Binary Tree 9.2 Active Directory Migrator User Guide
SMART Active Directory Migrator 9.2 is a software solution that helps you seamlessly migrate Active Directory objects, settings and properties to a new or existing Active Directory environment. It includes a back-end migration and synchronization engine, a front-end management console, and a lightweight agent for workstations and member servers, all of which communicate with a central web service. This process reduces risks and complexity, saves you time and money, and maintains transparent interoperability during the migration.
Advertisement
Advertisement
SMART Active Directory Migrator 9.2
User Guide
MAY 2016
Table of Contents
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 2
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 3
Section 1. Introduction
1.1 About SMART Active Directory Migrator
Whether your company is performing an Active Directory Migration as a result of an acquisition, merger, or divestiture, or simply as part of rebuilding an existing Active Directory restructure to meet technical or organizational needs,
SMART Active Directory Migrator (SMART AD Migrator) dramatically reduces risks, complexity, time, and costs associated with migrating and synchronizing their Active Directory environment to an existing or new Active Directory environment.
SMART AD Migrator
o Is a comprehensive software solution that seamlessly migrates AD objects, settings and properties o Has a back-end migration and synchronization engine o Has a front-end management console providing complete control of the migration o Ensures security and reliability of the product o Provides complete migration of relevant objects and properties o Migrates AD objects even if the source and target servers are not connected and are on isolated networks o Allows for migrations to occur during business hours with minimal effect on user productivity o Allows administrators to perform all migration-related tasks during business hours, reducing the administrator’s workload o Maintains transparent interoperability during the migration o Provides users access to all network resources, regardless of the migration status o Includes password and SID History synchronization capabilities that provide real-time data o Provides the ability to reverse the changes after key steps in the migration process o Can be used for any migration scenario, from consolidation to a restructuring of AD o Can be customized to meet unique requirements of any organization o Is highly conducive for migration of workstations in a distributed workforce
Key Features
o Complete migration o Minimal downtime or interruptions to users o Provides coexistence o Synchronization of AD objects o Safe with ability to recover original state o Flexible migration o Highly customizable o Synchronizes SID history
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 4
o Ability to copy Passwords o Highly conducive for migration of workstations in a distributed workforce
Important! - Windows 10 is NOT SUPPORTED at this time.
1.2 Audience for SMART Active Directory Migrator
This document assumes the reader has some experience using Active Directory and some basic Administration skills. A fundamental understanding of SIDs (Security Identifiers) is also beneficial.
1.3 Getting More Information
For additional resources, refer to Support:
www.binarytree.com/support
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 5
Section 2. Migration Project Management
2.1 SMART Active Directory Migrator Architecture
The first step towards success on a project using SMART AD Migrator is to understand the product architecture and how this architecture will operate in your environment.
SMART Active Directory Migrator consists of the following components: o A directory synchronization engine o A REST based web service o A management interface o A lightweight agent for workstations and member servers o A database running on Microsoft SQL Server
The directory synchronization engine, the web service, and the management interface will all access the same SQL database. In most scenarios, these components will be installed on the same system. In larger or more complex network environments, the components can be distributed across multiple systems. If the directory synchronization engine, the web service or the management interface is installed on a separate system, it is important to ensure that all three components retain access to the same SQL database.
The directory synchronization engine is provided by Binary Tree’s SMART Directory Sync. SMART Directory Sync is included as part of SMART AD Migrator. SMART Directory Sync is responsible for synchronizing users and groups between source and target Active Directory domains. SMART Directory Sync also handles migrating key user properties such as SID History and user passwords.
User workstations and member servers are called devices in SMART AD Migrator. Devices communicate with the
SMART Active Directory Migrator web service using the SMART AD Migrator Agent. The SMART AD Migrator Agent is a lightweight application that installs as a service on Windows devices. Upon installation, the agent has the ability to autodiscover the location of the SMART Active Directory Migrator web service.
To ensure that no firewall exceptions are required, the web service does not “call” the workstations or servers to be migrated. Instead, the SMART AD Migrator Agents contact the web service at defined polling intervals, using standard
HTTPS or HTTP requests to recovers jobs. Jobs include key tasks such as system discovery, updating the operating system, file system and user profile permissions, and migrating the device to the new domain.
2.2 Planning the Migration Project
A typical migration project using SMART AD Migrator can be broken up into phases. o Phase 1: Installing and Creating the Synchronization Profile within SMART Directory Sync o Phase 2: Register Devices (Concurrent with Phase 3) o Phase 3: Identify Users, Rooms, Contacts, and Groups to Migrate (Concurrent with Phase 2) o Phase 4: ReACL Devices and NAS o Phase 5: Cutover Devices o Phase 6: Cleanup
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 6
The Cleanup process typically occurs several months after the completion of the project.
