How to migrate windows users and retain passwords?

Question

I am moving a web application from one server to another, where users log in with Windows accounts (local server accounts, not AD). I want the migration to be as smooth as possible, but re-creating Windows users on the new server means every user must create a new password.

Is there a way to copy the passwords, so the migration is 100% seamless?

@tonyroth: Limited user accounts, migrating from Windows 2003 server -> Windows 2008 server. Not sure if that's what you're asking :) — tenfour, Jan 05 '12 at 17:47
if it was w2k8r2 then you could use http://technet.microsoft.com/en-us/library/dd379531(WS.10).aspx#BKMK_supportedOS. — tony roth, Jan 05 '12 at 18:02

score 6 · Accepted Answer · edited Apr 13 '17 at 12:14

There isn't a "supported" method to do what you're asking for without involving Active Directory (AD). You could promote the current Windows Server 2003 computer to a Domain Controller (DC), which would "promote" all the local accounts to domain accounts. At that point you could join the new server to your domain as a DC and decommission the old server. That would do exactly what you want, but you'll have to use AD.

If you don't want to go w/ AD then you're stuck copying the details of the user accounts and resetting their passwords. I wrote a script to copy local user account properties for another Server Fault question, but that won't handle password migration. That script would be easy to modify, if you have a record of the passwords (which, admittedly, for security reasons isn't a great thing to have), to set the passwords during the copying.

You could use the PasswdHk password filter to capture user password changes on the old server. You'd have to ask everyone to change their password at least once after installing the filter. I can't recommend this course of action in good conscience without warning you that you'll be creating a situation where an attacker could steal the plaintext of your users' passwords by doing this, but it would work to build a password list for migration.

This is what I suspected. I have used some other tool in the past as well which literally copied passwords from one machine to the next, but it was more of a shameful hacker's tool than a sysadmin tool. Thanks for such a complete answer. — tenfour, Jan 05 '12 at 22:53

score 3 · Answer 2 · answered Jun 20 '12 at 12:24

You can give Sys-Manage's CopyRight2 a trial. It has an easy to use graphical user interface that allows you to selecively copy user and group accounts including password hashes from one computer to another. It supports all possible scenarios, e.g. from member server to DC, DC to member server, cross domain, inner domain, workgroup mode... You can download it from their website located at: http://www.sys-manage.com/PRODUCTS/CopyRight/tabid/64/Default.aspx

score 1 · Answer 3 · answered Jun 20 '12 at 12:31

1

Okay maybe my solution is a little bit rude or even illegal but you can try to crack the passwords with on of the many password crackers.

answered Jun 20 '12 at 12:31

Marcel Janus

1,115
2
14
29

score 1 · Answer 4 · answered Feb 22 '17 at 17:02

1

Use Microsoft Windows Migration Tool - Follow this part of the guide for migrating local users. https://technet.microsoft.com/en-us/library/dd379531(WS.10).aspx

answered Feb 22 '17 at 17:02

Jim

11
1

1

The link states that it does not copy passwords. – crokusek Jun 07 '19 at 21:58

How to migrate windows users and retain passwords?

4 Answers4

Linked