Bit of Background

In the ideal Intra-Forest migration you are consolidating accounts and resources from one domain to another.  The main difference between inter-forest and intra-forest migration is that in intra-forest accounts move (not copy).  How does this create a problem for what I was doing? Well, users in the source domain also had exactly the same SAMAccount name in the target domain and both these accounts are in active use by the same user. All resource access is performed using group access in both source and target domains.

Since the objective of the consolidation is to use the target domain, the majority of the applications users access including Exchange are accessed using the existing account in the target domain, so the target user account will be the account that will be used by all users after consolidation.

Ok, you may say, ADMT has a merge option for migrating user accounts – but this is not available for intra-forest migration. So we can’t do that.  So, what can we do?

Migration Strategy

So the migration strategy that we decided on was as follows:

1) Convert all Global Groups in Source domain to Universal Groups

2) Migrate these Groups to the Target domain

3) Add Target domain “duplicate” accounts to the migrated universal groups

4) Migration Workstation to target domain using ADMT

5)Translate User profile to allow the target account to use the source users profile

6)Migrate Server resources using ADMT.

So steps 1,2,3,4 and 6 are straightforward and can be performed using simple administrative procedures or ADMT, step 5 is not straightforward and this is what the remainder of this post will discuss.

Translating the user profile

This step becomes an issue because normally we would use ADMT to translate the ACLs and profile.  Since we haven’t ADMT’d the user account, when we log on to the workstation with the target account it creates a new profile – this is not what we want.  We want the user to log on to the workstation with the target domain user account and get the profile that they had when they were logging on with the source domain account.

We can do this manually but for a lot of users this means a lot of desktop interaction, testing and making sure that users profile is there.  Ideally as part of the migration process we want this as automated as possible.

Scripting the translation

So I wanted to find a way of scripting this process. So I did a search on the internet and found the following article which did the bulk of what I wanted to do for me.

https://www.pcreview.co.uk/forums/thread-112155.php

It was published back in 2004 and a lot of work was done to get the profile translation right.  In that case, the scenario was translating a workgroup account to allow a new workgroup user to access an existing profile.  So some work needed to be done make it work in an intra-forest migration scenario. The script is principally targeting Windows XP clients. Some work still needs to be done to simplify it and make it work the way we want – but it works!

The script

The script is in the form of a batch file that should be executed using an administrative account as follows:

profiler.bat <target NetBIOS domain Name> <username>

In the script you will notice <srcdomain> – this is the NetBIOS name of the source domain and a reference to a usertosid.vbs script as well as other utilities subinacl and setacl.

The content of the batch file is follows:

subinacl /subdirec “c:documents and settings%2” /setowner=%1%2
subinacl /subdirec “c:documents and settings%2 /replace=<srcdomain>%2=%1%2
subinacl /subdirec “c:documents and settings%2*.*” /setowner=%1%2
subinacl /subdirec “c:documents and settings%2*.* /replace=<srcdomain>%2=%1%2
c:windowssystem32reg load hkuscript_user “c:documents and settings%2ntuser.dat”
setacl usersscript_user /registry /grant %1%2 /full /r:cont_obj /silent
c”windowssystem32reg unload hkuscript_user
for /f %%1 in (‘cscript /nologo usertosid.vbs “%2”’) do set sid=%%i
echo Windows Registry Editor Version 5.00 > temp.reg
echo. >> temp.reg
echo [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionProfileList%sid%] >> temp.reg
echo “ProfileImagePath”=”c:\documents and settings\%2” >> temp.reg
echo. >> temp.reg
regedit /s temp.reg
del temp.reg

Batch File Components

subinacl is a Microsoft utility,the package should be installed on the system running the script and can be found here, :

https://www.microsoft.com/downloads/en/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en

setacl is a third party utility and should be in the folder where the script is being run and can be found here:

https://helgeklein.com/download/

(note that hopefully I will use subinacl to replace this command in a future update)

usertosid.vbs

This script is based on this post: https://www.winvistatips.com/re-get-user-sid-t749526.html

and as is listed as follows:

' user2sid.vbs
'
' Author: MagicWorm
' https://magicw.secuz.org
' Date: 2003-08-22
''''''''''''''''''''''''''''''''''''
Const GENERAL_FAILURE = 2
Dim ArgObj ' Object which contains the command line argument
Dim Args(10) ' Array that contains all of the non-global arguments
Dim ArgCount ' Tracks the size of the Args array
Dim strComputer
Dim Account
Set ArgObj = WScript.Arguments
If ArgObj.Count < 1 or ArgObj.Count >2 Then
DisplayHelpMessage
WScript.Quit (GENERAL_FAILURE)
End If
Select Case ArgObj.Count
Case 1
strComputer = "."
Account = argObj(0)
Case 2
strComputer = argObj (0)
Account = argObj(1)
End Select