2.3 Best Practices
Best practices for each phase of the migration project are presented below:
Phase 1: Installing and Creating the Synchronization Profile within SMART Directory Sync
o SMART Directory Sync is used to synchronize objects and must be installed before installing the SMART Active
Directory Migrator Console and Web Service. o The Active Directory Migrator synchronization profile should be set up to include every device. However, not every device needs to be migrated immediately. This process ensures they are in the database, ready to install the SMART AD Migrator agent and register themselves. Devices can be blacklisted if you do not want to immediately migrate them. o Carefully consider the Group Collision option (Merge, Skip, Rename). It is recommended that this option is not changed once migrations have been started. Additionally, it is strongly recommended to not select the Skip option. The Merge and Rename options are better in most cases. o Synchronizing SID History is recommended.
Phase 2: Register Devices (Concurrent with Phase 3)
o The Device Agent should be pushed out to devices via Group Policy (GPO) or third party tool and sufficient time should be allowed to address any issues with device registration with the server. Correcting registration issues can take more time than expected. A typical large company with a large number of devices may need a couple of weeks of off and on work to resolve registration issues with all devices.
Phase 3: Identify Users, Rooms, Contacts, and Groups to Migrate (Concurrent with Phase 2)
o Before migrating users and groups, do some planning and analysis to see what users, rooms, contacts, and groups should be migrated, what groups need to be consolidated, how duplicates will be handled, etc. o More than one synchronization profile can be used to control the target destinations of users, rooms, contacts, and groups. o User Accounts should be disabled in the target. o Identifying users, rooms, contacts, and groups to Migrate can be accomplished concurrently with resolving device registration issues in Phase 2.
Phase 4: ReACL Devices and NAS
o Run a ReACL on as many devices as possible early in the process. o Troubleshoot any devices that did not ReACL. o ReACL again close to the actual cutover date. This will allow you to complete most of the ReACL process early and provide time to resolve any issues with things such as Anti-Virus software and Group Policies. ReACL is a non-destructive process that can be repeated as often as necessary.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 7
Phase 5: Cutover Devices
o Create some test users, groups, and devices to verify a successful user and group migration and device cutover. o Typically, a final ReACL would occur the weekend before the cutover to ensure any new users and other changes are processed. o A workstation reboot is required after the target account is enabled, source account is disabled, and the workstation cutover is complete. This is usually completed in the evening when fewer users are affected. The affected users should be alerted that this reboot is necessary.
Phase 6: Cleanup
o The cleanup phase typically takes place about two months after all device cutover is complete. Cleanup includes removing all permissions from the source domain and removing the SMART AD Migrator Agent from the devices. o Before executing the cleanup job, it is recommended to disable SID filtering/quarantine to verify there are no issues with application access before completing the cleanup process.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 8
Section 3. Configuring the Active Directory
Migrator Profile
3.1 Launching SMART Directory Sync
To launch the SMART Directory Sync:
1. Double-click the SMART Directory Sync Console desktop shortcut.
OR
Select SMART Directory Sync Console in the Start menu.
2. The SMART Directory Sync Console screen appears briefly and the application opens.
3.2 Adding an AD Migration/Synchronization Profile
To add an AD Migration/Synchronization profile:
1. On the Profiles tab, click Add Profile.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 9
2. In the Profile Type Selection window, select AD Migration/Synchronization and then click OK.
The following Profile Types are also available:
Exchange Migration – used in support of an Exchange migration utilizing Binary Tree’s E2E Complete product.
Active Directory to Domino Directory – used to synchronize objects from an Active Directory source to a Domino directory target.
Domino Directory to Active Directory – used to synchronize objects from a Domino directory source to an Active Directory target.
Window Server Migration – used in support of a Windows Server migration utilizing Binary Tree’s
Windows Server Migration product.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 10
3. A new pane appears at the bottom of the console which provides the ability to configure options for synchronization.
4. On the General tab, enter a name to identify the profile in the Name field.
5. Select the scope of the profile from the Scope drop-down list: o Inter-Forest– (default) will synchronize domains in different forests. o Intra-Forest – will synchronize domains within a forest. If selected, the Add x500 Proxy to Source and
Resource Forest options must be set to No and msExch mappings are invalid. Before the profile can be saved with Intra-Forest chosen as the scope, the mappings for all of the msExch attributes will need to be removed.
6. Select the status of the profile from the Status drop-down list: o Active– will synchronize manually or as scheduled as soon as the profile is saved o Suspended – Not active, will not synchronize
7. Select the logging level of the profile from the Logging drop-down list: o Low – only errors are logged o Medium – errors and warnings are logged o High – all messages (errors, warnings, information, etc.) are logged (should be used for troubleshooting purposes only)
8. Select an Audit Logging option from the drop-down list: o Enabled – Records object and attribute changes in the Audit Log o Disabled – Object and attribute changes will not be recorded in the Audit Log
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 11
9. For Schedule, select the schedule: o By frequency – enter the appropriate frequency or the specific time for the synchronization process to run for your environment. Zero (0) is not a valid value for frequency. The minimum interval is 15 minutes. o At specific times(s) – enter one or more specific times or select times from the drop-down list of times.
A selected time can be deleted by selecting the time and clicking the Delete key. o Manual only – the synchronization process will not run until it is manually started.
