Migrate Source Domain(old) to Target Domain(new) with ADMT 3.2

Question

Old DC01(IP:10.0.0.1) OS Windows 2016
Old DC02(IP:10.0.0.2) OS Windows 2016
Old DC03(IP:10.0.0.3) OS Windows 2019
Domain Name: OldDomain.com

Client: Windows 10 (Version 20h2)

New DC01(IP:172.16.0.1) OS Windows 2019
New DC02(IP:172.16.0.2) OS Windows 2019

Domain Name: NewDomain.com

SQL Express 2008 R2 SP2

SQL Express 2008 R2 SP3 Update

ADMT 3.2 (For Service Account/Group/User/Computer Migration)
PSE3.1 (For Password Migration)

---

All DC forest level and domain functional level are Windows 2016
I will share experience with you step by step

Answer 1

ADMT Domain Group Migration

There is a sequence for doing this though, they have been migrated in the correct order;

• First: Universal Groups
• Second: Global Groups
• Third: Domain Local Groups

To locate what types of groups you have, and what they are called, run the following commands;

PowerShell Display all Universal Groups

----------

import-module activedirectory
Get-ADGroup –LDAPFilter "(&(objectCategory=group)(groupType:1.2.840.113556.1.4.803:=-2147483640))"

----------

PowerShell Display all Global Groups

----------

import-module activedirectory
Get-ADGroup –LDAPFilter "(&(objectCategory=group)(groupType:1.2.840.113556.1.4.803:=-2147483646))"

----------

PowerShell Display all Domain Local Groups

----------

import-module activedirectory
Get-ADGroup –LDAPFilter "(&(objectCategory=group)(groupType:1.2.840.113556.1.4.803:=-2147483644))"

----------

ADMT Migrating Groups

How about Distribution Groups? These are created by Microsoft Exchange, if you need to migrate Distribution groups then you can convert them to domain local security groups, then migrate them with ADMT. Note: You may need to fix their Email address manually, that depends on your new email deployment in newdomain.com

Converting Distribution Groups to Security Groups
Run the following commands

----------

$dlGrps = Get-AdGroup -Filter { name -like "GROUP-NAME -AND GroupCategory -eq "Distribution"} | select -exp SamAccountName

foreach ($dl in $dlGrps) { Set-AdGroup $dl -GroupCategory Security }

----------

Answer 2

ADMT User Migration
Please refer Service Account(user) part

![88000-21user-options.jpg][6]

![88069-25migration-progress.jpg][8]

You can see user will added to relative groups automatically

ADMT Security Translation

Of course we can choose more than one computer at the same time

[6]: /api/attachments/88000-21user-options.jpg?platform=QnA [8]: /api/attachments/88069-25migration-progress.jpg?platform=QnA

Answer 3

ADMT Computer Migration

Answer 4