Migrate Source Domain(old) to Target Domain(new) with ADMT 3.2

Question

Old DC01(IP:10.0.0.1) OS Windows 2016
Old DC02(IP:10.0.0.2) OS Windows 2016
Old DC03(IP:10.0.0.3) OS Windows 2019
Domain Name: OldDomain.com

Client: Windows 10 (Version 20h2)

New DC01(IP:172.16.0.1) OS Windows 2019
New DC02(IP:172.16.0.2) OS Windows 2019

Domain Name: NewDomain.com

SQL Express 2008 R2 SP2

SQL Express 2008 R2 SP3 Update

ADMT 3.2 (For Service Account/Group/User/Computer Migration)
PSE3.1 (For Password Migration)

---

All DC forest level and domain functional level are Windows 2016
I will share experience with you step by step

Answer 1

ADMT – Database Requirement
1.Download SQL Express 2008 R2 SP2 and SQL Express 2008 R2 SP3 Update

2.Install SQL Express 2008 R2 SP2 in one of your old domain (i.e old DC03) and one of your new domain(i.e new DC02)

Account is NewDomain\ADMT Admin

Add NewDomain\ADMT Admin to Specify SQL Server Administrators

3.Install SQL Express 2008 R2 SP3 Update

4.Grant Permission of SQL on Domain Controllers

Open CMD run the following commands(On Domain which you installed SQL Express i.e Old DC03 and New DC02)

---

NET LOCALGROUP SQLServerMSSQLUser$Target-DC$SQLEXPRESS /ADD

SC SHOWSID MSSQL$SQLEXPRESS

{Copy the SID to the clipboard you will need it later}
MD %SystemRoot%\ADMT\Data
ICACLS %Systemroot%\ADMT\Data /grant *{Paste the SID from above}:F
i.e.
ICACLS %systemroot%\ADMT\Data /grant *S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133:F

---

Answer 2

Disabling SID Filtering

1.On your Old Domain(i.e Old DC03) run CMD with administrator rights then run the following command

---

NETDOM TRUST {source-domain} /domain:{target-domain} / UserO:{username} /PasswordO:{password} /Quarantine:NO

i.e NETDOM TRUST OldDomain.com /Domain:NewDomain.com /UserO:Administrator /PasswordO:P@$$W0rd /Quarantine:NO

(I use Administrator and P@$$W0rd) you should type your actual password

---

Remember the SID warning message in Domain Trust part that's why we should disabling SID filtering

ADMT: Set up Password Export Server

1.On your New Domain(i.e New DC02) run CMD with administrator rights then run the following command

---

admt key /option:create /sourcedomain:{source-domain} /keyfile:”C:\PES.pes” /keypassword:{password}

i.e admt key /option:create /sourcedomain:OldDomain.com /keyfile:”C:\PES.pes” /keypassword:PE$W0rd

**- source-domain: OldDomain.com

• keyfile: Where you want to save the keyfile.(I name it PES and save it in C:)
• keypassword: We will need it to setup the password export server, so don’t forget it.**

---

You will see PES.pes in your C:\ if everything runs OK

1. Copy PES.pes from NewDomain(i.e New DC02) to OldDomain(i.e Old DC03)
2. Download Password Export Server 3.1
3. Install Password Export Server 3.1 in OldDomain(i.e Old DC03) (Install it via command line or you will see error messages later although your keypassword is correct ) We can copy that downloaded file to C:\ then open CMD with administrator rights run msiexec /i C:\pwdmig

Choose PES.pes you copy from NewDomain(i.e New DC02) to OldDomain(i.e Old DC03) Before Type in password the same as keypassword when you create PES.pes (i.e PE$W0rd my password)(Install via command line in the beginning or you will get error message here although your password is correct)

Choose account NewDomain\admtadmin

Open Services on your OldDomain(i.e DC03) Change Start up Type to Automatic then start it

Answer 3

ADMT-Agent deployment Pre-Setting
For computer and security translations required ADMT Agent installed in computers on Old Domain

Disable local firewall and services setting

1.Create GPO and link to actual OU

2.Name GPO (i.e disable local firewall)

3. Edit GPO

4. Navigate to

Computer Configuration >Policies > Administrative Templates > Network > Network Connections > Windows Firewall > Domain Profile

Computer Configuration > Polices > Windows Settings > Security Settings > System Services

Make sure ADMT Admin added to security

Answer 4

ADMT-Migration
Login as ADMT Admin on your NewDomain which installed ADMT(i.e DC03)
Make sure you follow this order for Migration

1. Services Account Migration
2. Groups Migration
3. Users Migration
4. Computer Security Translation
5. Computer Migration

And I suggest you can create actual OU on your NewDomain(i.e Migrated Items)

---

Services Account Migration

Replaces any service accounts on the Old Domain(OldDomain.com) machines with migrated service accounts from the New Domain(NewDomain.com)

1.Open ADMT on your New Domian(i.e DC02)

2.Choose Service Account Migration Wizard

3.Migration

Answer 5

Services Account Migration(User)

If everything runs OK you can see(The machine on olddomain) the service account has been changed(i.e newdomain\syncservice)