Binary Tree 10.2 Active Directory Pro User Guide

Active Directory Pro 10.2

User Guide

March 2017

Binary Tree Documentation

Table of Contents

Section 1. Introduction.............................................................................................. 4

1.1 About Active Directory Pro ............................................................................................................ 4

1.2 Audience for Active Directory Pro .................................................................................................. 5

1.3 Getting More Information ............................................................................................................. 5

Section 2. Migration Project Management...................................................................... 6

2.1 Active Directory Pro Architecture ................................................................................................... 6

2.2 Planning the Migration Project....................................................................................................... 6

2.3 Best Practices ............................................................................................................................... 7

Section 3. Configuring the Active Directory Pro Profile ....................................................... 9

Section 4. Using the Active Directory Pro Console........................................................... 10

4.1 Launching the Active Directory Migrator Console .......................................................................... 10

4.2 Refreshing Data .......................................................................................................................... 10

4.3 Creating Mapping Files ................................................................................................................ 10

4.4 Migration Groups ........................................................................................................................ 11

4.5 Using Blacklists ........................................................................................................................... 12

4.6 Grouping, Sorting, and Filtering Tables ......................................................................................... 12

4.7 Customizing Columns .................................................................................................................. 14

4.8 Selecting Multiple Table Rows...................................................................................................... 15

4.9 Triggering a Sync ......................................................................................................................... 15

4.10 Exporting the Grid ..................................................................................................................... 16

Section 5. Migrating Users ....................................................................................... 17

Section 6. Migrating Rooms ...................................................................................... 21

Section 7. Migrating Contacts ................................................................................... 23

Section 8. Migrating Groups ..................................................................................... 25

Section 9. Settings ................................................................................................. 28

9.1 Migration Options ....................................................................................................................... 28

9.2 Credentials ................................................................................................................................. 29

9.3 Network Profiles ......................................................................................................................... 31

9.4 Device ReACL Profiles .................................................................................................................. 32

9.5 NAS ReACL Profiles...................................................................................................................... 37

9.6 Menu Actions ............................................................................................................................. 41

9.7 Custom Menu Action Example ..................................................................................................... 46

9.8 Global Variables .......................................................................................................................... 47

9.9 Credential Cache and Offline Domain Join .................................................................................... 48

9.10 Admin Agents ........................................................................................................................... 52

9.11 Admin Agent Example ............................................................................................................... 55

Active Directory Pro 10.2 User Guide

2

Binary Tree Documentation

Section 10. Migrating Devices ................................................................................... 60

Section 11. Migrating NAS........................................................................................ 69

Section 12. Reports ................................................................................................ 73

Section 13. Using the Directory Sync Pro Log Viewer ....................................................... 79

13.1 Searching Log Entries................................................................................................................. 79

13.2 Pausing a Log ............................................................................................................................ 79

13.3 Showing Log Entries for a Time Period ........................................................................................ 80

13.4 Filtering the Log ........................................................................................................................ 80

13.5 Grouping the Log by Column ...................................................................................................... 80

13.6 Viewing Log Entry Details........................................................................................................... 81

13.7 Exporting Log Entries ................................................................................................................. 81

13.8 Clearing Log Entries ................................................................................................................... 81

Section 14. Troubleshooting ..................................................................................... 82

Appendix A. Cutover Job Result Codes......................................................................... 85

Appendix B. SMART Active Directory Reporter ............................................................... 87

Appendix C. Advanced Network Requirements .............................................................. 96

Active Directory Pro Port Requirements ............................................................................................. 96

Directory Sync Pro to SQL Server Access............................................................................................. 96

Directory Sync Pro Profile Specific Scenario Requirements .................................................................. 96

Appendix D. Active Directory Pro SQL Re-permission ....................................................... 98

Appendix E. Creating Linked Exchange Account............................................................ 103

Appendix F. Sample Admin Agent PowerShell Script ...................................................... 105

About Binary Tree................................................................................................ 109

Binary Tree Social Media Resources ................................................................................................. 109

Active Directory Pro 10.2 User Guide

3

Binary Tree Documentation

Section 1. Introduction

Active Directory Pro features a new name and logo, but is the same, trusted product previously known as SMART

Active Directory Migrator.

1.1 About Active Directory Pro

Whether your company is performing an Active Directory Migration as a result of an acq uisition, merger, or divestiture, or simply as part of rebuilding an existing Active Directory restructure to meet technical or organizational needs, Active Directory Pro dramatically reduces risks, complexity, time, and costs associated with migrating and synchronizing their Active Directory environment to an existing or new Active Directory environment.

Active Directory Pro



Is a comprehensive software solution that seamlessly migrates AD objects, settings and properties



Has a back-end migration and synchronization engine



Has a front-end management console providing complete control of the migration



Ensures security and reliability of the product



Provides complete migration of relevant obj ects and properties



Migrates AD objects even if the source and target servers are not connected and are on isolated networks



Allows for migrations to occur during business hours with minimal effect on user productivity



Allows administrators to perform all migration-related tasks during business hours, reducing the administrator’s workload



Maintains transparent interoperability during the migration



Provides users access to all network resources, regardless of the migration status



Includes password and SID Hi story synchronization capabilities that provide real -time data



Allows cutover of devices to a new domain without them having to contact a target domain controller



Includes the ability within the software to create custom jobs, such as the ability to downlo ad files locally to managed devices



Provides the ability to reverse the changes after key steps in the migration process



Can be used for any migration scenario, from consolidation to a restructuring of AD



Can be customized to meet unique requirements of any organization



Is highly conducive for migration of workstations in a distributed workforce

Key Features



Complete migration



Minimal downtime or interruptions to users



Provides coexistence

Active Directory Pro 10.2 User Guide

4

Binary Tree Documentation



Synchronization of AD objects



Safe with ability to recover original state



Flexible migration



Highly customizable



Synchronizes SID history



Ability to copy Passwords



Credential Caching and Offline Domain Join



Highly conducive for migration of workstations in a distributed workforce

1.2 Audience for Active Directory Pro

This document assumes the reader has some experience using Active Directory and some basic Administration skills. A fundamental understanding of SIDs (Security Identifiers) is also beneficial.

1.3 Getting More Information

For additional resources, refer to Support:

www.binarytree.com/support

Active Directory Pro 10.2 User Guide

5

Binary Tree Documentation

Section 2. Migration Project Management

2.1 Active Directory Pro Architecture

The first step towards success on a project using Active Directory Pro is to understand the product architecture and how this architecture will operate in your environment.

Active Directory Pro consists of the following components :



A directory synchronization engine



A REST based web service



A management interface



A lightweight agent for workstations and member servers



A database running on Microsoft SQL Server

The directory synchronization engine, the web service, and the management interface will all access the same SQL database. In most scenarios, these components will be installed on the same system. In larger or more complex network environments, the components can be distributed across multiple systems. If the director y synchronization engine, the web service or the management interface is installed on a separate system, it is important to ensure that all three components retain access to the same SQL database.

The directory synchronization engine is provided by Binary Tree’s Directory Sync Pro. Directory Sync Pro is included as part of Active Directory Pro. Directory Sync Pro is responsible for synchronizing users and groups between source and target Active Directory domains. Directory Sync Pro also handles migrating key user properties such as

SID History and user passwords.

User workstations and member servers are called devices in Active Directory Pro. Devices communicate with the

Active Directory Pro web service using the Active Directory Pro Agent. The Active Directory Pro Agent is a lightweight application that installs as a service on Windows devices. Upon installation, the agent has the abi lity to autodiscover the location of the Active Directory Pro web service.

To ensure that no firewall exceptions are required, the web service does not “call” the workstations or servers to be migrated. Instead, the Active Directory Pro Agents contact the web service at defined polling intervals, using standard HTTPS or HTTP requests to recovers jobs. Jobs include key tasks such as system discovery, updating the operating system, file system and user profile permissions, and migrating the device to the new domain.

2.2 Planning the Migration Project

A typical migration project using Active Directory Pro can be broken up into phases.



Phase 1: Installing and Creating the Synchronization Profile wi thin Directory Sync Pro



Phase 2: Register Devices (Concurrent with Phase 3)



Phase 3: Identify Users, Rooms, Contacts, and Groups to Migrate (Concurrent with Phase 2)



Phase 4: ReACL Devices and NAS



Phase 5: Cutover Devices



Phase 6: Cleanup

Active Directory Pro 10.2 User Guide

6

Binary Tree Documentation

The Cleanup process typically occurs several months after the completion of the project.

2.3 Best Practices

Best practices for each phase of the migration project are presented below:

Phase 1: Installing and Creating the Synchronization Profile within Directory Sync Pro



Directory Sync Pro is used to synchronize objects and must be installed before installing the Active

Directory Pro Console and Web Service.



The AD Migration/Synchronization profile should be set up to include every device. However, not every device needs to be migrated immediately. This process ensures they are in the database, ready to install the Active Directory Pro agent and register themselves. Devices can be blacklisted if you do not want to immediately migrate them.



Carefully consider the Group Collision option (Merge, Skip, Rename). It is recommended that this option is not changed once migrations have been started. Additionally, it is strongly recommended to not select the Skip option. The Merge and Rename options are better in most cases.



Synchronizing SID History is recommended.

Phase 2: Register Devices (Concurrent with Phase 3)



The Device Agent should be pushed out to devices via Group Policy (GPO) or third party tool and sufficient time should be allowed to address any issues with device registration with the server. Correcting registration issues can take more time than expected. A typical large company with a large number of devices may need a couple of weeks of off and on work to resolve registration issues with all devices.

Phase 3: Identify Users, Rooms, Contacts, and Groups to Migrate (Concurrent with Phase 2)



Before migrating users and groups, do some planning and analysis to see what users, rooms, contacts, and groups should be migrated, what groups need to be consolidated, how duplicates will be handled, etc.



More than one synchronization profile can be used to control the target destinations of users, rooms , contacts, and groups.



User Accounts should be disabled in the target.



Identifying users, rooms, contacts, and groups to Migrate can be accomplished concurrently with resolving device registration issues in Phase 2.

Phase 4: ReACL Devices and NAS



Run a ReACL on as many devices as possible early in the process.



Troubleshoot any devices that did not ReACL.



ReACL again close to the actual cutover date. This will allow you to complete most of the ReACL process early and provide time to resolve any issues with things such as Anti -Virus software and Group Policies.

ReACL is a non-destructive process that can be repeated as often as necessary.

Phase 5: Cutover Devices



Create some test users, groups, and devices to verify a successful user and group migration and device cutover.

Active Directory Pro 10.2 User Guide

7

Binary Tree Documentation



Create any custom jobs that may be required to run against users, rooms, groups, contacts or devices.



Typically, a final ReACL would occur the weekend before the cutover to ensure any new users and other changes are processed.



A workstation reboot is required after the target account is enabled, source account is disabled, and the workstation cutover is complete. This is usually completed in the evening when fewer users are affected.

The affected users should be alerted that this reboot is necessary.

Phase 6: Cleanup



The cleanup phase typically takes place about two months after all device cutover is complete. Cleanup includes removing all permissions from the source domain and removing the Active Directory Pro Agent from the devices.



Before executing the cleanup job, it is recommended to disable SID filtering/quarantine to verify there are no issues with application access before completing the cleanup process.

Active Directory Pro 10.2 User Guide

8

Binary Tree Documentation

Section 3. Configuring the Active Directory Pro Profile

An AD Migration/Synchronization profile must be created in Directory Sync Pro. Refer to the

Directory Sync Pro

User Guide for AD Migration/Synchronization and Exchange Migration

for detailed information on creating an AD

Migration/Synchronization profile.

Active Directory Pro 10.2 User Guide

9

Section 4. Using the Active Directory Pro Console

Binary Tree Documentation

4.1 Launching the Active Directory Pro Console

To launch the Active Directory Pro console:

1.

Double-click the Active Directory Pro Console desktop shortcut.

OR

Select

Active Directory Pro Console

on the Apps screen or in the Start menu.

The Active Directory Pro screen appears briefly and the application opens.

The Active Directory Pro Console will not launch until a license for AD Migration/Synchronization is applied in the Directory Sync Pro Console. Refer to the Directory Sync Pro User Guide for AD

Migration/Synchronization and Exchange Migration for information on applying a license in the

Directory Sync Pro Console.

4.2 Refreshing Data

Use the Refresh button to refresh the data currently displayed in the table. The refr eshed data will display all previous changes to the database and the currently available right click-options. All selected filter options will not be affected by refreshing.

To refresh the data displayed in the table:

2.

Click the

Refresh

button .

4.3 Creating Mapping Files

Use the Create Mapping Files button to generate the User Mapping File (Map.usr) and Group Mapping File

(Map.gg). These files are automatically created during the ReACL process so the only time they need to be created manually is when re-permissioning SQL databases. This process is otherwise not required.

To create the mapping files:

1.

Click the

Create Mapping Files

button .

Active Directory Pro 10.2 User Guide

10

Binary Tree Documentation

2.

The Mapping Files window appears and displays the location of the created Map.usr and Map.gg files.

Click

OK

.

Each time the Create Mapping Files process is run, the Map.usr and Map.gg files are overwritten.

If the Active Directory environment is non-English, the values in the sAMAccountName column of the BT_SystemGroup table in the SQL database will need to be cha nged after Directory Sync

Pro is installed to have the appropriate non-English values.

4.4 Migration Groups

Objects in the table can be grouped into Migration Groups for migration process management. Migration Groups allow for filtering to be able to sync smaller groups of objects. An item can be part of a single Migration Group only.

To set Migration Group for objects:

1.

Click on table rows to select one or more objects in the list. (Use Ctrl -Click to select more than one row.)

2.

Right-Click to view the options menu and select

Set Migration Group

.

3.

Select a migration group from the drop-down list or click

New

to create a new Migration Group for the selected objects. To remove a previously select migration group, select

<None>

from the drop-down list.

4.

If creating a new Migration Group, enter a Migration Group Name.

5.

Click

Save

. The Migration Group column is populated for the selected objects.

Import Migration Groups

The import Migration Groups feature allows a CSV file to be imported with objects and their matching migration groups.



Duplicate objects in the CSV will not be stamped with a migration group.



Objects names can be the sAMAccountName (for Users, Rooms, Groups, and Devices) or the

Distinguished Name (for Users, Rooms, Contacts, Groups, and Devices).

Active Directory Pro 10.2 User Guide

11

Binary Tree Documentation

To import Migration Group values:

1.

Click the

Import Migration Groups

button .

2.

Select a CSV file containing the Migration Group names and click

Open

.

The CSV file should have two columns. The first column is Object Name and the second column is

Migration Group Name. An example file is below: jsmith,Windows 7 Group mjones,Windows 7 Group jtaylor,Windows 8 Group

An example file entry for Contacts is below:

CN=John Smith,DC=domain,DC=dom,Windows 7 Contacts

3.

Click

OK

on the confirmation window. Click

Export Results

to export a file containing the matching results.

4.5 Using Blacklists

Objects can be added to the blacklist. Blacklisted objects will not be displayed unless the "Show Blacklisted" option is selected. Blacklisted objects cannot have actions performed on them, except

Set Migration Group

and

Mark as

Migrated

.

To add objects to the blacklist:

1.

Click on table rows to select one or more objects in the list. (Use Ctrl -Click to select more than one row.)

2.

Right-Click to view the options menu and select

Add to Blacklist

. The selected objects are removed from the displayed list.

3.

Select the

Show Blacklisted

option to view the blacklisted objects.

To remove objects from the blacklist:

1.

Select the

Show Blacklisted

option to view the blacklisted objects.

2.

Click on table rows to select one or more objects in the list. (Use Ctrl -Click to select more than one row.)

3.

Right-Click to view the options menu and select

Remove from Blacklist

. The selected objects are removed from the displayed list.

4.

Deselect the

Show Blacklisted

option to view the non-blacklisted objects.

