domain, install the Password Migration Service.

When prompted, install the service as the domain admin from your target domain, this account will be added the log on as service right.

A reboot of the machine where this service is installed will be needed.

MIgrate users between a forests Install Password Migration Service 1MIgrate users between a forests Install Password Migration Service 2 MIgrate users between a forests Install Password Migration Service 4 MIgrate users between a forests Install Password Migration Service 3MIgrate users between a forests Install Password Migration Service 5

After the reboot, you will need to manually start the “Password Export Server Service”, after you’ve migrated your users, for security, you should stop this service.

MIgrate users between a forests Install Password Migration Service start services

Creating a user list for migration

The last step before migration, is creating a CSV file with a list of the users we want to migrate. I will do this using a simple PowerShell command

get-aduser –filter * -searchbase {OU full path} | Export-csv {path}

You can be more complex if you need to target users who are part of a security group or multiple OUs.

MIgrate users between a forests create include file of users

You will need to edit this CSV to use the accepted headers for use as an “include file” for ADMT. You can follow the official documentation for these headers.

MIgrate users between a forests create include file of users 2

MIgrate users between a forests create include file of users documentation

Migrating users between AD Forests

Ok, we’ve finished the prep work. Now time to migrate the users.

  1. Open up ADMT console, right click on the Migration tool folder and select “User Account Migration Wizard”
  2. Type in your source domain, and select your target domain from the drop down
  3. Select the option “read objects from include file”
  4. Set your include file location and Source OU where your users are located
  5. Select the option to migrate the user’s passwords
  6. Select account options for after the migration
    1. If selected SID History Migration, accept the options
  7. Input the domain admin detail to authenticate to the Source Domain
  8. Configure user options for after the migration
  9. Select any user object attributes you do not want to be migrated
  10. Select your option for how to handle user conflicts
  11. Complete the user migration wizard
  12. Watch the progress, you also have easy access to view the logs from here
  13. Configure user’s password so that they do not need changing upon next login.
get-aduser -filter * -searchbase {OU path} | set-aduser -changepasswordatlogon $false

MIgrate users between a forests 1   MIgrate users between a forests 2 enter source and target domain         MIgrate users between a forests 3 Select use include fileMIgrate users between a forests 4 set include file location and source OU

MIgrate users between a forests 5 Migrate passwords MIgrate users between a forests 6 select options for accounts once migrated

MIgrate users between a forests 7 SID migration settings MIgrate users between a forests 8 Set domain administrator from Source domain

MIgrate users between a forests 9 user options MIgrate users between a forests 10 Object Property exclusion

MIgrate users between a forests 11 Conflict management MIgrate users between a forests 12 Complete user account migration wizard

MIgrate users between a forests 13 migration progress MIgrate users between a forests 14 set user change password false

Hope this helps someone out there, I recommend that you read the ADMT document first before undertaking a migration of AD users in production, and then test in a lab environment.

8 thoughts on “Migrating User and Password Objects between Active Directory Forests

  1. Do you know if there is a way to migrate password history? My customer is migrating to a new forest but needs to ensure that users do not use any of their prior 12 months of passwords.

    1. Hi, I’ve had a look, and this functionality is not available with ADMT, also looking at third party tools for these operations, none of them look to support migrating password history. So I think this is not possible.

  2. We are doing a hardware refresh (old stack to new stack). So, the DC’s are named the same. How do we make this work for migrating objects and passwords from AD01 to AD01? Thanks.

    1. So if your moving from ad01.olddomain.local to ad01.newdomain.local – this shouldn’t be an issue, it should work as described. If you are moving from ad01.domain.local to ad01.domain.local, then well I doubt this is even possible, because you know, everything is the same name.

      I once moved domains from something.domain.local which was the full domain name at root in that forest. To a brand new AD forest called domain.local, and that took a lot of messing around with DNS records on both sides of the domains, to get a one-way trust working, and was probably highly unsupported from a connectivity point of view.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.