On Error Resume Next
Set objWMIService = GetObject("winmgmts:\" & strComputer & "rootcimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_Account where Name = '" & Account & "'" )
For Each objItem in colItems
Wscript.Echo objItem.SID
Next

''''''''''''''''''''''''''''
'
' Display Help Message
'
''''''''''''''''''''''''''''
Sub DisplayHelpMessage()
WScript.Echo
WScript.Echo UCase(WScript.ScriptName) & " By MagicWorm"
WScript.Echo "https://magicw.secuz.org"
WScript.Echo String(80, "_")
WScript.Echo "The goal of the utility is to obtain SID from the account
name, usage:"
WScript.Echo
WScript.Echo UCase(WScript.ScriptName) & " [computer_name]
account_name"
WScript.Echo
WScript.Echo "where computer_name is optional. By default, the search"
WScript.Echo "starts at a local Windows NT computer."
End Sub

I have replaced the section

On Error Resume Next
Set objWMIService = GetObject("winmgmts:\" & strComputer & "rootcimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_Account where Name = '" & Account & "'" )
For Each objItem in colItems
Wscript.Echo objItem.SID
Next

with

On Error Resume Next
Set objWMIService = GetObject("winmgmts:\" & strComputer & "rootcimv2")
Set objaccount = objWMIServce.Get(“Win32_UserAccount.Name=’”& Account &”’, Domain=’<targetdomain>’”)
Wscript.Echo objaccount.SID
Next

This replacement I got from The Scripting Guys

https://blogs.technet.com/b/heyscriptingguy/archive/2004/12/03/how-can-i-determine-the-sid-for-a-user-account.aspx

The reason this replacement was made is because the original script finds the SID of the computer as well, I don’t want that, I want the SID of account in the target domain.

Explaining What the Script does to the Profile:

subinacl /subdirec “c:documents and settings%2” /setowner=%1%2
subinacl /subdirec “c:documents and settings%2 /replace=<srcdomain>%2=%1%2
subinacl /subdirec “c:documents and settings%2*.*” /setowner=%1%2
subinacl /subdirec “c:documents and settings%2*.* /replace=<srcdomain>%2=%1%2

This section sets the owner of the target account on the profile and replaces the SID from the source domain with the SID of the account from the target domain

c:windowssystem32reg load hkuscript_user “c:documents and settings%2ntuser.dat”
setacl usersscript_user /registry /grant %1%2 /full /r:cont_obj /silent
c”windowssystem32reg unload hkuscript_user

This section sets permissions on NTUser.dat for the profile

for /f %%1 in (‘cscript /nologo usertosid.vbs “%2”’) do set sid=%%i
echo Windows Registry Editor Version 5.00 > temp.reg
echo. >> temp.reg
echo [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionProfileList%sid%] >> temp.reg
echo “ProfileImagePath”=”c:\documents and settings\%2” >> temp.reg
echo. >> temp.reg
regedit /s temp.reg
del temp.reg

This section sets the SID of the target domain account in the profilelist in the registry.  This must be in the registry or a new profile will be generated.

Summary

So this is the first effort I’ve put together for the script that works, There does need to be some changes around automation but it works very nicely.  Users can log on with the new account and get their old profile with absolutely no issues and that was primarily the goal.  If any updates are done to the script I will post updates.

I hope people who come across this post find it useful.

Cheers

Jon

So what happens when you get to a customer site and you need to get information on how many servers a customer has in their Active Directory including the Server OS Version and Service Pack level?  You turn to the Microsoft Assessment and Planning Tool…..yeah then you run it and you find that all the ports are blocked and you’re not getting any good information out…….what do you turn to?

Active Directory Users and Computers of course! Ok, you can do this the long way or the short way.  You can go an manually one by one on each server and note down each server in turn but that’s going to take ages, so what about Active Directory queries?  Ah haaaaa – Yes!

So I created a custom query based on Computer –> Operating System starts with “Windows Server”.  This listed all the servers in the domain but still didn’t tell me what OS or Service Pack level was.  There had to be a way and then after a quick search of the web I found this article that solved my problem:

Thank you Pber! https://www.pberblog.com/post/2009/06/21/Add-extra-columns-to-Active-Directory-Users-and-Computers-display.aspx

What this told me was the methodology to add new columns to Active Directory Users and Computers.  So I wanted to see Operating System and Service Pack level.  Using Pber’s methods I modified the default display specifiers extracolumns attribute as follows:

operatingSystem,Operating System,0,-1,0

operatingSystemServicePack,Service Pack,0,-1,0

After Restarting Active Directory Users and Computers I could add the New Columns for Operating System and Service Pack.  Problem Sorted.  This works nicely for AD queries.  As Pber notes in his blog this doesn’t work at OU level and you have to modify the organizationalunit specifiers.

Job done I get a list of servers with all their OS versions and Service Pack levels – sorted!