4.6 Grouping, Sorting, and Filtering Tables

The data table can be grouped by column headers, sorted by column or filtered.

Grouping

To group the data table by column headers:

1.

Click and drag a column header to the area above the column headers to group by that column header.

Active Directory Pro 10.2 User Guide

12

Binary Tree Documentation

2.

Click and drag additional column headers to create child groups.

3.

To remove a grouping, rollover and click the "X" in the grouped by column heading.

Sorting

To sort the data table by column headers:

1.

Click a column header to sort the table by the column in ascending order.

2.

Click the column header again to sort the table by the column in descending order.

3.

Click the column header a third time to remove the column sort and return to the default sort.

Filtering

To filter the data table with the column filters:

1.

Click the filter icon in the column header. The filter options window appears.

2.

Select filter options and then click

Filter

. The table is updated as options are selected. The filter icon is darkened when applied.

3.

To remove the column filter, click the filter icon and click

Clear Filter

.

4.

To clear all column filters, click the

Clear All Column Filters

button and select

Clear All Column Filters

.

or right-click on the header row

To filter the data table by Directory Sync Pro Profile:

1.

Select a profile from the

DirSync Profiles

drop-down list. The table is updated to display only objects associated with the selected Directory Sync Pro profile. By default, objects from

All Profiles

are displayed.

Active Directory Pro 10.2 User Guide

13

Binary Tree Documentation

To filter the data table by Migration Group:

1.

Select a migration group from the

Migration Group

drop-down list. The table is updated to display only objects in the selected migration group. By default, objects from

All

batches are displayed.

4.7 Customizing Columns

The default data tables do not display every available column. However, the displayed columns can be customized.

Also the column order can also be changed.

To choose displayed columns:

1.

Click the

Choose Columns

button in the table header

Choose Columns

. The Choose Columns window appears.

or right click on the header row and select

2.

Select the columns to display in the table.

3.

Click

OK

. The table is updated with the selected columns.

To change the order of columns:

1.

Click and drag the column header and drop it in a new location. The table is updated.

Active Directory Pro 10.2 User Guide

14

Binary Tree Documentation

4.8 Selecting Multiple Table Rows

There are several ways to select multiple table rows.

To select all table rows:

1.

Click the

Select All

button in the table header default.

or use

Ctrl+A

. The first 1000 rows are selected by

By default, the first 1000 rows are selected. This setting can be changed in SQL in the

ADM_Setting table field SelectAllLimit.

2.

Perform a right-click action to the selected rows.

If attempting to select more than 1000 rows at time, perform the action on the first 1000, filter the list based on the action, and then select all again.

To select more than one table row:



Use

Ctrl+Click

to select more than one row.



Use

Shift+Up/Down Arrow

to select additional rows before or after the currently selected row.



Use

Shift+Pg Up/Pg Dn

to select all rows before or after the currently selected row.

The following key shortcuts do not work: Shift+Ctrl+End, Shift+Ctrl+Home, Shift+Ctrl+Page Down,

Shift+Ctrl+Page Up, Shift+Left Click, Click+Shift+Left Click.

4.9 Triggering a Sync

Use the Sync button to sync the data currently displayed in the table. Select a different Directory Sync Pro Profile before starting a sync to synchronize just that configured Source to Target. If

All Profiles

is selected, all of the

Directory Sync Pro Active Directory Pro profiles will be synchronized. If the Directory Sync Pro Active Directory Pro profile has been set to synchronize on a schedule, manually starting a sync i s not necessary.

Only objects marked as "Ready to Sync" will be synced to the target.

To sync the data displayed in the table:

1.

Click the

Sync

button .

2.

After clicking the Sync button the following confirmation for the synchronization of the selected Directory

Sync Pro Profile will be displayed.

Active Directory Pro 10.2 User Guide

15

3.

If

All Profiles

are selected the prompt will appear as follows:

4.

If a sync is already running the following will be displayed:

4.10 Exporting the Grid

The view as it is currently sorted and filtered can be exported to a file.

To export the grid:

1.

Click the

Export Grid

button .

2.

Click

OK

on the Export All? confirmation window.

3.

Select a location, enter a file name, select a type and then click

Save

.

Binary Tree Documentation

Active Directory Pro 10.2 User Guide

16

Binary Tree Documentation

Section 5. Migrating Users

The Users screen allows users to be synchronized to the target as well as enable and disable users on the source and target before cutover occurs.

Sync Users

To sync users to the target:

1.

Click on table rows to select one or more users in the list (Use Ctrl -Click to select more than one row).

2.

Right-Click to view the options menu and select

Ready to Sync

. The Ready to Sync column for the selected users becomes checked. The selected users are synced during the next sync cycle (scheduled in Directory

Sync Pro or triggered manually with the Sync button in Active Directory Pro).

If the Ready to Sync column doesn’t display all of the check marks expected, click on the

Refresh

button to refresh the data in the table.

3.

To prevent the users from syncing, select the users and select

Not Ready to Sync

from the right-click menu.

Enable and Disable Users

To enable/disable users on the source or target.

1.

Click on table rows to select one or more users in the list (Use Ctrl -Click to select more than one row).

2.

Right-Click to view the options menu and select one of the following options:



Enable on Target only



Enable on Target/Disable on Source



Enable on Source only



Enable on Source/Disable on Target

The Source UAC and/or Target UAC columns of the selected users is updated.

Active Directory Pro 10.2 User Guide

17

Binary Tree Documentation

A sync must be performed before the selected Enable/Disable User option takes effect.

The Allow Enable/Disable of Mailbox Enabled Source Objects option in the AD

Migration/Synchronization Directory Sync Pro Profile must be set to Yes if the ability to change the User Account Control (UAC) on the Source account is desired. If this is option is set to No, the Disable/Enable Source Actions in Active Directory Pro will not work (for the Source account).

Mark as Migrated

As a way to mark the User Accounts that are fully completed, that require no further action, they can be set as migrated:

1.

Click on table rows to select one or more users in the list.

2.

Right-Click to view the options menu and select

Mark as Migrated

.

3.

Click

Save

. The Migrated column of the selected users is checked.

Admin Agent Menu Actions

If Admin Agent menu actions have been created for Users, they will appear in the right-click options menu:

1.

Click on table rows to select one or more users in the list.

2.

Right-Click to view the options menu and select an Admin Agent action.

3.

In the Job Options window, check

Do not start before

and enter a date if you do not want the job to begin immediately. Select the

Admin Agent

and the

Agent Admin Credentials

to use from the drop-down lists.

4.

Click

OK

. The Queue Summary appears.

5.

Click

OK

.

Active Directory Pro 10.2 User Guide

18

Binary Tree Documentation

User Columns

The following columns appear on the Users screen by default:



Migration Group- The Migration Group name. Use the Right-click

Set Migration Group

option to change.



First Name - the first name attribute of the source user account



Last Name - the last name attribute of the source user account

 sAMAccountName - the sAMAccountName attribute of the source user account



Display Name - the display name attribute of the source user account



Distinguished Name - the distinguished name attribute of the source user account



Target Distinguished Name - the distinguished name attribute of the target user account. This column is populated when a user is synced.



Description - the description attribute of the source user account



Migrated – An optional tag that can be manually set to track migration progress. Use the Right-click

Mark as Migrated

option to change.



Ready to Sync - This is checked if the user account is currently ready to sync. Use the Right-click

Ready to

Sync

option or

Not Ready to Sync

option to change.



Created - This is checked if the user account has been created in the target



Source UAC - Indicates if the user account is enabled in the source. Use the Right-click Enable/Disable

User options to change.



Target UAC - Indicates if the user account is enabled in the target. Use the Right-click Enable/Disable User options to change.



Last Sync - Displays the date/time of the l ast sync.

The following additional fields can be displayed by customizing the columns:



ID - SQL record number



Migration Group ID



Blacklisted - This is checked if the user is currently on the blacklist. Use the Right-click

Add to Blacklist

option or

Remove from Blacklist

option to change.



Alias



Assistant



Company



Country



Country Code



Country Name



Deleted Item Flags

Active Directory Pro 10.2 User Guide

19



Delivery Content Length



Department



Department Number



Division



Employee ID



Employee Number



Employee Type



Extension 1 - 15



Manager



Object SID

Binary Tree Documentation

Active Directory Pro 10.2 User Guide

20

Section 6. Migrating Rooms

The Rooms screen allows rooms to be synchronized to the target.

Binary Tree Documentation

Sync Rooms

To sync rooms and resources to the target:

1.

Click on table rows to select one or more rooms in the list (Use Ctrl -Click to select more than one row).

2.

Right-Click to view the options menu and select

Ready to Sync

. The Ready to Sync column for the selected rooms becomes checked. The selected rooms are synced during the next sync (scheduled in Directory

Sync Pro or triggered manually with the Sync button).

3.

To prevent the rooms from syncing, select the rooms and select

Not Ready to Sync

from the right-click menu.

Admin Agent Menu Actions

If Admin Agent menu actions have been created for Rooms, they will appear in the right-click options menu:

1.

Click on table rows to select one or more rooms in the list.

2.

Right-Click to view the options menu and select an Admin Agent action.

3.

In the Job Options window, check

Do not start before

and enter a date if you do not want the job to begin immediately. Select the

Admin Agent

and the

Agent Admin Credentials

to use from the drop-down lists.

4.

Click

OK

. The Queue Summary appears.

5.

Click

OK

.

Room Columns

The following columns appear on the Rooms screen by default:



Migration Group - The Migration Group name. Use the Right-click

Set Migration Group

option to change.



Room Number - the room number attribute of the source room



Display Name - the display name attribute of the source room



Distinguished Name - the distinguished name attribute of the source room

Active Directory Pro 10.2 User Guide

21

Binary Tree Documentation



Target Distinguished Name - the distinguished name attribute of the target room. This column is populated when a room is synced.



Description - the description attribute of the source room



Ready to Sync - This is checked if the room is currently ready to sync. Use the Right-click

Ready to Sync

option or

Not Ready to Sync

option to change.



Created - This is checked if the room has been created in the target.



Last Sync - Displays the date/time of the last sync.

The following additional fields can be displayed by customizing the columns:



ID - SQL record number



Migration Group ID



Blacklisted - This is checked if the room is currently on the blacklist. Use the Right-click

Add to Blacklist

option or

Remove from Blacklist

option to change.



Alias



Assistant



Company



Country



Country Code



Country Name



Deleted Item Flags



Delivery Content Length



Department



Department Number



Division



Extension 1 - 15



Manager



Object SID

Active Directory Pro 10.2 User Guide

22

Section 7. Migrating Contacts

The Contacts screen allows contacts to be synchronized to the target.

Binary Tree Documentation

Sync Contacts

To sync contacts to the target:

1.

Click on table rows to select one or more contacts in the list (Use Ctrl -Click to select more than one row).

2.

Right-Click to view the options menu and select

Ready to Sync

. The Ready to Sync column for the selected contacts becomes checked. The selected contacts are synced during the next sync (scheduled in Directory

Sync Pro or triggered manually with the Sync button).

3.

To prevent the contacts from syncing, select the contacts and select

Not Ready to Sync

from the rightclick menu.

Admin Agent Menu Actions

If Admin Agent menu actions have been created for Contacts, they will appear in the right-click options menu:

1.

Click on table rows to select one or more contacts in the list.

2.

Right-Click to view the options menu and select an Admin Agent action.

3.

In the Job Options window, check

Do not start before

and enter a date if you do not want the job to begin immediately. Select the

Admin Agent

and the

Agent Admin Credentials

to use from the drop-down lists.

4.

Click

OK

. The Queue Summary appears.

5.

Click

OK

.

Contact Columns

The following columns appear on the Contacts screen by default:



Migration Group - The Migration Group name. Use the Right-click

Set Migration Group

option to change.



First Name - the first name attribute of the source contact



Last Name - the last name attribute of the source contact



Display Name - the display name attribute of the source contact

Active Directory Pro 10.2 User Guide

23

Binary Tree Documentation



Distinguished Name - the distinguished name attribute of the source contact



Target Distinguished Name - the distinguished name attribute of the target contact. This column is populated when a contact is synced.



Description - the description attribute of the source contact



Ready to Sync - This is checked if the contact is currently ready to sync. Use the Right-click

Ready to Sync

option or

Not Ready to Sync

option to change.



Created - This is checked if the contact has been created in the target.



Last Sync - Displays the date/time of the last sync.

The following additional fields can be displayed by customizing the columns:



ID - SQL record number



Migration Group ID



Blacklisted - This is checked if the contact is currently on the blacklist. Use the Right-click

Add to Blacklist

option or

Remove from Blacklist

option to change.



Alias



Assistant



Company



Country



Country Code



Country Name



Deleted Item Flags



Delivery Content Length



Department



Department Number



Division



Employee ID



Employee Number



Employee Type



Extension 1 - 15



Manager



Object SID

Active Directory Pro 10.2 User Guide

24

Section 8. Migrating Groups

The Groups screen allows groups to be synchronized to the target.

Binary Tree Documentation

How different types of groups (Domain Local, Global, and Universal Group) are created on the target and how group collisions are handled is defined on the AD Target Options tab of the Active Directory

Migrator synchronization profile

Sync Groups

To sync groups to the target:

1.

Click on table rows to select one or more groups in the list (Use Ctrl -Click to select more than one row).

2.

Right-Click to view the options menu and select

Ready to Sync

. The Ready to Sync column for the selected groups becomes checked. The selected groups are synced during the next sync (scheduled in Directory

Sync Pro or triggered manually with the Sync button).

3.

To prevent the groups from syncing, select the groups and select

Not Ready to Sync

from the right-click menu.

Admin Agent Menu Actions

If Admin Agent menu actions have been created for Groups, they will appear in the right-click options menu:

1.

Click on table rows to select one or more groups in the list.

2.

Right-Click to view the options menu and select an Admin Agent action.

3.

In the Job Options window, check

Do not start before

and enter a date if you do not want the job to begin immediately. Select the

Admin Agent

and the

Agent Admin Credentials

to use from the drop-down lists.

4.

Click

OK

. The Queue Summary appears.

5.

Click

OK

.

Active Directory Pro 10.2 User Guide

25

Binary Tree Documentation

Group Columns

The following columns appear on the Groups screen by default:



Migration Group - The Migration Group name. Use the Right-click

Set Migration Group

option to change.

 sAMAccountName - the sAMAccountName attribute of the source group account



Display Name - the display name attribute of the source group account



Group Type - The type of group of the source group account



Distinguished Name - the distinguished name attribute of the source group account



Target Distinguished Name - the distinguished name attribute of the target group account. This column is populated when a group is synced.



Description - the description attribute of the source group account



Ready to Sync - This is checked if the group is currently ready to sync. Use the Right-click

Ready to Sync

option or

Not Ready to Sync

option to change.



Created - This is checked if the group account has been created in the target.



Last Sync - Displays the date/time of the last sync.

The following additional fields can be displayed by customizing the columns:



ID - SQL record number



Migration Group ID



Blacklisted - Checked if the group is currently on the blacklist. Use the Right-click

Add to Blacklist

option or

Remove from Blacklist

option to change.



Alias



Assistant



Company



Country



Country Code



Country Name



Deleted Item Flags



Delivery Content Length



Department



Department Number



Division



Extension 1 - 15

Active Directory Pro 10.2 User Guide

26



Managed By



Object SID

Binary Tree Documentation

Active Directory Pro 10.2 User Guide

27

Binary Tree Documentation

Section 9. Settings

The Settings screen allows settings to be defined to be used when the device Cutover process is started, create

ReACL Profiles, and add custom Menu Actions.

9.1 Migration Options

To add migration options:

1.

Click the

Migration Options

tab.

2.

Click the

Add

button. The Migration Options window appears.

3.

