-1

I've been running a Windows 2003R2 AD ad1.local for some time. Two DCs are involved in this domain.

Some time later on, another AD was created, ad2.local. This AD was also hosted on Windows Server 2003 systems. One of the servers on this AD was a system with a 1TB raid drive. Some time ago trust between the two domains was implemented. With that done, users from ad1.local could authenticate on ad2.local to obtain access to the 1Tb drive. On the latter, a lot of directories were made with different group/user permissions from the ad1.local AD.

This is a troublesome setup, especially now that we have a roadmap of moving everything to VMs (finally!!!) on some new hardware, plus upgrade to Windows 2019 (not directly, if we want to keep our ad1.local user accounts and stuff). One step of this process is moving this multitude of data from the 1Tb ad2.local system to be directly accessible from ad1.local, but keeping permissions intact.

I don't know if this is possible. In simple terms I would like to "move" this ad2.local system to join ad1.local. If it was a workstation things would be easy: leave the ad2.local AD, reboot a couple of times to get rid of the policies and then join the ad1.local AD.

But in my scenario the 1tb disk holds complex permissions (who from ad1.local can see or write or modify what on which subdirectory). I presume that all this information will be lost doing this exit ad2.local -> enter ad1.local domain dance...

I'm also willing to follow other alternatives. I do have a NAS which can server iSCSI shares. I could attach it perhaps on the system hosting the ad2.local 1tb disk to clone it, and then connect this iSCSI to one of my ad1.local servers?

Really clueless on how to accomplish all this. Any info will be appreciated!

For the record, I do not employ roaming profiles in ad1.local. I do have a number of GPOs in place to have shared disks appear on my ad1.local users pointing to this ad2.local shared disk, which could be changed of course.

EDIT The thread is locked and I can not post this as a solution, but I'll leave this for whoever stumbles into a similar issue:

I cloned the disk from the 1tb on the ad2.domain system to an iSCSI drive (obviously a physical drive would do, but since this is a server system, it was not easy to remove physically disks since they are RAID members; perhaps an external USB drive would suffice). I then disconnected the iSCSI drive and connected it to one of my ad1.domain servers and presto: all permission were there, everything worked perfectly, without even subinacl! The only thing I had to do is create the shares, which was rather easy!

carmik
  • 149
  • 11

1 Answers1

1

You need to create a mapfile and use the Active Directory Migration Tool(ADMT). For more information about how to use ADMT, please refer to the following article:

ADMT v3.1 Guide: Migrating and Restructuring Active Directory Domains http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=19188

Active Directory Migration Tool version 3.1 http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=17918

Active Directory Migration Using ADMT 3.1 http://www.sivarajan.com/admt.html

...Or go with the SUBINACL command. Take a look at this link on TechNet: https://social.technet.microsoft.com/Forums/windowsserver/en-US/f36ada21-63e9-4902-8951-36eafe62b497/migrate-file-server-to-new-domain-and-export-ntfs-permission?forum=winserverMigration

Larryc
  • 315
  • 1
  • 5
  • From a quick read, subinacl seems more feasible for me. I've cloned the 1tb disk to another iSCSI one. Used `Robocopy source1tbdrive dest1tbiSCSIdrive /mir /flags:datsou` so I've taken all security information for the files. I can attach this disk to the ad1.domain. Any idea on how should I go from there, considering that this disk contains already references to ad1.local users? Any chance that I won't have to do anything at all? – carmik Aug 19 '20 at 10:02
  • Setup the mapfile.txt file before you run Subinacl. Depending on the number of files, this could take some time for the task to complete. After that, you should be good to go. Good luck. – Larryc Aug 19 '20 at 18:34