This is something that I almost never do so I’m documenting it here to avoid future mistakes.<\/p>\n
We are migrating between domains and while we considered ADMT, there was too much clutter and our AD structure changed.\u00a0 So a piece meal approach was decided on.\u00a0 Hint to future self, don’t do this again, use ADMT!<\/p>\n
I’m transferring groups but this has proved problematic.\u00a0 Two main reasons for this, the AD structure is different and the Domain is different.<\/p>\n
Big lesson first up is that you need to exclude many SAM entry’s using the -o modifier.\u00a0 My command for groups striped out everything but member.\u00a0 However all the member mappings changed so I excluded them as well.\u00a0 I ended up with:<\/p>\n
ldifde -f exportfile.ldf -s <serverName> -d “OU=Tomcat,OU=Security Groups,OU=IBM,DC=<domain>,DC=<domain>,DC=local” -r “(objectCategory=CN=group,CN=Schema,CN=Configuration,DC=<domain>,DC=<domain>,DC=local)” -o “badPasswordTime,badPwdCount,lastLogoff,lastLogon,logonCount,memberOf,objectGUID,objectSid,primaryGroupID,pwdLastSet,sAMAccountType,member”<\/p><\/blockquote>\n
Now to bring that over.\u00a0 I can convert using the -c option.\u00a0 In my case the OU’s lined up on the other side so the command was:<\/p>\n
ldifde -i -f exportfile.ldf -s <serverName> -k -v -c “DC=<domain>,DC=<domain>,DC=local” “DC=<domain>,DC=<domain>,DC=org”<\/p><\/blockquote>\n
I have all the groups but no membership.\u00a0 Use ADMT next time.<\/p>\n
Errors that you can get with any of the SAM accounts is discussed here: https:\/\/support.microsoft.com\/en-us\/kb\/276382<\/a><\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
This is something that I almost never do so I’m documenting it here to avoid future mistakes. We are migrating between domains and while we considered ADMT, there was too much clutter and our AD structure changed.\u00a0 So a piece meal approach was decided on.\u00a0 Hint to future self, don’t do this again, use ADMT!<\/p>\n