Enter values in the following fields:



Option Name - the name to identify the options (for example, "10 Second Reboot Delay")

Active Directory Pro 10.2 User Guide

28

Binary Tree Documentation



Domain Join Delay - the delay (in seconds) before joining the domain



Reboot Delay - the delay (in seconds) before rebooting

If set to any value other than zero (0), the user will receive a pop-up notification informing them that the workstation will be rebooted when the cutover is performed. If set to zero, no notification will appear.



Recycle Bin - select how to handle the Recycle Bin during cutover, either

Empty

or

Don't Empty

Users may get an error message that their Recycle Bin has been corrupted after migration if the Recycle Bin is not empty. See Troubleshooting for more information about this issue.



Target OU - the target OU where the devices will be created. If this field is left blank, the devices will default to the Computers container.

4.

Check

Join to Existing Device

to join the device to the existing target computer during cutover.

5.

Click

Save

. The migration options are added to the list.

9.2 Credentials

Use the Credentials tab to add credentials used for either a device cutover or for an admin agent.

The specified cutover credentials must be able to join and disjoin a computer from the specified domain and well as disable a computer in the specified domain. A trust between the source and target domain is not required.

To add cutover credentials:

1.

Click

Credentials

tab.

2.

Click the

Add

button. The Credentials window appears.

3.

Enter a

Name

to identify the credentials (for example, "DomA to DomB Admins").

4.

Select

Cutover

from the

Type

drop-down list. The Source and Target fields appear.

5.

Enter values in the following fields:

Active Directory Pro 10.2 User Guide

29

Binary Tree Documentation



Source Domain FQDN - the domain FQDN of the source in s ource.domain.dom format



Source Username - the username to access the source domain in domain\username or UPN

([email protected]) format



Source Password - the password to access the source domain



Target Domain FQDN - the domain FQDN of the target in target.domain.dom format



Target Username - the username to access the target domain in domain\username or

UPN ([email protected]) format



Target Password - the password to access the target domain

6.

Click

Save

. The credentials are added to the list.

To add admin agent credentials:

1.

Click

Credentials

tab.

2.

Click the

Add

button. The Credentials window appears.

3.

Enter a Name to identify the credentials (for example, "Move User Credentials").

4.

Select

Admin Agent

from the

Type

drop-down list. The Credentials fields appea r.

5.

Enter values in the following fields:



Domain FQDN - the domain FQDN in domain.dom format

Active Directory Pro 10.2 User Guide

30



Username - the username to access the domain in domain\username or UPN

([email protected]) format



Password - the password to access the domain

6.

Click

Save

. The admin agent credentials are added to the list.

9.3 Network Profiles

To add network profiles:

1.

Click the

Network Profiles

tab.

2.

Click the

Add

button. The Network Profiles window appears.

Binary Tree Documentation

3.

Enter values in the following fields:



Profile Name - the name to identify the network profile



Obtain DNS server address automatically? - options include

No Change

,

Manually Assign

, or

Use

DHCP

If DNS settings are manually assigned, be sure that the DNS server(s) included can resolve the

ADM Agent SRV record.



Preferred DNS Server - the preferred DNS server



Alternate DNS Server - the alternate DNS server



Append primary and connection specific DNS suffixes - options include

No Change

,

Obtain from NIC

, or

Manually Assign

.



DNS Suffixes - Enabled if

Manually Assign

is selected to the Append primary and connection specific

DNS suffixes option. The list of DNS suffixes. Enter each suffix and then press

Enter

.



DNS Suffix for this Connection - the DNS suffix once cutover is complete

Active Directory Pro 10.2 User Guide

31

Binary Tree Documentation



Register the connection's addresses in DNS - options include

No Change

,

No

, or

Yes



Use this connection's DNS suffix in DNS registration - Enabled if

Yes

is selected to the Register the connection's addresses in DNS option, select

No Change

,

Don't register manual DNS suffix

, or

Register manual DNS suffix

.



Preferred WINS Server - the preferred WINS server



Alternate Wins Server - the alternate WINS server

4.

Click

Save

. The network profile is added to the list.

9.4 Device ReACL Profiles

The default Device ReACL profile is used if a different profile is not defined and set on the devices. The default

Device ReACL profile can be edited.

To add Device ReACL profiles:

1.

Click the

Device ReACL Profiles

tab.

2.

Click the

Add

button. The Device ReACL Profile window appears.

3.

In the

Profile Name

field, enter a name to identify the Device ReACL Profile.

Active Directory Pro 10.2 User Guide

32

Binary Tree Documentation

4.

Under the

Basic

tab:



In the

Blacklist Folders

box, enter folder paths that will not be included in the ReACL process.

Wild card characters (* and ?) can be used when specifying blacklist folders. Separate the paths by pressing

Enter

. By default, the following folders are blacklisted:



\Windows



\WINNT



\I386



\Windows\I386



\Program Files



\PROGRAM FILES (x86)



\MSOCACHE



\System Volume Information



\Recycler



\$RECYCLE.BIN



\CONFIG.MSI



\RECOVERY



\OEM



\Quarantine



\BOOT



Select an option from the

Logging Level

drop-down list. Options include Info (default) and Debug.

Active Directory Pro 10.2 User Guide

33

5.

Click the

Advanced

tab.

Binary Tree Documentation

The Advanced tab allows a more granular selection of the components to be included or excluded from the ReACL process. Select the components to be included by checking the desired items.

We recommend that the

Windows Services Accounts

box is left UNCHECKED. A change in the ACL of the services accounts of the target may have an impact on the applications currently running. Although the

ReACL process can usually be rolled back in case of issues, there could be a temporary disruption in service until resolved. Selecting the

Windows Service Accounts

box will switch the domain account that

Windows services are running under to the corresponding matched target domain account after a completed ReACL process.

The

Windows Services

option will ensure that any source domain accounts that were given permission to a service will include the corresponding matched target domain account after a ReACL process.

The

System ACLs

option allows for the proper translation of accounts within the security audit logs.

If Roaming Profiles is selected, users must be logged out of their roaming profiles during the

ReACL process.

If the

Preserve Archive Bit

box is left unchecked, the archive bit will be reset. If checked, the archive bit will not be reset.

6.

If the Local/Files folders box is selected on the left, normally all files and folders are included in the ReACL process. If it is preferred to provide a specific list, enter the list in the

Only ReACL These Local Folders

box.

Separate each entry by pressing

Enter

. You may use just a file path using backslashes, or provide an exact drive letter. If a drive letter is provided, the ReACL is limited to that exact path.

Note that if you choose to list folders here, these are the ONLY folders that will be included in the ReACL

Active Directory Pro 10.2 User Guide

34

Binary Tree Documentation process. (The exception is if you check the User Profiles box: those Profiles will always be included automatically in addition to your list.)

Active Directory Pro 10.2 User Guide

35

Binary Tree Documentation

7.

Select an option from the

Elevate Failure Action

drop-down list to choose the action that should be taken if any part of the ReACL process encounters errors.

In order to successfully adjust permissions, Active Directory Pro must create a process with a security token that has been assigned additional permissions. The token is said to have elevated rights/permissions. If this process fails, it is likely that the ReACL will be largely unsuccessful in updating the operating system for use by target user accounts.



The default is

Terminate ReACL

, meaning the ReACL process for that device is stopped as soon as an error occurs. This is a time-saving option. The ReACL process is reported as

Failed

in the Devices

View. A device cannot be Cutover if the ReACL process reports as Failed. This is the recommended setting.



If you choose

Error

, the entire process will attempt to complete when an Elevate Failure error is encountered, but the process will still be reported as

Failed

. This selection may take significantly more time than Terminate ReACL, as the entire process will attempt to finish before reporting as

Failed

.



If you choose

Warn

, a warning entry will be logged, however the process will be reported as

Successful

. This choice allows experienced migration architects to analyze the logs and choose to

Cutover anyway based on their analysis of the results.



If you choose

Info

, an info entry will be logged, however the process will be reported as

Successful

.

This choice allows experienced migration architects to analyze the logs and choose to Cutover anyway based on their analysis of the results. We suggest choosing Warn over I nfo as this will make the entries easier to locate in the log.

8.

Select an option from the

Invalid/Duplicate Target Profile Action

drop-down list to choose the action that should be taken when an invalid or duplicate profile exists in the target.



The default is

Terminate ReACL

, meaning the ReACL process for that device is stopped as soon as an error occurs. This is a time-saving option. The ReACL process is reported as

Failed

in the Devices

View. A device cannot be Cutover if the ReACL process reports as Fai led. This is the recommended setting.



If you choose

Error

, the entire process will attempt to complete when an Elevate Failure error is encountered, but the process will still be reported as

Failed

. This selection may take significantly more time than Terminate ReACL, as the entire process will attempt to finish before reporting as

Failed

.



If you choose

Warn

, a warning entry will be logged, however the process will be reported as

Successful

. This choice allows experienced migration architects to analyze the logs and choose to

Cutover anyway based on their analysis of the results.



If you choose

Info

, an info entry will be logged, however the process will be reported as

Successful

.

This choice allows experienced migration architects to analyze the logs and choose to Cutover anyway based on their analysis of the results. We suggest choosing Warn over Info as this will make the entries easier to locate in the log.

9.

Select an option from the

Add Rollback Metadata

drop-down list.

Active Directory Pro ins erts a "breadcrumb” during the ReACL process to allow seamless rollback of the

ReACL process if needed. You can control the insertion of these breadcrumbs (which are removed during the Cleanup process) if desired, here.

Active Directory Pro 10.2 User Guide

36

Binary Tree Documentation



The default is

Always

and does not affect performance. We recommend this setting. This is the only setting where the changes performed by the ReACL process can be rolled back, or undone, in all scenarios.



If you choose

Only If Ambiguous

, metadata will only be included when the rollback settings would be ambiguous. Only If Ambiguous results in the addition of fewer breadcrumbs, preserving usage for times when it may be impossible to determine the original file or folder permissions. This would occur, for example, when users have accounts in multiple domains that will be consolidated into a single domain.

Note that Only If Ambiguous guarantees a ReACL can be rolled back to the original state only when the file system permissions remained unchanged. Modification of ACLs on the fil e system could create a state where a rollback cannot complete with 100% success. To ensure the ability for a ReACL Rollback in all scenarios, Always should be selected.



If you are an experienced migration architect, you may choose

Never

to never include metadata.

If this is selected, a complete rollback may not be possible.

10.

Check the

Simulation Only (No Actual Changes)

box to simulate the results of the ReACL process without actually making any changes to the ACL. Visit the logs/reports to determine any potential issues and correct them before an actual ReACL process. You might use this to create a Device ReACL Profile specifically for testing purposes.

11.

Click

Save

. The Device ReACL Profile i s added to the list.



Click the

Restore Defaults

button to reset the profile values back to the default settings.

9.5 NAS ReACL Profiles

The default NAS ReACL profile is used if a different profile is not defined and set on the NAS devices. The default

NAS ReACL profile can be edited.

To add NAS ReACL profiles:

1.

Click the

NAS ReACL Profiles

tab.

2.

Click the

Add

button. The NAS ReACL Profile window appears.

Active Directory Pro 10.2 User Guide

37

Binary Tree Documentation

3.

In the

Profile Name

field, enter a name to identify the NAS ReACL Profile.

4.

Under the

Basic

tab:



In the

Blacklist Folders

box, enter folder paths that will not be included in the ReACL process.

Wild card characters (* and ?) can be used when specifying blacklist folders. Separate the paths by pressing

Enter

. By default, the following folders are blacklisted:



\Windows



\WINNT



\I386



\Windows\I386



\Program Files



\PROGRAM FILES (x86)



\MSOCACHE



\System Volume Information



\Recycler



\$RECYCLE.BIN



\CONFIG.MSI



\RECOVERY



\OEM

Active Directory Pro 10.2 User Guide

38

Binary Tree Documentation



\Quarantine



\BOOT



Select an option from the

Logging Level

drop-down list. Options include Info (default) and Debug.

5.

Click the

Advanced

tab.

The Advanced tab allows you a more granular selection of the components to be included or excluded from the ReACL process. Select the components to be included by checking the desired items.

If the Preserve Archive Bit box is left unchecked, the archive bit will be reset. If checked, the archive bit will not be reset.

6.

Enter the network errors that will trigger a retry in the

Network Error Retry List

field. By default, errors 53 and 64 will trigger a retry.

7.

Enter the number of retries to attempt in the

Network Error Retry Count

field. The default retry count is

10 retries.

8.

Enter the number of seconds between network error retries in the

Network Error Retry Interval Seconds

field. The default interval is 1 second.

9.

Select an option from the

Elevate Failure Action

drop-down list to choose the action that should be taken if any part of the ReACL process encounters errors.

Active Directory Pro 10.2 User Guide

39

Binary Tree Documentation

In order to successfully adjust permissions, Active Directory Pro must create a process with a security token that has been assigned additional permissions. The token is said to have elevated rights/permissions. If this process fails, it is likely that the ReACL will be largely unsuccessful in updati ng the operating system for use by target user accounts.



The default is

Terminate ReACL

, meaning the ReACL process for that device is stopped as soon as an error occurs. This is a time-saving option. The ReACL process is reported as

Failed

in the

Devices View. A device cannot be Cutover if the ReACL process reports as Failed. This is the recommended setting.



If you choose

Error

, the entire process will attempt to complete when an Elevate Failure error is encountered, but the process will still be reported as

Failed

. This selection may take significantly more time than Terminate ReACL, as the entire process will attempt to finish before reporting as

Failed

.



If you choose

Warn

, a warning entry will be logged, however the process will be reported as

Successful

. This choice allows experienced migration architects to analyze the logs and choose to

Cutover anyway based on their analysis of the results.



If you choose

Info

, an info entry will be logged, however the process will be reported as

Successful

. This choice allows experienced migration architects to analyze the logs and choose to

Cutover anyway based on their analysis of the results. We suggest choosing Warn over Info as this will make the entries easier to locate in the log.

10.

Select an option from the

Add Rollback Metadata

drop-down list.

Active Directory Pro inserts a "breadcrumb” during the ReACL process to allow seamless rollback of the

ReACL process if needed. You can control the insertion of these breadcrumbs (which are removed during the Cleanup process) if desired, here.



The default is

Always

and does not affect performance. We recommend this setting. This is the only setting where the changes performed by the ReACL process can be rolled back, or undone, in all scenarios.



If you choose

Only If Ambiguous

, metadata will only be included when the rollback settings would be ambiguous. Only If Ambiguous results in the addition of fewer breadcrumbs, preserving usage for times when it may be impossible to determine the original file or folder permis sions.

This would occur, for example, when users have accounts in multiple domains that will be consolidated into a single domain.

Note that Only If Ambiguous guarantees a ReACL can be rolled back to the original state only when the file system permissions remained unchanged. Modification of ACLs on the file system could create a state where a rollback cannot complete with 100% success. To ensure the ability for a ReACL Rollback in all scenarios, Always should be selected.



If you are an experienced migrati on architect, you may choose

Never

to never include metadata.

If this is selected, a complete rollback may not be possible.

11.

Check the

Simulation Only (No Actual Changes)

box to simulate the results of the ReACL process without actually making any changes to the ACL. Visit the logs/reports to determine any potential issues and correct them before an actual ReACL process. You might use this to create a Device ReACL Profile specifically for testing purposes.

12.

Click

Save

. The NAS ReACL Profile is added to the list.

Active Directory Pro 10.2 User Guide

40



Click the

Restore Defaults

button to reset the profile values back to the default settings.

Binary Tree Documentation

9.6 Menu Actions

Menu Selections and Menu Actions

New menu selections that appear as a right-click option on Devices or NAS screens can be created in the Menu

Actions tab. Menu selections are a sequence of menu actions to complete a process.

The Menu Selection area will allow you to create a new right-click job menu for devices or NAS shares. Existing or new Menu Action entries should be dragged over to the desired Menu Selection item to complete the custom job process.