That’s it – hope this helps anybody stumbling across this.

Welcome to Episode two of my thrilling blog instalments!  This month I thought I'd do a little bit on Ops Mgr.  A little like last month small edible nuggets for those who have read this far can digest.

Right then, let's dive in.

Bite Size Chunks

Ops Mgr is a big product ,right? and there's a lot of management packs out there.  The biggest thing that I see our customers do is get overwhelmed with alerts on installing all the management packs that they want to monitor. What customers don't realise is that when you install a new management pack into a management group all deployed agents in that management group will start reporting events for the new management pack. So if you deploy lots of management packs all at once then expect lots and lots of alerts.  So how can you stop so many alerts coming through to your email? well we can tune the way your notifications are handled. This is based on the fact that alerts are generally designated by Ops Mgr as "Critical Medium" alerts, so configuring the alerts you actually want as "Critical High" will ensure you only get the alerts you need.  Want to know more?  Kevin Holman's blog has way much more information on Ops Mgr than I could ever give you! So rather than repeating this really useful information that Kevin originally posted a couple of years ago here's the link on how to do it: https://blogs.technet.com/b/kevinholman/archive/2008/06/26/using-opsmgr-notifications-in-the-real-world-part-1.aspx

That's it for this month, thanks for reading!

Until next month....Bloggy Oi! 

False Start....right try again? Start with what though? Arggh am I just contributing to lots of other inane stuff out there?  Right - got off track, start again.  This is isn't going well.

Hello poor unfortunate who has arrived at this place - sorry nothing good here yet. !!$#&*>? Done it again haven't I? - Got off track,  Ok let's start with  a nice heading. No, this is even worse I'm talking to myself on my own new blog???? Whaaat?

Introduction?

Hi I'm Jon Sabberton, a Senior Consultant in MCS based out of Dubai in the UAE. (Now I'm an American talk show host! arrgghhh).  Ok so what I'm hoping to do in these ramblings is hopefully give out some information that someone somewhere will actually find of some use.  Initially I'm not sure I'm going to give you anything mindblowingly special or make you go oooooooo, but hopefully you'll check back now and again to see what's going on.

Ok I'm going to try and write something vaguely techie-like now.  So for you non techie types (Hello Mum and Dad!, Hello Mrs S) best leave now as that's the interesting stuff done with as I'm going to attempt some geeking:

System Center Service Manager 2010

Every now and then a product comes along that blows my mind.  This is one of them. So I thought I'd just give out a couple of very high level pointers on this to get you started thinking about what you need if you're considering putting this in

Pointer one:  It works really well if you have - Active Directory, Configuration Manager and Operations Manager in your environment (note to self and reader <singular> this doesn't mean it doesn't work well if you don't have all three - you just get less information to work with)

Pointer two: Clean up your Active Directory of all stale objects like Computer accounts and User accounts that are old and don't need to be there.

Pointer three: A little bit like the above but.... with Configuration Manager - give it a nice spring clean - make sure it's happy and give it a bit lovin' - make all those services show green in the status node....and I don't mean by cheating and resetting all the statuses so they appear Green only to give you warnings and errors a few minutes later - really get them sorted.

Pointer four: Guess what? The same with Operations Manager....this one is more tricky - particularly those of you (and I know that you're there) that think that a happy Operations Manager is when the console is closed and you can't see those alerts waiting for you because if your console is closed there's nothing wrong right?.......Now is the time to sort those alerts out and get tuning those management packs so you're getting the alerts you want to see - If you don't they'll only come and haunt you in Service Manager...and then the entire helpdesk and your management team can see what you're not dealing with.

Pointer Five: This is a biggy. In Service Manager we want to map your processes and procedures into Service Manager workflows.  We can't do this if you haven't defined Incident Management or Change Management in your organisation.  If we have no idea how your organisation handles and incident or a change how can we map it? So get some Operations Consulting - get all your processes these mapped using an ITIL or MOF specialist (note to reader - I orginially had a MOF joke here......removed due to taste and decency and primarily because my Mum is reading this - Hello Mum)  - this may take some time. :0)

Pointer Six: Once this is done we're good to go. The minimum, weeniest deployment of Service Manager needs 2 servers! Yes TWO as in the answer to 1+1 or 10 in binary (oooh technical). The first server is for Service Manager Console and Workflows and all the good Stuff, the second is for the Datawarehouse server, these cannot co-exist...This is by design.

Outro

OK, this typing about stuff is exhausting and is making me think - something the pea rolling around in my skull isn't really used to. I think this will do for my first effort.  If you've read this far thanks very much and hopefully it wasn't too useless - At some point I'll make it look nice.  I'll be back soon with some more inane ramblings but for now......My Name's Jon Sabberton, thankyou and Goodnight.(roll credits - cue applause?)

Cheers

Sabbs

Bloggy! Oi!