ADMT域迁移工具

thm0908

怎样使用ADMT域迁移工具把WIN2K域里面的帐号和密码迁移到WIN2003域里面去呀.请各位可否详解给一下,谢谢了!

laoliu_tj

转一篇文章<br>
<br>
[OBJECTIVE]<br>
<br>
To migrate a user from one domain to another retaining the users SID history and password using ADMT<br>
[LAB CONFIGURATION]<br>
<br>
Two domain controllers, one being a Windows .NET domain controller<br>
[LAB]<br>
<br>
1. Set up the lab environment<br>
•Logon to your computer as Administrator<br>
•Create an external 2 Way trust between your source and target computers<br>
•Add the Domain Admins from each domain to the other domains local administrators group<br>
•On the target computer edit the Default Domain Controllers Policy Object and enable “Computer Configuration/Windows Settings/Security Settings/Local Policies/Security Options/Network access: Let Everyone permissions apply to anonymous users”<br>
•Check that the Everyone system group is a member of the “Pre-Windows 2000 Compatibility Access” group<br>
•If not, at the Command Prompt type “net localgroup “Pre-Windows 2000 Compatibility Access” Everyone /add”<br>
•Reboot the target compter<br>
<br>
2. Install ADMT and generate the key for the Password Export Server<br>
•Install ADMT on the target computer<br>
•Create a folder C:\ADMTKEY and share it out<br>
•At the Command Prompt, change into the folder where ADMT is installed<br>
•Type “admt key SourceDomainName c:\admtkey *” (SourceDomainName = Netbios name of your source domain)<br>
•When prompted enter a password of password<br>
<br>
3. Install the Password Export Server <br>
•On the source computer Create an OU containing a global group and 2 users (one being a member of the global group)<br>
•Make sure you assign a password to each user<br>
•On the source computer create a folder called PWDMIG and copy the pwdmig.exe from the instructor machine and the password .pes file created in the previous step<br>
•Install the Password Export Server by running PWDMIG.EXE when prompted enter the path to the .pes file and enter the password of password (Do not reboot)<br>
•On the source computer run Regedit, under “HKLM/System/CurrentControlSet/Control/Lsa” create the following entries and set both values to 1<br>
•AllowPasswordExport:REG_DWORD (enables password migration)<br>
•TcpipClientSupport:REG_DWORD (enables RPC for SID migration)<br>
•Reboot the source computer<br>
[CONTINUE TO NEXT PAGE]<br>
<br>
[CONTINUIED]<br>
<br>
4. Migrate users to target domain<br>
•On the target computer create a folder and remove all permissions and assign full permissions to both of the users you created in the source domain (this will be used to test SID history is preserved)<br>
•Run ADMT<br>
•Migrate the users you created, from the source domain to an OU in the target domain<br>
•Migrate passwords, SID history and any associated user groups<br>
•Enable target and disable source users<br>
•Say yes to enable auditing on both the source and target domains<br>
•Say yes to creating the DomainName$$$ group on the source domain<br>
<br>
5. Testing Migration<br>
•On the source domain check that your users have been disabled<br>
•On target computer check your OU contains the users and group you migrated<br>
•Run ADSIEDIT and check that the SID history attribute of your users is populated<br>
•Add your users to your Domain Admins Group<br>
•Logon as one of the migrated users to test that the passwords were migrated<br>
•Open Explorer and check that you can access the folder you created in the previous step<br>
<br>
[END OF LAB]

thm0908

兄弟,谢谢了!有没有中文的呀,我的英文不是太好呢?看不懂呀.

FirstWe

Technet里面有很多的介绍，去搜一下！