The Menu Action area will allow you to create the action(s) that will be downloaded and executed against devices or NAS shares. You can associate a single action or multiple actions with a Menu Selection object by dragging each

Menu Action item over to the desired Menu Selection.

It is important to note that system menu selections and actions can only be viewed or copied, they are not editable.

Adding or copying a Menu Action

To add or copy a menu action:

Above the Menu Action table, click

Add

or select an existing menu action and click

Copy

(or right-click and select

Copy

). Check

Show System

to view and select an existing system menu action.



Menu Action Name

(Required): Enter a name for the menu action. The Menu Action Name cannot begin with "BT-" which is used to identify system menu actions.

Active Directory Pro 10.2 User Guide

41

Binary Tree Documentation



Menu Action Type

(Required): Select one of the options from the drop-down list.



PowerShell Script:

Allows you to defi ne a PowerShell script for the process on the Command and

Rollback tabs. Global Variables can be added and used in the script.



Command Line:

Allows you to define a Command line for the process on the Command and

Rollback tabs. Global Variables can be added and used in the command line.



Download File:

Downloads a file to the predefined Downloads folder.



Description:

Enter a description for the menu action.



General tab

: Mark or unmark the following checkboxes and enter the following options if adding or copying a PowerShell Script or Command Line:



Automatic Rollback:

if checked, automatic rollback is added to the menu action.



Requires Cutover Credentials:

if checked, the script or command line includes the

$CutoverCredentials_XXXXX parameters.



Requires Network Profile

: if checked, the script or command line includes the

$NetworkProfile_XXXXX parameters.



Requires Migration Options:

if checked, the script or command line includes the

$MigrationOption_XXXXX parameters.



Requires Global Variables:

if checked, the script or command line includes the Global Variables.



Requires Offline Domain Join:

if checked, script or command line includes the Offline Domain Join parameters.



Run On Admin Agent:

if checked, the script or command can only be used on Admin Agent devices.



Timeout (Seconds):

For PowerShell Script or Command Line, enter the number of seconds the process will be attempted before timing out.



Retry Count:

For PowerShell Script or Command Line, enter the number of times the process will be retried.



Update Interval (Seconds):

For PowerShell Script or Command Line, enter the number of seconds between process runs.



Command tab:

Enter a PowerShell scrip to command line. If creating a PowerShell Script, click

Starter

Script

to populate the entry box with the basi c framework of a script. Enter or edit the command line or

PowerShell Script. Text is required.



Rollback tab:

Enter a PowerShell scrip to command line. If creating a PowerShell Script, click

Starter Script

to populate the entry box with the basic framework of a script. Enter or edit the command line or

PowerShell Script. Text is required.



Download tab:

Enter the following options if adding or copying a Download File menu action. When a new download job is created for a managed workstation, the specified fi le that is stored on the Active

Directory Pro server (c:\Program files\Binary Tree\ADPro\Downloads\) will be downloaded to c:\Program files\Binary Tree\ADPro Agent\Downloads\ on the workstation’s local disk.



File Name

(required): The file name. Based on the File Location for Download Jobs used during installation The File Name cannot contain invalid file characters and cannot use reserved file

Active Directory Pro 10.2 User Guide

42

Binary Tree Documentation names: map.usr, map.gg, ReACL-config.json.



Target Location:

The target location of the download job. The Target Location cannot contain invalid file characters and cannot use reserved file names: map.usr, map.gg, ReACL-config.json. A

Target Location is required if the File Name contains environment variables.



Retry Count:

For PowerShell Script or Command Line, enter the number of times the process will be retried.



Update Interval (Seconds):

For PowerShell Script or Command Line, enter the number of seconds between process runs.



Timeout (Seconds):

For PowerShell Script or Command Line, enter the number of seconds the process will be attempted before timing out.

The local download folder on an Active Directory Pro managed machine will be secured with permissions only for the BUILTIN\Administrators group.

If rights other than BUILTIN\Administrators are required then the administrator will need to make a change on the local downloads folder (c:\Program files\Binary Tree\ADPro Agent\Downloads\) on the

Agent machine.

Adding or copying a Menu Selection

To add or copy a menu selection:

above the Menu Selection table, click

Add

or select an existing menu selection and click

Copy

(or right-click and select

Copy

). Check

Show System

to view and select an existing system menu selection.

Active Directory Pro 10.2 User Guide

43

Binary Tree Documentation



Menu Selection Name

(Required): Enter a name for the menu selection. The Menu Action Name must be unique.



Display Name:

Enter the name that appears in the right-click menu on the Devices or NAS screen.



Object Type:

Select one of the options from the drop-down list.



Device:

The menu selection will appear in the right-click menu on the Devices screen.



NAS:

The menu selection will appear in the right-click menu on the NAS screen.



User:

The menu selection will appear in the right-click menu on the Users screen.



Room:

The menu selection will appear in the right-click menu on the Rooms screen.



Contact:

The menu selection will appear in the right-click menu on the Contacts screen.



Group:

The menu selection will appear in the right-click menu on the Groups screen.



Admin Agent:

The menu selection will appear in the right-click menu on the Admin Agents screen.

Active Directory Pro 10.2 User Guide

44

Binary Tree Documentation



Activity:

Select one of the options from the drop-down list. The Activity determines what validations are applicable to the job, and which status columns are updated when the job runs. for example, a custom menu selection with the ReACL activity, it will have the s ame validations as the system ReACL menu selection.



Discovery:

Gathers properties from the device.



ReACL:

Updates device domain user profiles for use by the matching target user after cutover.



ReACLRollback:

Rolls back all changes made by the ReACL process .



ReACLShare:

Updates the NAS’s domain user profiles for use by the matching target user after cutover.



ReACLRollbackShare

: Rolls back all changes made by the ReACL process.



Cutover:

Moves a device from the source domain to the new target domain.



Cleanup:

Removes the Source SIDs after the Cutover process completes.



CleanupShare:

Removes the Source SIDs after the Cutover process completes.



ExplicitRollback:

Rejoins a device back to the source domain.



UploadLogs:

Uploads log files from the Active Directory Pro Device Agent to the Active Directory

Pro Web Server using Microsoft BITS.



Other

(default): An activity not related to any system activity. No predefined validations are applicable. By default, new menu selections are assigned as Other.



Menu Selection Type:

This option is not editable. System types are read-only. User types can be edi ted.



Description:

Enter a description for the menu action.

Adding Menu Actions to Menu Selections

Drag and drop system or custom menu actions from the Menu Action list to the menu selection in the Menu

Selection list. Menu actions are listed in the order i n which they will be executed. Drag and drop menu actions to reorder them. Menu Actions can be viewed, copied, or removed by clicking the selecting the menu action and clicking the appropriate button or by right-clicking and selecting an option from the menu.

Menu actions marked as "Run On Admin Agent" can be added to Device, User, Room, Contact, or Group Object

Type menu selections (NAS is not supported). Menu actions designed to run on devices or NAS devices can be added to Device or NAS Object Type menu selections only.

Activating Menu Selections

Only menu selections marked as Active will appear in the right-click menus. Click the

Deactivate

or

Activate

button to change the active status of the menu selection. Inactive menu selections can be displayed in the table by marking the

Show Inactive

check box. You may want to create a new menu selection, activate it, and then deactivate the system menu selection.

Active Directory Pro 10.2 User Guide

45

Binary Tree Documentation

9.7 Custom Menu Action Example

Scenario

: The administrator wants to download the Get-DiskSpace.ps1 file on selected workstations.

Steps:

1.

Copy the Get-DiskSpace.ps1 file in the file location for download jobs selected during the installation of

Active Directory Pro,

c:\Program files\Binary Tree\ADPro\Downloads\

by default.

2.

Under the

Menu Actions

tab in

Settings

, add a menu action.

3.

Select the "Download File" Menu Action Type and enter the File Name. The full path to the file should not be entered.

4.

Add a menu selection. The Display Name is how the option will appear in the right-click menu. Select the

"Device" Object Type so the menu option will appear on the Devices screen.

Active Directory Pro 10.2 User Guide

46

Binary Tree Documentation

5.

Drop and drag the new menu action to under the new menu selection and ensure the menu selection is active. The menu selection can be expanded to view the associated menu action.

6.

On the Devices screen, select the devices and then select the new "Get Disk Space" option from the rightclick menu. When the new download job is run successfully against a managed machine, the Get-

DiskSpace.ps1 file will resi de locally on disk at c:\Program files (x86)\Binary Tree\ADPro

Agent\Downloads.

9.8 Global Variables

Global variables can be defined and be used across multiple scripts when defining menu actions. For example, a global variable to add the current date can be added to multiple scripts. Global variables will appear when selecting a starter script when creating a Menu Action if the Requires Global Variables option is selected.

Active Directory Pro 10.2 User Guide

47

Adding a Global Variable

To add a Global Variable

click

Add

under the Global Variables tab.

Binary Tree Documentation



Variable Name

(Required): Enter a name for the global variable. The name must contain alphanumeric and underscores only.



Variable Value

(Required): The value of the global variable. Check the

Encrypted

box to encrypt the value in the database and hide the variable value in the interface.

9.9 Credential Cache and Offline Domain Join

Description

Microsoft’s Offline Domain join allows a workstation to join a domain without contacting a Domain Controller.

Active Directory Pro builds upon this functionality to allow machines to be cutover to the new domain without contacting a target domain controller.

Active Directory Pro allows the workstation to join the new domain without having the user connect to the corporate VPN and manually joining their workstation to the new domain.

Normally, VPN users can’t login right after joining a new domain and rebooting because Windows must be able to contact the target domain to authenticate agains t a domain controller for the very first login. Typically, a remote user would need to login to his or her machine first and then establish a VPN connection.

Active Directory Pro resolves this by taking advantage of Windows ability to cache credentials. If users have logged in to a domain previously, Windows can still log them in even if they can no longer reach a domain controller by using their cached credentials. Active Directory Pro has functionality to have a user pre-login to the new domain before the device is cutover so the target credentials can be cached and used for the first login without the need to contact a domain controller first.

The devices that the ODJ process is being run on must have network connectivity to BOTH the source and target environments at the same time in order to have the Cached Credentials function work properly.

Creating ODJ files for each workstation

The first st ep will be to use Microsoft’s DJOIN utility to create a provisioning file. Only the provisioning part of the

DJOIN process is needed. Complete information on DJOIN can be found here:

https://technet.microsoft.com/en-us/library/offline-domain-join-djoin-step-by-step(v=ws.10).aspx

The Provision, Domain, Machine, and Savefile parameters are required at a minimum. There is the option to control where the target machine will be created using the MachineOU parameter as in the sample shown here.

Active Directory Pro 10.2 User Guide

48

Binary Tree Documentation

DJOIN.EXE /Provision /Domain BTADLAB.com /Machine Sales220 /Savefile “C: \Program Files\Binary

Tree\ADPro\Downloads\ODJ\ Sales220.txt” /MACHINEOU OU=SalesComputers,OU=Sales,DC=BTADLAB,DC=CO M

The file must be saved in the ODJ folder in the downloads path that was chosen during the installation.

By default, this is C:\Program Files\Binary Tree\ADPro\Downloads\ODJ.

This can be completed for all relevant workstations early in the migration process.

WARNING: Be sure to name each text file with the exact matching machine name.

Configuring the Credential Cache Profile

The next step is to configure the existing Default Credential Cache profile with the IP address of a Target domain controller, or to create a new profile.

Click on

Add

to create a new profile, or

Edit

to modify an existing profile. If the Default profile is chosen, it must be edited it to include a Target DC IP address.



The

Target DC Ping Interval

setting determines how long the script will sleep before pinging the DC again.



The

Timeout Before Job Failure

setting determines the Credential Cache app timeout value that will be used for the job once downloaded to the agent managed machine.

Active Directory Pro 10.2 User Guide

49

Binary Tree Documentation



The

User Credential Dialog Timeout

setting determines how long the user is presented with a dialog box to enter their target domain credentials. When the time is reached, something happens.

Cache Credential Jobs

Now that a profile has been configured with a target DC IP address, we can assign a Cache Credentials job to the workstation(s).

In the Devices view, select a single device or use the Ctrl key to select multiple devices. Right-click to bring up the action menu and choose

Cache Credentials

.

The Cache Credential Options box appears.

Select a Cache Credential Profile.

A date and time for the Cache Credentials job can be chosen to run the job at a later time. This date/time combination represents the earliest time that this job could run. The actual time depends on the Polling Interval of the workstation.

If a date/time is not chosen, this job will run on the workstation the next time it checks for jobs.

Active Directory Pro 10.2 User Guide

50

Binary Tree Documentation

The Device view will reflect a status of Queued. When the job is collected by the workstation the status will change to In Progress, and then finally a status of Completed or Failed.

On the workstation side, when the Cache Credentials Job is received, the user will be prompted to enter their target credentials. Below is an example of what the user will see when the Cache Credential job runs:

ReACL

The next recommended step is the ReACL process. The ReACL process can be run repeatedly as needed, but it is suggested to be run at least once right after Cache Credentials.

Offline Domain Join Job

The final step is the actual Offline Domain Join. This is similar to the cutover process for machines that are directly connected to the network.

Active Directory Pro 10.2 User Guide

51

Binary Tree Documentation

WARNING: Do not perform the Cutover process on Offline Domain Join workstations. The Offline

Domain Join process takes the place of Cutover for workstations connecting via VPN.

In the Devices view, select a single device or use the Ctrl key to select multiple devices. Use the right-click Action menu to choose

Offline Domain Join

.

The Job Options box appears. A date/time combination can be chosen, or just click OK to have this job received by the workstations during their next check for jobs.

WARNING: The Offline Domain Join (Job Scheduling Options dialog box) start date and time must be

AFTER the Cache Credentials (Cache Credential Options dialog box) start date and time.

The Offline Domain Join feature does not support rollback.

9.10 Admin Agents

The Admin Agent option allows you to designate one or more machines as remote workstations that can perform customized tasks, such as running PowerShell scripts that ca n be triggered against devices, users, rooms, contacts, or groups as needed. For example, an organization may want to designate a machine to move users from a temporary OU in the target, to what is later designated as their final destination.

Active Directory Pro 10.2 User Guide

52

Binary Tree Documentation

Typically, the Admin Agent will be run on a device outside the scope of the Directory Sync Pro profile being used.

You also have the option to convert an existing machine already running the agent into an Admin Agent device on the Devices screen. The admin agent cannot perform both roles, so Admin Agent devices are typically chosen from the target forest as they do not need to be cutover.

If you are choosing a machine from the target as an Admin Agent device, you should create it on the Admin Agents tab under Settings before installing the agent software. Existing devices that were converted to an Admin Agent device will appear here automatically.

Click on

Add

to define a new Admin Agent Device, or

Edit

to modify an existing Admin Agent Device.



The

sAMAccountName

identifies the machine name the Admin Agent will run on.



The

Domain

identifies where the machine is located.



The

Description

is an optional field used to describe the machine.



The

Polling Interval

setting determines the length of time (in seconds) between polls. The Polling Interval is set to 60 seconds by default.

After adding a machine to the Admin Agents screen, you can install the agent software on the Admin Agent machine. You should see the device register here after refreshing the screen. If you ca n ping the device from the

Active Directory Pro console, but it never registers, check that the agent software has been successfully installed using the Event Viewer on the admin agent machine.

After the Admin Agent device is added and registered, credentials to be used for the Admin Agent device can be added to the Credentials tab under Settings and custom menu actions (marked as "Run On Admin Agent") can be created on Menu Actions tab under Settings. These new menu actions can then be added to menu selections available to Users, Rooms, Contacts, Groups, or Devices.

Polling Interval

The polling interval is set to 60 seconds (1 minute) by default. The polling interval tells devices how frequently to contact the Active Directory Pro Server and check for jobs. If the polling interval is set to a high number, such as

14400 seconds (4 hours), it is possible that any command sent to the device may not execute for up to four hours.

Devices will only obtain an updated polling interval when next contacting the Active Directory Pro web service.

View Jobs

Active Directory Pro 10.2 User Guide

53

Binary Tree Documentation

To view Admin Agent jobs:

1.

Click on table rows to select one or more Admin Agent devices in the list (Use Ctrl -Click to select more than one row).

2.

Right-Click to view the options menu and select

View Jobs

. The Admin Agent Jobs window appears.

3.

The Admin Agent Jobs table includes the following columns:



Job ID - the ID of the job



Queued Timestamp - the date and time the job was queued



Do Not Start Before - the date selected if using the Do not start before option



Command Name - the command name of the job



Device - The Device the job is run on.



NAS - The NAS Device the job is run on.



Status - the current status of the job



Cancel Requested - checked in a cancel of the job has been requested



Message - Result codes and messages for the job



Timeout (sec) - the timeout in seconds



Retry Count - the number of times the job has been retried



Rollback Status - the status of a rollback



Rollback Message - the status of a rollback

4.

To cancel a job, select the job and click the

Cancel

button or select

Cancel

from the right-click menu. To refresh the jobs list, click the

Refresh

button.

View Properties

After the Discovery process has been completed for a device, you view the properties of the device.

To view a device's properties:

1.

Click on table rows to select a device in the list.

2.

Right-Click to view the options menu and select

View Properties

. The Device Properties window appears displaying the properties of the device and the user profiles associated with the device.

Active Directory Pro 10.2 User Guide

54

Binary Tree Documentation

3.

Click the

Export All

button to export the content of the window in Excel, text, CSV, or HTML format.

9.11 Admin Agent Example

Scenario

: The administrator wants to designate a machine to move users from a temporary OU in the target, to what is later designated as their final destination. Any specific PowerShell modules (like Active Directory) or any other script dependencies should be installed on the desired Admin Agent machine prior to these activities to ensure the necessary scripts can execute successfully.

Steps:

1.

Add the machine to the Admin Agents tab under Settings.

Active Directory Pro 10.2 User Guide

55

Binary Tree Documentation

2.

Install the Active Directory Pro Agent on a machine outside scope of Directory Sync Pro profile used to migrate devices. This is going to be the Admin Agent machine used for running custom admin actions. You should see the machine register after refreshing the screen.

3.

Under the Menu Actions tab, add a new Menu Selection with Users Object Type selected. This will create a right-click menu option on the Users screen.

Active Directory Pro 10.2 User Guide

56

Binary Tree Documentation

4.

Add a menu action. The Run On Admin Agent option must be checked. For this scenario, select PowerShell

Script and edit the script under Command tab. The script can call whatever credentials the PowerShell script should run under on the Admin Agent. The provided PowerShell script needs to clearly identify what users are required to move and where the final destination is. See Appendix F for a sample PowerShell starter script that moves users from one OU to another. The provided sample script is meant to showcase the flexibility of the Admin Agent and is not representative of the definitive scripting method by which to accomplish moving users from one OU to another.

5.

Add the menu action to the new menu selection by dragging and dropping the menu action onto the menu selection.

Active Directory Pro 10.2 User Guide

57

6.

Under the Credentials tab, add credentials the Admin Agent machine will use.

Binary Tree Documentation

7.

On the Users screen, select the users you want to move and select the new menu selection from the rightclick menu.

8.

Select the Admin Agent machine and the credentials on the Job Options window and start the job. Instead of individual jobs for each user, a CSV file of users to move is downloaded to the Admin Agent machine to run.

Active Directory Pro 10.2 User Guide

58

Binary Tree Documentation

9.

Under the Admin Agents tab in Settings, right-click on the Admin Agent device and click View Jobs to see the move job results.

Active Directory Pro 10.2 User Guide

59

Binary Tree Documentation

Section 10. Migrating Devices

Workstations and Servers are referred to as Devices in Active Directory Pro. The Devices screen allows devices to be registered, change the polling interval, and manage the device Discovery, ReACL, Cutover, and Cleanup processes.

The Active Directory Pro Agent must be installed on the device before a device can be registered or any actions taken on it. Refer to Installing the Active Directory Pro Agent on Devices topic for more information.

Job Options

The Job Options allow the administrator to effectively manage the server and workstation environment during the migration event by scheduling device jobs to run at specific points of time in the future. Each job that is available by right-clicking a dev ice will surface the ability to set a “Do not start before” date and time. If a job is scheduled, then it sits in the queue and is not an active job for the device as it polls in looking for jobs based on the configured polling interval.

Active Directory Pro 10.2 User Guide

60

Binary Tree Documentation

View Jobs

To view device jobs:

1.

Click on table rows to select one or more devices in the list (Use Ctrl -Click to select more than one row).

2.

Right-Click to view the options menu and select

View Jobs

. The Device Jobs window appears.

3.

The Device Jobs table includes the following columns:



Job ID - the ID of the job



Queued Timestamp - the date and time the job was queued



Do Not Start Before - the date selected if using the Do not start before option



Command Name - the command name of the job



Admin Agent - The Admin Agent device the command will run on



NAS - The NAS device the job is run on



Status - the current status of the job



Cancel Requested - checked in a cancel of the job has been requested



Message - Result codes and messages for the job



Timeout (sec) - the timeout in seconds



Retry Count - the number of times the job has been retried



Rollback Status - the status of a rollback



Rollback Message - the status of a rollback

4.

To cancel a job, select the job and click the

Cancel

button or select

Cancel

from the right-click menu. To refresh the jobs list, click the

Refresh

button.

Jobs can be canceled when the Status or Rollback Status is either Queued, Scheduled,

Started, or In Progress.

View Properties

After the Discovery process has been completed for a device, you view the properties of the device.

To view a device’s properties:

1.

Click on table rows to select a device in the list.

2.

Right-Click to view the options menu and select

View Properties

. The Device Properties window appears displaying the properties of the device and the user profiles associated with the device.

Active Directory Pro 10.2 User Guide

61

Binary Tree Documentation

3.

Click the

Export All

button to export the content of the window in Excel, text, CSV, or HTML format.

Polling Interval

The polling interval is set to 900 seconds (15 minutes) by default. The polling interval tells devices how frequently to contact the Active Directory Pro Server and check for jobs. If the polling interval is set to a high number, such as

14400 seconds (4 hours), it is possible that any command sent to the device may not execute for up to four hours.

You may decide to set the polling interval to a high number to keep the load off of the web servers until devices are closer to the actual date of cutover.

A lengthy time between sending a command to a device and the device executing the command is not likely to be effective on the day of cutover. To ensure adequate response time on the day of cutover, it is recommended to decrease this interval in advance of the Cutover process.

Devices will only obtain an updated polling interval when next contacting the Active Directory Pro web service.

To set polling interval:

1.

Click on table rows to select one or more devices in the list (Use Ctrl -Click to select more than one row).

2.

Right-click to view the options menu and select

Set Polling Interval

. The Set Polling Interval window appears.

3.

Edit the Polling Interval (seconds) field and click

Save

.

The polling interval default for all newly registered devices can be changed in SQL in the

ADM_Setting table field PollIntervalSeconds.

If upgrading from a release prior to SMART Active Directory Migrator 9.2, the polling interval default was 14400 seconds. This default value will not be changed during an upgrade and will need to be updated in the ADM_Setting table per above.

Active Directory Pro 10.2 User Guide

62

Binary Tree Documentation

Set ReACL Profile

To set ReACL Profile:

1.

Click on table rows to select one or more devices in the list (Use Ctrl -Click to select more than one row).

2.

Right-click to view the options menu and select

Set ReACL Profile

. The Set ReACL Profile window appears.

3.

Select the ReACL Profile and click

Save

.

Make Admin Agent

The agent currently running on the device can be changed to an Admin Agent to allow the device to perform custom admin functions. Once changed to an Admin Agent, the device will be removed from the Devices list and will appear in the Admin Agent list in Settings and will be able to only perform admin actions. Admin Agents cannot be changed back to a device agent.

To make a device an Admin Agent:

1.

Click on table rows to select one or more devices in the list (Use Ctrl -Click to select more than one row).

2.

Right-click to view the options menu and select

Make Admin Agent

. The confirmation window appears.

3.

Click

Yes

. The device is removed from the devices list and appears in the in the Admin Agent list in

Settings and can only be used to run custom admin functions.

Discovery

The Discovery process gathers properties (OS versions, network properties, and so on) from the device to allow additional future functionality. The first discovery process begins for a device when the device becomes registered which will automatically occur after the Device Agent has been installed, as long as the environment is properly configured.

To start the device Discovery process manually:

1.

Click on table rows to select one or more devices in the list (Use Ctrl -Click to select more than one row).

2.

Right-Click to view the options menu and select

Discovery

.

3.

In Job Scheduling Options window, click

OK

to begin the Discovery process as soon as possible. Check

Do not start before

and then enter or select a date and time when the process will begin. If using the Do not start before option, the Discovery Status will be displayed as Queued in the Devices table and the Do Not

Start Before column in the Device Jobs table will be populated with the selected date.

4.

The Queue Summary window appears.

Active Directory Pro 10.2 User Guide

63

Binary Tree Documentation

5.

Click

OK

. The Discovery Status column is populated with the current status. Use the Right-click

View Jobs

option or double-click a row in the Devices table to view the list of jobs for the specific Device.

ReACL

The ReACL process updates the device’s domain user profiles for use by the matching target user after cutover.

At least one group must be migrated to populate the map.gg file or the ReACL process will fail.

Before ReACL can occur, the target users and groups which have permissions set on the device must be migrated to the target.

To start the device ReACL process:

1.

Click on table rows to select one or more devices in the list (Use Ctrl-Click to select more than one row).

2.

Right-Click to view the options menu and select

ReACL

.

3.

In Job Scheduling Options window, click

OK

to begin the ReACL process as soon as possible. Check

Do not start before

and then enter or select a date and time when the process will begin. If using the

Do not start before

option, the ReACL Status will be displayed as Queued in the Devices table and the Do Not

Start Before column in the Device Jobs table will be populated with the selected date.

4.

The Queue Summary window appears.

5.

Click

OK

. The ReACL Status column is populated with the current status. Use the Right-click

View Jobs

option or double-click a row to view the list of jobs.

Two checks are performed at the start of the ReACL process. The first check is a gainst invalid Source

Profiles, which will be logged as a WARNING and those profiles will be skipped. The second check is against invalid Target Profiles, where a user may create a profile with the target account before their machine is ReACL’d and cutover . By default, this is logged as a FATAL ERROR and will halt the ReACL process. However, it can be changed to a WARNING with the – t switch passed by editing the command in SQL.

ReACL Agent will automatically create two files on the device being ReACL’d, map .usr and map.gg.

These files are used to find the source permissions and add the appropriate target permissions during the ReACL process. System groups, such as Domain\Domain Admins and Domain\Domain Users are included in the map.gg file for updating the group permissions during the ReACL process. If the Active

Directory environment is non-English, the values in the sAMAccountName column of the

BT_SystemGroup table in the SQL database will need to be changed after Directory Sync Pro is installed to have the appropriate non-English values.

If the Mapped Network Drive is being mapped via GPO or using an integrated credential such as the current Windows logon session, ReACL will create a warning entry in the log “…WARNING: The

UserName value for drive U w as empty and could not be mapped to the target user.” This warning does not mean that the mapped drive cannot be accessed after Cutover.

Active Directory Pro 10.2 User Guide

64

Binary Tree Documentation

For Windows 10 and Windows Server 2016 devices, the ReACL process is decoupled from the actions against files, folders, and the registry.

A ReACL against a Windows 10 or Windows Server 2016 device will update all files and folders and registry entries found on the machine except for the user profile specific registry keys in HKLM, ntuser.dat, and usrclass.dat even if the user profiles option is selected in the ReACL profile.

After a ReACL has been run against a Windows 10 or Windows Server 2016 device, the user profile components will not be prepared during a cleanup process.

The prepare and cleanup process should be completed along with the remaining ReACL activities against the user profile specific registry keys in HKLM, ntuser.dat and usrclass.dat at time of device cutover (prior to domain join command).

Cutover

The Cutover process moves a device from the source domain to the new target domain.

To start the Cutover process:

1.

Click on table rows to select one or more devices in the list (Use Ctrl -Click to select more than one row).

2.

Right-Click to view the options menu and select

Cutover

.

3.

The Cutover Options window appears. Select

Cutover Credentials

, a

Network Profile

, and

Migration

Option

from the drop-down lists.

4.

Check

Do not start before

and then enter or select a date and time when the process will begin. If using the

Do not start before

option, the Cutover Status will be displayed as Queued in the Devices table and the Do Not Start Before column in the Device Jobs table will be populated with the selected date. The

Cutover process will begin as soon as possible if not using this option.

5.

The Queue Summary window appears.

6.

Click

OK

. The Cutover Status column is populated with the current status. Use the Right-click View Jobs option or double-click a row to view the list of jobs.

Devices should not be ReACL'd once they have been cutover to the Target. This is not a best practice and is not supported as this can cause problems with the registry and user profiles.

The Cutover Options are set on the

Settings

screen.

Rollback

The Rollback process moves a device back to the original source domain and restores any modified network settings. The device must have attempted Cutover for this explicit Rollback process to work.

To start the Rollback process:

1.

Click on table rows to select one or more devices in the list (Use Ctrl-Click to select more than one row).

2.

Right-Click to view the options menu and select

Rollback

.

3.

In Job Scheduling Options window, click

OK

to begin the Rollback process as soon as possible. Check

Do not start

before and then enter or select a date and time when the process will begin. If using the

Do not start before

option, the Do Not Start Before column in the Device Jobs table will be populated with the selected date.

Active Directory Pro 10.2 User Guide

65

Binary Tree Documentation

4.

Click

OK

. The Queue Summary window appea rs.

5.

Click

OK

. The selected devices are sent back to their original domain and any modified network settings are restored. The Cutover Status column is updated with the current status.

Cleanup

The Cleanup process removes the Source SIDs after the Cutover process completes.

Cleanup should be done when the migration project is completed. Before running the Cleanup process, it is recommended to disable SID filtering/quarantine to verify there are no issues with application access before completing the cleanup process.

To start the Cleanup process:

1.

Click on table rows to select one or more devices in the list (Use Ctrl -Click to select more than one row).

2.

Right-Click to view the options menu and select Cleanup.

3.

In Job Scheduling Options window, click

OK

to begin the Cleanup process as soon as possible. Check

Do not start before

and then enter or select a date and time when the process will begin. If using the

Do not start before

option, the Cleanup Status will be displayed as Queued in the Devices table and the Do Not

Start Before column in the Device Jobs table will be populated with the selected date.

4.

The Queue Summary window appears.

5.

Click

OK

. The Cleanup Status column is populated with the current status. Use the Right-click View Jobs option or double-click a row to view the list of jobs.

ReACL Rollback

The ReACL Rollback feature rolls back all changes made by the ReACL process. ReACL Rollback can be performed on devices that have completed the ReACL process.

To rollback ReACL:

1.

Click on table rows to select one or more devices in the list (Use Ctrl -Click to select more than one row).

2.

Right-click to view the options menu and select

ReACL Rollback

.

3.

In Job Scheduling Options window, click

OK

to begin the ReACL Rollback process as soon as possible.

Check

Do not start before

and then enter or select a date and time when the process will begin. If using the

Do not start before

option, the Do Not Start Before column in the Device Jobs table will be populated with the selected date.

4.

View rollback results by viewing the device's job view.

Cache Credentials

The Cache Credentials feature to assign a Cache Credentials job to our workstation(s). See the Credential Cache and Offline Domain Join topic for more information.

Offline Domain Join

The Offline Domain Join feature performs the Offline Domain Join process and is similar to the Cutover process for machines that are directly connected to the network. See the Credential Cache and Offline Domain Join topic for more information.

Active Directory Pro 10.2 User Guide

66

Binary Tree Documentation

WARNING: Do not perform the Cutover process on Offline Domain Join workstations. The Offline Domain Join process takes the place of Cutover for workstations connecting via VPN.

Admin Agent Menu Actions

If Admin Agent menu actions have been created for Devices, they will appear in the right-click options menu:

1.

Click on table rows to select one or more devices in the list.

2.

Right-Click to view the options menu and select an Admin Agent action.

3.

In the Job Options window, check

Do not start before

and enter a date if you do not want the job to begin immediately. Select the

Admin Agent

and the

Agent Admin Credentials

to use from the drop-down lists.

The Cutover options will also appear if the selected Admin Agent menu action includes the Cutover action.

4.

Click

OK

. The Queue Summary appears.

5.

Click

OK

.

Device Columns

The following columns appear on the Devices screen by default:



Migration Group - The Migration Group name. Use the Right-click

Set Migration Group

option to change.

 sAMAccountName - the sAMAccountName attribute of the source device



Distinguished Name - the distinguished name attribute of the source device



Registered - This is checked if the device is registered with the server.



Agent Last Contact - Displays the time and date of the last contact between the agent and the Active

Directory Pro Server.



Description - the description attribute of the source device



Polling Interval - The time interval (in seconds) between polls. This is set to 900 seconds (15 minutes) by default. Use the Right-click

Set Polling Interval

option to change. The Active Directory Pro agent will pick up the new polling interval value the next time it contacts the Web Service.



Discovery Status - The status of the discovery process. Use the Right-click

Discovery

option to start the

Discovery process.



ReACL Status - The status of the ReACL process. Use the Right-click

ReACL

option to start the ReACL process.



ReACL Profile - The ReACL Profile set for the device. Use the Right-click

Set ReACL Profile

option to change. Device ReACL Profiles are defined in Settings.



Cutover Status - The status of the Cutover process. Use the Right-click

Cutover

option to start the Cutover process.



Cleanup Status - The status of the Cleanup process. Use the Right-click

Cleanup

option to start the

Cleanup process.



Last Job Message - The last job status.

Active Directory Pro 10.2 User Guide

67

Binary Tree Documentation

The following additional fields can be displayed by customizing the columns:



ID - SQL record number



Migration Group ID - The Migration Group ID.



Agent Version - The version of the agent installed on the device.



Operating System Version - The version of the device's operating system.



Blacklisted - checked if the device is currently on the blacklist. Use the Right-click

Add to Blacklist

option or

Remove from Blacklist

option to change.

Upload Logs

Log files from the Active Directory Pro Device Agent can be uploaded to the Active Directory Pro Web Server using

Microsoft BITS. To enable this functionality, the installer will enable BITS Server Extensions for IIS and create a virtual directory called

DeviceLogs

where all uploaded files will be stored.

To upload Log files from the Active Directory Pro Device Agent:

1.

Click on table rows to select one or more devices in the list (Use Ctrl -Click to select more than one row).

2.

Right-Click to view the options menu and select Upload Logs.

3.

In Job Scheduling Options window, click OK to begin the Upload Logs process as soon as possible. Check

Do not start before and then enter or select a date and time when the process will begin. If using the Do not start before option, the Do Not Start Before column in the Device Jobs table will be populated with the selected date.

4.

Review the device jobs to see when the Upload Logs job has completed.



The logs will be stored at the following location: C:\Program Files\Binary Tree\ADPro\DeviceLogs



The device logs will be zipped, and the file names will be in the following format with a unique file name:

SMART-WIN7X86-1_201573111235

Active Directory Pro 10.2 User Guide

68

Section 11. Migrating NAS

The NAS screen allows you to ReACL NAS (Network Attached Storage) devices via a network share.

Binary Tree Documentation

Add a NAS

To add a NAS device:

1.

Click the

Add

button. The Network Storage window appears.

2.

Enter values in the following fields:



UNC Path - the UNC path that will be the starting location for ReACL on the NAS device



Device Name - The name of the device used to access the NAS device. This device must be local (same network, region, and so on) to the NAS device. This is a sAMAccountName, not an FQDN.



Username - The username to access the NAS device. UserPrincipalName values ([email protected]) or domain\username format are supported

Active Directory Pro 10.2 User Guide

69



Password - the password to access the NAS device

3.

Click

Save

. The NAS device is added to the list.

Edit a NAS

Binary Tree Documentation

To edit a NAS device:

1.

Click on a table rows to select one a NAS device in the list.

2.

Click the

Edit

button or select

Edit

from the right-click menu. The Network Access Storage window appears.

3.

Edit the values.

4.

Click

OK

. The NAS device is updated in the list.

Delete a NAS

To delete a NAS device:

1.

Click on table rows to select one or more NAS devices in the list (Use Ctrl -Click to select more than one row).

2.

Click the

Delete

button or select

Delete

from the right-click menu. The NAS device is removed from the list.

Set ReACL Profile

To set ReACL Profile:

1.

Click on table rows to select one or more devices in the list (Use Ctrl -Click to select more than one row).

2.

Right-click to view the options menu and select

Set ReACL Profile

. The Set ReACL Profile window appears.

3.

Select the ReACL Profile and click

Save

.

ReACL

The ReACL process updates the NAS’s domain user profiles for use by the matching target user after cutover.

To start the device ReACL process:

1.

Click on table rows to select one or more NAS devices in the list (Use Ctrl -Click to select more than one row).

2.

Right-Click to view the options menu and select

ReACL

.

3.

In Job Scheduling Options window, click

OK

to begin the ReACL process as soon as possible. Check

Do not start before

and then enter or select a date and time when the process will begin. If using the

Do not start before

option, the ReACL Status will be displayed as Queued in the NAS table and the Do Not Start

Before column in the NAS Device Jobs table will be populated with the selected date.

4.

The Queue Summary window appears.

5.

Click

OK

. Use the Right-click

View Jobs

option to view the list of jobs.

Cleanup

The Cleanup process removes the Source SIDs after the Cutover process completes.

Active Directory Pro 10.2 User Guide

70

Binary Tree Documentation

To start the Cleanup process:

1.

Click on table rows to select one or more NAS devices in the list. (Use Ctrl-Click to select more than one row or Shift-Click to select a range of rows.)

2.

Right-Click to view the options menu and select

Cleanup

.

3.

In Job Scheduling Options window, click

OK

to begin the Cleanup process as soon as possible. Check

Do not start before

and then enter or select a date and time when the process will begin. If using the

Do not start before

option, the Cleanup Status will be displayed as Queued in the NAS table and the Do Not Start

Before column in the NAS Device Jobs table will be populated with the selected date.

4.

The Queue Summary window appears.

5.

Click

OK

. The Cleanup Status column is populated with the current status. Use the Right-click

View Jobs

option to view the list of jobs.

View Jobs

To view NAS device jobs:

1.

Click on table rows to select one or more NAS devices in the list (Use Ctrl -Click to select more than one row).

2.

Right-Click to view the options menu and select

View Jobs

. The Device Jobs window appears.

3.

The Device Jobs table includes the following columns:



Job ID - the ID of the job



Queued Timestamp - the date and time the job was queued



Command Name - the command name of the job



Status - the current status of the job



Cancel Requested - checked in a cancel of the job has been requested



Message - Result codes and messages for the job



Timeout (sec) - the timeout in seconds



Retry Count - the number of times the job has been retried



Rollback Status - the status of a rollback



Rollback Message - the status of a rollback

4.

To cancel a job, select the job and click the

Cancel

button or select

Cancel

from the right-click menu. To refresh the jobs list, click the

Refresh

button.

Active Directory Pro 10.2 User Guide

71

Binary Tree Documentation

ReACL Rollback

The ReACL Rollback feature rolls back all changes made by the ReACL process. ReACL Rollback can be performed on NAS devices that have completed the ReACL process.

To rollback ReACL:

1.

Click on table rows to select one or more NAS devices in the list (Use Ctrl -Click to select more than one row).

2.

Right-click to view the options menu and select

ReACL Rollback

.

3.

In Job Scheduling Options window, cli ck

OK

to begin the ReACL Rollback process as soon as possible.

Check

Do not start before

and then enter or select a date and time when the process will begin. If using the

Do not start before

option, the Do Not Start Before column in the NAS Device Jobs ta ble will be populated with the selected date.

4.

View rollback results by viewing the NAS device's job view.

NAS Columns

The following columns appear on the NAS screen by default:



ID - the migration ID



Device Name - The name of the device used to access the NAS device. This device must be local to the

NAS device.



UNC Path - the UNC path to the network share used to access the NAS device



Username - the username to access the NAS device



ReACL Status - The status of the ReACL process. Use the Right-click

ReACL

option to start the ReACL process.



Cleanup Status - The status of the Cleanup process. Use the Right-click

Cleanup

option to start the

Cleanup process.

Active Directory Pro 10.2 User Guide

72

Binary Tree Documentation

Section 12. Reports

The Reports screen allows you to view reports for the current AD migration, devices, migration groups, and users.

Reports are available only if the Reporting feature was installed and configured.

Dashboard

The Dashboard report is a high level status report of the current AD Migration.

To view the Dashboard report:

1.

Select

Dashboard

from the drop-down list.

2.

To filter the report to display a specific Migration Group, select an option from the

Select Migration

Group

drop-down list and click the

View Report

button. If no Migration Groups have been created, the only option available i s

ALL

which displays all objects.

The report displays the following data:



User Preparation Status - Displays the number of users prepared and not prepared for migration.



User Migration Status - Displays the number of users migrated and not migrated.



Device Preparation Status - Displays the number of devices prepared and not prepared for cutover.



Device Cutover Status - Displays the number of devices that have completed cutover and have not completed cutover.



Devices that Failed to Cutover - Displays the number of devices that failed cutover and completed cutover.



User Profiles to Device Relationship - Displays the users that have logged onto each device.

Device Detail Report

The Device Detail Report is a detailed report of device information.

To view the Device Detail Report:

1.

Select

Device Detail Report

from the drop-down list.

Active Directory Pro 10.2 User Guide

73

Binary Tree Documentation

2.

To filter the report to display a specific record, select an option from one or more drop -down lists and click the

View Report

button.

The report displays the following data for each device:



Migration Group - The Migration Group name.



Name - The sAMAccountName attribute of the source device.



Device Not Checking In - Is the device checking in with the server.



Source DN - The distinguished name attribute of the source device.



Registered - Is the device registered with the server.



Discovery - The status of the Discovery process.



ReACL - The status of the ReACL process.



Cutover - The status of the Cutover process.



Cleanup - The status of the Cleanup process.



Prepared for Migration - The device has successfully started the cutover process.



Last Contact - The time and date of the last contact between the agent and the Active Directory Pro

Server.

This report includes an extra blank page that can be ignored.

Devices that Failed to Cutover

The Devices that Failed to Cutover report is a report displaying devices that did not successfully complete the cutover process.

Active Directory Pro 10.2 User Guide

74

To view the Devices that Failed to Cutover report:

1.

Select

Devices that Failed to Cutover

from the drop-down list.

Binary Tree Documentation

2.

To filter the report to display a specific Migration Group, select an option from the

Select Migration

Group

drop-down list and click the

View Report

button. If no Migration Groups have been created, the only option available is

ALL

which displays all devices.

The report displays the following data for each device:



Device Name - The sAMAccountName attribute of the source device.



Migration Status - The status of the migration.



Last Job Message - The last job status.

Migration Group Status

The Migration Group Status report displays metrics information about all migration objects.

To view the Migration Group Status report:

1.

Select

Migration Group Status

from the drop-down list.

2.

To filter the report to display a specific Migration Group, select an option from the

Select Migration

Group

drop-down list and click the

View Report

button. If no Migration Groups have been created, the only option available is

ALL

which displays all objects.

Active Directory Pro 10.2 User Guide

75

User Status Report

The User Status Report is a detailed report of user information.

To view the User Status Report:

1.

Select

User Status Report

from the drop-down list.

Binary Tree Documentation

2.

To filter the report to display a specific record, select an option from one or more drop-down lists and click the

View Report

button.

The report displays the following data for each user:



Migration Group - The Migration Group name.



Display Name - The display name attribute of the source user account.



Source User ID - The User ID of the source user account.



Target User ID - The User ID of the target user account.



Source DN - The distinguished name attribute of the source user account.



Target DN - The distinguished name attribute of the target user account.



Source UAC - Indicates if the user account is enabled in the source.



Target UAC - Indicates if the user account is enabled in the target.



Migrated - This column shows any users that have been manually tagged with the Migrated status. This is an optional tag for tracking purposes and does not necessarily represent a successful user migration.



Prepared for Migration - A value of True verifies that the user has been synchronized with the target.



Ready to Sync - User has been marked as Ready-to-Sync.



Failed to Sync - If the Ready-to-Sync value is true, AND Failed to Sync is a value of True, this means that the synchronization has actually failed. Examine the log for details. If the Ready-to-Sync value is False, and Failed to Sync is a value of True, this means that synchronization has not yet been attempted for this user.



Status Message - The last status. No message is displayed if Failed to Sync is False.



Migration Group ID - The ID of the Migration Group.

Active Directory Pro 10.2 User Guide

76

Binary Tree Documentation

User Profiles to Device Relationship Report

The User Profiles to Device Relationship Report is a report showing the users that have logged onto each device.

To view the User Profiles to Device Relationship Report:

1.

Select

User Profiles to Device Relationship

from the drop-down list.

2.

To filter the report to display a specific Migration Group, select an option from the

Migration Group

dropdown list and click the

View Report

button. If no Migration Groups have been created, the only option available is

ALL

which displays all devices.

The report displays the following data for each user:



Device Name - The name of the device.

 sAMAccountName - The sAMAccountName of the user.



First Name - The first name of the source user.



Last Name - The last name of the source user.



Profile Last Used - The last date the profile was used.

Report Options

Report options are available above the displayed report.



Paging - Click the

First Page

,

Previous Page

,

Next Page

, and

Last Page

arrows to page through a multi page report.



Refresh - Click the

Refresh

icon to update the data in the report. This option is also available in the rightclick menu while hovering over the report.



Print - Click the

Print

icon to open printing options. This option is also available in the right-click menu while hovering over the report.



Print Layout - Click the

Print Layout

icon to view the report as it will be printed. This option is also available in the right-click menu while hovering over the report.

Active Directory Pro 10.2 User Guide

77

Binary Tree Documentation



Page Setup - Click the

Page Setup

icon to open paper, orientation, and margin options. This option is also available in the right-click menu while hovering over the report.



Export - Click the

Export

icon to select a format to export. This option is also available in the right-click menu while hovering over the report.



Zoom - Click the drop-down list and select a zoom option. This option is also available in the right-click menu while hovering over the report.



Find / Next - Enter a value to search for in the report and click

Find

. Click

Next

to find the next instance of the value.

Active Directory Pro 10.2 User Guide

78

Binary Tree Documentation

Section 13. Using the Directory Sync Pro Log Viewer

The Directory Sync Pro Log Viewer allows you to view, search, export, and clear synchronization logs.

To open and view logs in the Directory Sync Pro Log Viewer:

1.

In the Active Directory Pro console, click the

Logs

icon . The Directory Sync Pro Log Viewer opens.

2.

The Synchronization profile is automatically selected and log entries associated with the profile are displayed. To change the profile, select a different profile from the

Profile

drop-down list. Click the

Refresh icon next to the Profile drop-down list to refresh the list of profiles and the log grid.

13.1 Searching Log Entries

To search for log entries:



Enter a search term in the

Search

field and then click the Find icon. The table refreshes to show the search results.

13.2 Pausing a Log

You can stop the continuous scrolling of the log to allow for easier reading. This feature pauses the display only, not the logging function.

To pause the log:

1.

Click the Pause icon.

2.

To restart the log display, click the Play icon (next to “Paused”).

Active Directory Pro 10.2 User Guide

79

Binary Tree Documentation

13.3 Showing Log Entries for a Time Period

To show all log entries for a time period:



Select a “Show...” option from the drop -down list near the upper right corner of the console. The table refreshes to show all log entries for the selected time period.

13.4 Filtering the Log

To filter the log:

1.

Click the filter button on any column header to open the filter window.

2.

Enter the filter criteria, and then click

Filter

. The table refreshes to the filtered log entries.

3.

User the

Clear Filter

button to clear the filter.

13.5 Grouping the Log by Column

To group the log by a column:



Drag a column header to the bar above the log table to group the log by a specific column. The table refreshes grouped by the selected column.

Active Directory Pro 10.2 User Guide

80

Binary Tree Documentation

13.6 Viewing Log Entry Details

To view log entry details:



Click the plus icon in the log entry. The entry expands to display the details of the log entry.

13.7 Exporting Log Entries

To export the log entries of the currently selected profile:

1.

Click

Export All

.

2.

Enter a File name, location, a file type, and then cli ck

Save

.

13.8 Clearing Log Entries

To clear old log entries of the currently selected profile:

1.

Click

Clear

. The Clear Log window opens.

2.

Select a number and time unit (Weeks, Days, or Hours) from the drop-down list to clear the log of older entries and then click

OK

.

3.

Also, you have the option to clear the log entries of all profiles older than the selected time automatically by selecting

Clear log automatically (applies to all profiles)

Binary Tree recommends that the logs be set to clear automatically to prevent the accumulated data from becoming too large.

To clear all log entries of the currently selected profile:



Click

Clear All

. All log entries of the currently selected profile are cleared.

Active Directory Pro 10.2 User Guide

81

Binary Tree Documentation

Section 14. Troubleshooting



Problem:

What do you do when a user tries to use a network printer post ReACL process and/or cutover and receives an access denied error?

Solution:

Synchronize the SID History for that user to resolve the problem.



Problem:

ASP.NET will sometimes not register properly with IIS, which can cause errors when the Active

Directory Pro agent tries to communicate with the Web Service. How do I address this?

Solution:

During installation, the installer needs to enable the IIS feature for the server if the feature was not enabled so that web-service can be installed and configured. To address this problem, you should manually re-register the ASP.NET with IIS. To do this, run the below command on the server under

C:\Windows\Microsoft.NET\Framework\v4.5.2: aspnet_regiis -i



Problem:

What do I do if the Agent_<datetime>.log shows an Error: Login failed for user 'IIS

APPPOOL\ADM AppPool' in System.Data.SqlClient.SqlException?

Solution:

To fix this:

1.

Open SQL Management Studio where Directory Sync Pro databases were setup

2.

Go to SQL Server Security -> Logins

3.

New Login

4.

User name: IIS APPPOOL\ADM AppPool

5.

Click on

User Mappings

6.

Select BTCodex for the database

7.

Select db_datareader and db_datawriter for Roles

8.

Click

OK

9.

Restart the agent on the workstation or wait for the next polling interval



Problem:

Observed Access Denied error when trying to ReACL a Windows NAS Shared Drive.

Solution:

To fix this:

1.

Add the user credential in the NAS screen in the Active Directory Pro Console. This user shoul d be installed on a workstation with Local Admin Rights.

2.

After the agent installed on the workstation, change the Active Directory Pro Agent Service account from Local System to the user credential specified in step 1. This user should als o be logged in on the workstation as well.

3.

Turn off UAC on the workstation

4.

ReACL the Windows NAS Shared Drive



Problem:

Users are getting an error message that their Recycle Bin has been corrupted once their computer has been migrated.

Solution:

This is a common issue with Domain Migrations and is caused when the Recycle Bin is not

Active Directory Pro 10.2 User Guide

82

Binary Tree Documentation empty. This is happening because the name of the Recycle Bin is the user’s SID and the Recycle Bin cannot be reACL’d. After the workstation has been reACL’d and migrated when the user logs on, if the existing

Recycle Bin is not empty the user cannot access it. But if the existing Recycle Bin is empty a new one is created and the Target user’s SID is the name of the Recycle Bin.

Resolution:

Empty the Recycle Bin as part of the Cutover process



Problem:

Directory Sync Pro does not start if SQL Authentication method is used with Windows

Authentication.

Solution:

Manually add the computer account to the SQL server and granted with the sysadmin role. To accomplish this, perform the following steps.

1.

Via the SQL Management Studio, open a new query window and enter the below script

2.

CREATE LOGIN [Domain\machine_name$] FROM WINDOWS

3.

Via the Security and Logins, locate the newly created Computer Name

4.

Grant this user with sysadmin role



Problem:

A workstation that has been successfully cutover no longer responds to any additional jobs, such as Cleanup.

Solution:

If a workstation that has been successfully cutover now fails to respond to any additional jobs, such as Cleanup, check the Application event log. If you see a

"The remote name could not be resolved"

error, this most likely means that the SRV record for the ADM server can no longer be resolved due to a

DNS lookup failure.

If you cannot "Ping" the ADM server from any other machines in the target domain, then you will need to remedy this on a more global scale, such as creating a conditional forwarder on the target machines' current DNS server pointing to the appropriate location.

If you are able to "Ping" the ADM server, then check the Network Profile that was used during the Cutover to verify that the DNS settings were correct in that profile.

Password Sync Troubleshooting



Problem:

If you encounter "Access is denied" errors when syncing passwords with Directory Sync Pro.

Solution:

This is most likely because the utility (psexec.exe) used for remote calls to the Global Catalog is failing. Some things you can try are:

1.

Try the GC server's IP address, FQDN and Shortname. IP address often works when others do n ot.

2.

From the Directory Sync Pro machine browse to \\[GC]\admin$ with the admin username\password

3.

Run the Directory Sync Pro service with credentials that have access to the GC instead of as

LocalSystem

4.

Firewalls\Anti-Virus software should not be a problem but turning them off may help

Active Directory Pro BITS Troubleshooting



Problem:

The Active Directory Pro UI issued the ‘Upload Logs’ command to the Agent for a device, but nothing was uploaded to the web server.

Active Directory Pro 10.2 User Guide

83

Binary Tree Documentation

Solutions:

IIS Web Server where Active Directory Pro Web Service is installed:

1.

Open IIS Manager

2.

Verify that Default Web Site > adm > DeviceLogs exists a.

Verify there is a BITS Uploads option icon in the Feature View (at the bottom)

If not, use PowerShell to install

Import-Module ServerManager

Add-WindowsFeature BITS-IIS-Ext

b.

Verify in the BITS Upload view, that "Allow clients to upload files" is checked

1.

Open IIS Manager

2.

Go to Default Web Site -> adm -> DeviceLogs

3.

Click on Basic Settings in the right pane a.

Verify the Application Pool is set to "ADM AppPool"

4.

Click on Edit Permissions -> Security tab a.

Verify the IUSR account is in the list and has the following permissions: Modify, Ready & execute, List folder contents, Read, Write

On the Dev ice where the ‘Upload Logs’ command was issued:

1.

Navigate to C:\Program Files (x86)\Binary Tree\ADPro Agent\Files

2.

Open the agent_<date>.log in Notepad a.

Verify the URI for the server /api and /devicelogs location is correct

1.

Navigate to C:\Program Files (x86)\Binary Tree\ADPro Agent\Files

2.

Open the PowerShell -<date>-<time>-BT-UploadLogs.log file a.

Check for problems or errors

1.

Go to Start -> Run -> services.msc

2.

Verify the Background Intelligent Transfer Service is started

Active Directory Pro 10.2 User Guide

84

Binary Tree Documentation

Appendix A. Cutover Job Result Codes

Cutover Job Result Codes

8

16

32

Result

Code

Error

1

2

4

Unidentified Error - PowerShell Command Error

Source Domain could not be contacted

Bad Source Credentials

Target Domain could not be contacted

Bad Target Credentials

64

128

256

Target DNS Server could not be contacted or could not resolve the target DNS domain

Change Obtain DNS by DHCP

Set DNS Server IPs

Set WINS Servers

512 Register NIC with DNS

1024 Clear DNS Suffix Search List / Set to use NIC

2048 Set Alternate DNS Suffix List

4096 Enable Dynamic DNS Registration

8192 Set NIC Specific DNS Suffix

16384 Domain Disjoin Failed

32768 Domain Join Failed

65536 Source domain name does not match the system's domain

131072 Computer Reboot failed

No

262144 Target Domain Name could not be resolved via existing DNS, and new DNS Servers were not provided

No

No

No

No

Rollback

Possible

No

No

No

An odd number result codes represents an error running the Cutover PowerShell script. The most common cause of an odd numbered result code during cutover is that the device either has no network card with default gateway or more than one network card with a default gateway.

Result codes are additive. There are likely multiple errors if the result code is not represented in the table.

Upload Logs Result Codes

This table includes result codes for BT-UploadLogs PowerShell jobs.

Active Directory Pro 10.2 User Guide

85

Result

Code

Error

32 (zip folder) could not be created.

64 Failed to Zip log files on device.

128 Upload failed to contact the server. Please verify the URL (url) is correct and BITS is enabled.

Binary Tree Documentation

Rollback

Possible

No

No

No

Active Directory Pro 10.2 User Guide

86

Binary Tree Documentation

Appendix B. SMART Active Directory Reporter

Overview

SMART Active Directory Reporter (AD Reporter) provides a query-based interface that allows network administrators and IT personnel to easily build custom queries for issues specific to their network.

AD Reporter queries Windows 2003/2003 R2/2008/2008 R2/2012 Active Directories across forests from a central console, allowing you to perform customized searches by domain, object, object property and by using wildcards.

AD Reporter search results can be set to any or all object properties.

Installing AD Reporter

To install AD Reporter:

1.

Open the zip file and then launch the Setup.exe.

2.

Select the

Install SMART Active Directory Reporter Software

checkbox and click

Install

.

Active Directory Pro 10.2 User Guide

87

3.

Select the Installation Drive and Path and click on

Select

.

Binary Tree Documentation

4.

Wait for installation to complete.

Uninstalling AD Reporter

To uninstall AD Reporter:

1.

Select

Uninstall

from the Start menu.

Active Directory Pro 10.2 User Guide

88

2.

Click on

OK

to continue with the uninstall.

Binary Tree Documentation

3.

Select

ADReporter

and click on

OK

Active Directory Pro 10.2 User Guide

89

4.

Click on

Exit

when the uninstall is complete.

Binary Tree Documentation

Opening AD Reporter

To open AD Reporter:

1.

In the Start menu or Apps screen, right-click on the

AD Reporter

icon and select to

Run as administrator

.

Setting the screen size

You can change the size of the AD Reporter application to better fit your screen.

To set the screen size:

1.

On the

Configuration

menu, click

Set Screen Size

.

2.

In the Screen Size Options, select a screen size resolution.

3.

Click

OK

.

4.

Close and reopen the application to view the application in the selected size.

Configuring AD Reporter

Configuring AD Reporter requires you to define one or more active directory domains and select the current active directory domain to search.

To configure AD Reporter:

1.

On the

Configuration

menu, click

Add Active Directory Domain

.

2.

In the Domain Configuration Wizard, enter the domain NetBIOS name in the

Active Directory Domain

NetBIOS in Upper Case

field, and then click

Verify

.

3.

Click

Add

.

Active Directory Pro 10.2 User Guide

90

Binary Tree Documentation

4.

On the

Configuration

menu, click

Set Current Active Directory Domain

.

5.

Select the current active domain to search, and then click

OK

.

Searching

To search:

1.

Click the type of object to search for from the

Object Type

list. The list includes:



Domain



User



Group



Organizational Unit (OU)



Computer



Print Queue



Volume (Shared Folders)



Contact



Exchange (user properties)

2.

Select the property to search for from the

Search For

list.

3.

Select one or more properties to return in the results from the

Return results

list. Use Ctrl-Click or Shift-

Click to select more than one property to return.

4.

Click

Begin Search

. You can also click

Search Active Directory

on the

Active Directory Search and Report

menu.

5.

In the Narrow Search Option window, enter known property information to narrow the search criteria.

Wildcards can be used in the search criteria. The default "All" will search for all of the instances of the selected property.

6.

Click

OK

. The results are displayed.

If results appear to take a long time to retrieve, DNS server may not be properly configured, there may be broken trust relationships – the domain AD Reporter is querying is not reachable, or the account or proxy account may not have adequate rights to the domain being queried (check user rights).

Results

Viewing results

To view results:



In the results list, click a column header to sort by the column.



Click and drag the column headers to increase the width of each column.



Use the scroll bars to view information that is not displayed in the window.

Saving results as a text file

Active Directory Pro 10.2 User Guide

91

To save results as a text file:



On the

File

menu, click

Save Search Results as Text File

. The results file is saved in the

ADReporter\Reports folder.

Binary Tree Documentation

If you have searched for a large amount of information, we recommend you save results as an MS

Excel file as the text file does not have columns. Once you save the results as an MS Excel file, you can easily format the columns to a more readable format.

Viewing and managing results saved as a text file

To view and manage results saved as a text file:

1.

On the

View and Manage Saved Results

menu, click

View and Manage Text File Reports

.

2.

In the AD Reporter Manage Reports window, select a report and click

View

to view the file. You can also click

Delete

to remove the file.

Printing results

To print results:

1.

On the

File

menu, click

Print Search Results

.

2.

Select a printer and then click

Print

.

Exporting results as an Excel file

To export results as Excel file:

1.

On the

File

menu, click

Export Results as MS Excel File

.

2.

Enter a name for the file, and then click

OK

. The results file is saved in the ADReporter\Reports folder.

Viewing and managing results exported as an Excel file

To view and manage results exported a s an Excel file:

Excel must be installed.

1.

On the

View and Manage Saved Results

menu, click

View Saved Microsoft Excel File

.

2.

In the Saved Reports window, select a report and click

Open

to view the file in Excel.

Advanced Options

Editing Object Properties

To edit object properties:

1.

On the

Advanced Options

menu, click

Edit Object Properties

.

2.

In the AD Reporter Advance Properties window, select an object type to modify and then click

Modify

.

3.

To remove an object property, select the property and click

Remove

. To add an object property, enter the property name and click

Add

.

Active Directory Pro 10.2 User Guide

92

Binary Tree Documentation

Added properties must exist, are case-sensitive, and must be populated to return information.

4.

Select the object property to update the list of object properties.

Backing up and restoring Object Properties

To back up and restore Object Properties:

1.

On the

Advanced Options

menu, click

BackUp/Restore Object Properties

, and then select one of the following options:



BackUp Current Object Properties

– backs up current object properties to a .zip file at the installation location



Restore Default Object Properties

– restores the default object properties



Restore Object Properties From BackUp

– restores the object properties from the saved back up

2.

Click

OK

.

3.

Select the Object Property to update the l ist of object properties.

AD Report Tools

Convert Raw Active Directory Data to Textual Format

To convert Raw Active Directory Data to textual format:

1.

Create a report that includes results in Raw data format (SID, GUID, LogonHours, Date, GroupType).

2.

In the results list, double-click the searched for object property.

3.

In the Select Item to Send to Clipboard list, select the raw data to convert from the list and then click

OK

.

4.

On the

AD Report Tools

menu, click

Convert Raw Active Directory Data to Textual Format

.

5.

In the Conversion window, select the conversion type for the raw data on your clipboard and then click

OK

.

6.

Right-click and select

Paste

. The raw data is inserted.

7.

Click

OK

. The converted data is displayed.

Get all current object properties by Object Type

To get all current object properties by object type:

1.

On the

AD Report Tools

menu, click

Get All Current Object Properties by Object Type

.

2.

Select an object type and then click

OK

.

3.

Select one or more properties to add to AD Reporter and click

OK

.

4.

The AD Reporter Available Properties window appears with the selected properties added to the list of properties. You can also remove or add properties on this screen.

5.

Click

Close

to close the window.

Active Directory Pro 10.2 User Guide

93

Binary Tree Documentation

Active Directory Reports

AD Reporter includes several predefined reports allowing quick searches for frequently used information.



On the

Active Directory Reports

menu, point to

user Reports

,

group Reports

, or

computer Reports

, and then click a report. The search results appear.



On the

Active Directory Reports

menu, click

Generate User Mapping File

to generate a list of unmatched sAMAccountName values on the Source and Target based on the input of a matching attribute.

Active Directory Reports include:

User Reports



Disabled users

– all users with the Account St atus = “Account Disabled”



User never logged on

– all users with the Logon Status = “0” (zero) or blank



All users without an email address

– all users with the Email Status = “No email address”



Duplicate Source and Target Users

– duplicate same-named user accounts in the source and target. At least two domains must be configured to run this report.

Group Reports



Groups with no members

– all groups with the Membership Status= “no group members”



All security groups

– all security groups with Group Type value displayed



All distribution groups

– all distribution groups with Group Type value displayed



Duplicate Source and Target Groups

– duplicate same-named group accounts in the source and target. At least two domains must be configured to run this report.

Computer Reports



All XP computers

– All XP computers with Computer Type value displayed



All Vista computers

– All Vista computers with Computer Type value displayed



All Windows 7 computers

– All Windows 7 computers with Computer Type value displayed



All Windows 8 computers

– All Windows 8 computers with Computer Type value displayed



All Windows 2000 Servers-Workstations

– All Windows 2000 Servers-Workstations with Computer Type value displayed



All Windows 2003 Servers

– All Windows 2003 Servers with Computer Type value displayed



All Windows 2008 Servers

– All Windows 2008 Servers with Computer Type value displayed



All Windows 2008 R2 Servers

– All Windows 2008 R2 Servers with Computer Type value displayed



All Windows 2012 Servers

– All Windows 2012 Servers with Computer Type value displayed



All Computers without a description

- All Computers with the Computer Description = “No Description”

Generate User Mapping File

Active Directory Pro 10.2 User Guide

94

Binary Tree Documentation

The User Mapping File is a list of unmatched sAMAccountName values on the Source and Target based on the input of a matching attribute.

If using an attribute to link the source and target user accounts together, ensure that the values of the attribute on the Source are unique so there are not multiple matches generated. If the values of the attribute on the Target are not unique, the report will throw an error and will not allow the creation of the UsersMapping.map file at the end of the process.

To generate a User Mapping File:

1.

On the

Active Directory Reports

menu, click

Generate User Mapping File

.

2.

Select a Source Domain and click

OK

.

3.

Select a Target Domain and click

OK

.

4.

Enter the LDAP name of the AD attribute you want the accounts to match on and click

OK

. The matching results appear.

5.

Click

Yes

to create a mapping file from the results. A mapping file cannot be created if one or more of the results have multiple target matches.

AD Reporter Best Practices

Check Access Rights



You must be logged on to a Windows 2003/2008/2012 Domain. If you are not logged on to a Windows

2003/2008/2012 Domain, you cannot connect to Active Directory to set AD object attributes.



If you are searching a single domain, you must have Domain Admin rights to the domain.



If you are searching domains and child domains, you must have Enterprise Admin rights to the domain tree.



Ensure that non-existent or broken trusts relationships do not exist. If there are non-existent or broken trust relationships, AD Reporter will attempt to query non-existent domains, slowing the search.

To Query Share Information

When Querying Share (Volume) information, Shares must be published to Active Directory. AD Reporter searches

Active Directory information, not computer information; if the Shares are not published to Active Directory, AD

Reporter will not retrieve results.

Active Directory Pro 10.2 User Guide

95

Ports

1433

1433

80 or 443

(Configurable)

Protocol

TCP & UDP

TCP

Binary Tree Documentation

Appendix C. Advanced Network Requirements

Active Directory Pro Port Requirements

Source Target

Active Directory Pro

Web Service

SQL Server holding primary database

Active Directory Pro

Console

SQL Server holding primary database

Client servers and workstations

Active Directory Pro Web Service

TCP & UDP

Directory Sync Pro to SQL Server Access

Source Target

Directory Sync Pro SQL Server holding the primary database

Directory Sync Pro SQL Server holding the logging database

Ports

1433

1433

Protocol

TCP & UDP

TCP & UDP

Directory Sync Pro Profile Specific Scenario Requirements

Directory Sync Pro Match Only or Update Only Profile (no object creation)

Source Target Ports Protocol

Directory Sync Pro Source Domain controllers

Directory Sync Pro Target Domain controllers

389, 445*, 3268

389, 445, 3268

TCP (all)

UDP (389)

TCP (all)

UDP (389)

* Port 445 only needs to be open to the Source Domain Controller during Directory Sync Pro Profile creation

Directory Sync Pro Profile with Create Only or Create/Update Matching Option

Source Target Ports Protocol

Directory Sync Pro Source Domain controllers 389, 445*, 3268

TCP (all)

UDP (389)

Directory Sync Pro Target Domain controllers

139, 389, 445,

3268

TCP (all)

UDP (389)

* Port 445 only needs to be open to the Source Domain Controller during Directory Sync Pro Profile creation

Directory Sync Pro Profile with Synchronize Passwords selected

Source Target

Directory Sync Pro Source or Target Domain controllers

Ports

139, 389, 445,

3268

Protocol

TCP (all)

UDP (389)

Active Directory Pro 10.2 User Guide

96

Binary Tree Documentation

Directory Sync Pro Profile with SID History Synchronization selected

Source Target Ports Protocol

Directory Sync Pro

Source or Target Domain controllers running

Windows 2008 or newer

Directory Sync Pro

Source or Target Domain controllers running

Windows 2003

Source PDC Target GC

135, 137, 139, 389, 445, 3268 and 49152-65535

TCP (all)

UDP (389)

135, 137, 139, 389, 445, 3268 and 1024-5000

TCP (all)

UDP (389)

135, 138, 389, 445, 1027

TCP (all)

Active Directory Pro 10.2 User Guide

97

Binary Tree Documentation

Appendix D. Active Directory Pro SQL Re-permission

Use the Active Directory Pro SQL Repermission utility to update a SQL Server’s Source AD Windows Authentication

Group Login permissions and their associated database users for the Target domain the user and group objects have been migrated to.

Prior to re-permissioning SQL servers, accounts must be migrated and Mapping Files created using Active Directory

Pro.

1.

Download the

Binary Tree SQL Repermission.msi

file from the FTP location provided.

2.

Run the installer on the Active Directory Pro server or any machine that will have access to the SQL Server instance and databases to be re-permissioned.

3.

The Welcome screen appears. Click

Next

to continue.

Active Directory Pro 10.2 User Guide

98

4.

The Ready to Install screen appears. Click

Install

to begin the installation.

Binary Tree Documentation

5.

When the installation completes, the InstallShield Wizard Complete message appears. Click

Finish

to close the wizard.

6.

Copy the

map.usr

and

map.gg

files created using Active Directory Pro to a folder on the same machine.

Active Directory Pro 10.2 User Guide

99

7.

Launch the SQL Repermission utility from the Apps screen or the Start menu.

Binary Tree Documentation

8.

Select the

SQL Logon Method

. If SQL Server Authentication is selected, enter the Username and

Password. If Windows Authentication will be used, you must be logged onto the machine with an account that has access to the SQL Server instance and databases to be re-permissioned.

9.

Click on

Browse

to select the SQL Server instance to be re-permissioned.

Active Directory Pro 10.2 User Guide

100

10.

Select the SQL server instance from the list and click on

OK

.

Binary Tree Documentation

11.

Click on the

Connect

button. If connection is successful, the Logging message should read “SQL Server

Connected” and there should be databases available to pick from in the drop -down list.

Note: If the login information is incorrect, the following error will be received. The credentials to connect to the SQL server instance should be corrected, and then the Connect should be retried.

12.

Once successfully connected to the SQL server instance, in the drop down select either

<ALL>

or a specific database that needs to be re-permissioned.

13.

Click on the

Generate SQL

button. If the

Open script in Notepad

option is left checked, the results will be displayed when completed.

14.

The Logging information will display the name of the SQL file created in the directory that the application is located.

Active Directory Pro 10.2 User Guide

101

Binary Tree Documentation

15.

If the option to open the file in Notepad was not checked, navigate to where the file was saved and rightclick and choose

Open with Notepad

.

16.

The results of the process can be reviewed prior to actually executing it on the SQL Server instanc e.

17.

When the SQL file has been reviewed, either open the file in SQL Server Management Studio or create a new Query in SQL Server Management Studio and copy/paste the contents of the file into the Query.

18.

Execute the Query and the new target credentials wi ll be created.

Active Directory Pro 10.2 User Guide

102

Binary Tree Documentation

Appendix E. Creating Linked Exchange Account

This process supports customers that require completing their AD migration before their Exchange migration by creating a linked Exchange account. This allows users to log into their mailbox that still resides in the source

Domain, using their target credentials.

After an account has been migrated, the device reACL’d and cutover to the target, follow the next steps in order to link the target account to the Exchange mailbox still residing in the source.



In Active Directory Pro Console:

1.

Run the action on the migrated accounts “Enable on Target/Disable on Source”.

2.

Execute Sync in Active Directory Pro for that Directory Sync Pro Profile.

3.

Run the “Mark as Migrated” action on the above user accounts.

4.

Filter on the “Migrated” column as “True” and verify only the accounts to be actioned are in the grid.

5.

Export the Active Directory Pro Grid to a CSV.

In Directory Sync Pro , on the Exchange Target Options tab, make sure the “Allow Enable/Disable of

Mailbox Enabled Source Object” option is set to “Yes”.



On the Source Exchange server:

1.

Download the script file to a local directory and rename BT-ConvertMBX-to-Linked.ps1. The script can be obtained by contacting [email protected].

2.

Copy the updated CSV created from export of the Active Directory Pro grid to the same local directory.

3.

Run the following Exchange PowerShell command – replace red date with actual data.

.\BT-ConvertMBX-to-Linked.ps1 – InputCsvPath c:\temp\Export.csv

– OutputFolder c:\temp\outputlog –

SourceDomainDC E2E-DC1.DOM1.E2E.dom

– SourceDomainGC E2E-DC1.DOM1.E2E.dom

– TargetDomainController

QA-E2E-DC1.QA-Dom1.QA-E2E.dom

Results:

Log output will also be created in the directory specified in the PowerShell command.

Active Directory Pro 10.2 User Guide

103

Binary Tree Documentation

Verification:



Check the following AD attributes:

1.

msExchMasterAccountSid of the source account should contain the target account objectSID value.

2.

Check that the legacyExchangeDN on the both the source and target account has not changed.



Check mailbox using Outlook

1.

Log in to device using target account.

2.

Launch Outlook.

3.

Outlook should launch without prompting for credentials (should us pass-through authentication).

4.

Check that any additional proxyaddress’ are still present on the source user mailbox.

5.

Spot check in Outlook for the retention of signatures, tool bar edits, etc.

Additional:



Once all of the above has been completed and verified, migrate the mailbox to the target Exchange and verify that it is still accessible.

Active Directory Pro 10.2 User Guide

104

Binary Tree Documentation

Appendix F. Sample Admin Agent PowerShell Script

This is a sample PowerShell starter script that moves users from one OU to another. You may want to use this as a baseline on which to build your own custom scripts. Be sure to test your scripts in a non -production environment.

Param (

[System.String] $AdminUsername = $null,

[System.String] $AdminPassword = $null,

[System.String] $DomainController = $null,

[System.String] $TargetOU = $null

)

$WarningMessages = New-Object System.Collections.ArrayList try

{

#Active Directory Pro PowerShell Output Object

#This object is used to report status to the Active Directory Pro Console

$output = New-Object BinaryTree.ADMigrator.Agent.PSHelpers.PSOutput

#Verify input parameters are not $null.

if($AdminUsername -eq $null -OR $AdminPassword -eq $null -OR

$DomainController -eq $null -OR $TargetOU -eq $null)

{

#Write-Error will show in Active Directory Pro Log

Write-Error 'AdminUsername, AdminPassword, DomainController, and

TargetOU parameters are required.'

$output.ResultCode = 1

return ($output)

}

Active Directory Pro 10.2 User Guide

105

Binary Tree Documentation

#Output object's AgentFilePath is the download directory for the local agent installation

[System.String]$downloadsDirectory = $output.DownloadsPath

#Active Directory Pro Agent will download AdminAgent.csv file to the downloads directory before each job

#This CSV contains a list of Users to perform actions on

[System.String]$adminAgentCSVPath = Join-Path -Path $downloadsDirectory -

ChildPath 'AdminAgent.csv'

#Read AdminPassword input parameter and convert to a secure string to be used by a PSCredential object

$securePassword = $AdminPassword | ConvertTo-SecureString -AsPlainText -

Force

#Build the credential using $AdminUsername and $securePassword

$credential = New-Object

System.Management.Automation.PSCredential($AdminUsername, $securePassword)

#Create a Remote PowerShell Session to the server $DomainController and provide PSCredential object

$session = New-PSSession -ComputerName $DomainController -Credential

$credential

#Invoke-Command to ensure the ActiveDirectory modules are imported.

Invoke-Command -Session $session -ScriptBlock { Import-Module

ActiveDirectory }

#Merge the remote PowerShell Session's ActiveDirectory module to the local session

Import-PSSession -Session $session -Module ActiveDirectory -AllowClobber

#Verify $adminAgentCSVPath exists

if((Test-Path $adminAgentCSVPath) -eq $false)

{

Write-Error "Admin Agent CSV does not exist at path:

$adminAgentCSVPath"

Active Directory Pro 10.2 User Guide

106

Binary Tree Documentation

#Different ResultCodes can be used to troubleshoot script errors

$output.ResultCode = 2

return ($output)

}

#Read Admin Agent CSV into $users variable

$users = Import-CSV $adminAgentCSVPath

######## Admin Agent User Script Here ########

#For each user in the list

foreach($user in $users)

{

#Move the object to the $TargetOU

Move-ADObject -Identity $user.TargetDN -TargetPath $TargetOU -

Confirm:$false -Verbose

}

######## Admin Agent User Script Here ########

#ResultCode of 0 is a success, set and return

$output.ResultCode = 0

return ($output)

} catch

{

#Generic unexpected ResultCode

$output.ResultCode = 99

#Construct generic error message and include Exception message text.

$errorMessage = $_.Exception.Message

Active Directory Pro 10.2 User Guide

107

Write-Error "ERROR: $errorMessage"

Binary Tree Documentation

#Return $output object to Active Directory Pro Agent for reporting to

Active Directory Pro Console

return ($output)

}

Active Directory Pro 10.2 User Guide

108

Binary Tree Documentation

About Binary Tree

At Binary Tree, we power enterprise transformations. Our award-winning software and services help Enterprise businesses modernize their Microsoft email, directories and applications by moving and integrating them to the cloud. Binary Tree mitigates the ris k of delays, downtime, and budget overruns for complex transformation projects for large organizations. We understand Enterprise migration requirements that go well beyond the needs of small companies. Since 1993, we’ve transformed more than 7,000 global clients and 40 million users, including

6 million to Office 365. Our business first approach helps plan, move and manage the transformation process from end-to-end. So, clients stay focused on their core business while our experts deliver a low-risk, successful IT transformation.

Binary Tree is a Microsoft Gold Partner and a globally preferred vendor for Offices 365. Our headquarters are located outside of New York City with global offices in the United Kingdom, France, Germany, Sweden and

Singapore. For more, visit us at www.binarytree.com

.

Binary Tree Social Media Resources

© Copyright 2017, Binary Tree, Inc. All rights reserved.

Binary Tree, the Binary Tree logo, and any references to Binary Tree’s products and services, are trademarks of Binary Tree, Inc. All other trademarks are the trademarks or registered trademarks of their respective rights holders.

Active Directory Pro 10.2 User Guide

109