If you choose the By frequency option, SMART Directory Sync will initiate a synchronization when an active profile is saved. Select the At specific time(s) option and select a time in the future or select the Manual only option if you want to save an active profile without it syncing right away. This would be helpful if you wanted to run a Sync Report or inspect items in SQL before pulling them into the target Active Directory.
10. Click the AD Source tab enter credentials that have read/write access to the source Active Directory. The required read access must extend to the Deleted Accounts container, which can require a privileged account.
11. In the User Name field, enter the Active Directory User Name.
The credential should be entered as a user principal name (for example, [email protected])
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 12
12. In the Password field, enter the password assigned to the Active Directory user.
13. In the Global Catalog Server field, enter the IP Address or fully qualified domain name of the server (FQDN) for the Global Catalog Server or a Domain Controller that will be used for all read/write operations.
The entered credentials and Global Catalog Server/Domain Controller must have access to all Domains and subdomains that are required to synchronize.
If SID History will be synchronized, SMART Directory Sync will require access to the domain controller holding the PDC Emulator Active Directory FSMO role in all source and target domains.
14. Select an Attribute Change Detection option from the drop-down list: o Enabled– Only attributes changed on the source object will be synchronized o Disabled– All attributes on the source object will be synchronized
15. Select an Automatically Mark Objects as Ready to Sync option from the drop-down list:
No – (default) Objects are not marked as Ready to Sync. No should be selected if you are using
SMART AD Migrator to perform an AD migration. Objects can be marked as ready to sync in the
SMART AD Migrator Console.
Yes – Objects are marked as Ready to Sync. Objects will be synced during the synchronization. Yes should be selected if you are performing an AD to AD directory synchronization and not a full
AD migration.
16. Click Add OU(s) to display a list of OU(s) (organizational units) available to synchronize.
Note that a synchronization profile that includes the OU where the computer objects reside should be created.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 13
17. Select the appropriate source OU’s and click OK. The selected source OUs are displayed in the Source OUs table.
To deselect an OU from the source, select it and then click the Remove OU button and confirm or click the
Delete key.
18. The following Source OU fields display at the bottom of the screen used in the above example.
Source OU – Reflects the OU selected from the tree view.
Sub OUs – Select this option to synchronize Sub-OUs. The checkbox is selected by default. Clear this option if you do not want to synchronize sub-OUs.
Groups – The checkbox is selected by default. Clear this option to skip groups from being synchronized.
Disabled Users– Select this option to synchronize Disabled Users. The checkbox is selected by default.
Clear this option to prevent Disabled Users from being synchronized.
Non-Mail Enabled – Select this option to synchronize Non-mail enabled objects. The checkbox is not selected by default. Clear this option to skip Non-mail enabled objects from being synchronized.
User Filter– This is an LDAP filter and can be used to filter synchronization to specific object types or those objects exhibiting specific attribute properties. See the Using the User, Group, and Device LDAP
Filters topic in the SMART Directory Sync documentation for more information.
Group Filter – This is a LDAP filter and can be used to filter groups based on the entered criteria. See the
Using the User, Group, and Device LDAP Filters topic in the SMART Directory Sync documentation for more information.
Device Filter – This is a LDAP filter and can be used to filter devices based on the entered criteria. See the Using the User, Group, and Device LDAP Filters topic in the SMART Directory Sync documentation for more information.
It is recommended that you test the LDAP filter syntax prior to saving your changes and running a synchronization.
19. Click the Source DCs tab to define the list of Source Domain Controllers (DCs) used for synchronization.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 14
20. Click Add DC(s) to open the Active Directory DC Selection window. Click Refresh DCs to find all available
Domain Controllers. Available options include Ping Servers to test the availability of the selected Domain
Controllers and Test Connections to test the connection to the LDAP server. Select one or more Domain
Controller and click OK to add the Domain Controllers to the list of Source DCs.
If your Active Directory forest contains more than one domain it may be necessary to add at least one domain controller from each domain. When SMART Directory Sync attempts to resolve objects, such as group members or a user's manager, that are in another Domain (than the one specified on the Source tab), it will reference the domain controllers list to find a valid DC to use.
To ensure that group membership and manager/subordinate relationships are properly recreated, it is recommended to add the appropriate DC’s for alternate domains to the Source DC’s tab.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 15
21. The Active Directory DC Selection window closes and the selected Domain Controllers appear in the Source
DC’s list. The order the domain controllers are used for each Domain can be selected by entering a number value in the Priority column (lowest number = first). If the highest priority DC is unavailable, Directory Sync will use the next DC.
Domain Controllers with no priority set will be used after those with a priority.
If no priority is set for the servers in a Domain, they will be used in the order listed in the table.
A Domain Controller that is the Global Catalog Server selected on the AD Source tab is given top priority regardless of the value in the Priority field.
No two DC’s in a Domain can have the same priority.
22. Click the AD Target tab.
23. In the User Name field, enter the name of the Active Directory user that has the required rights to the Target directory.
The credential should be entered as a user principal name (for example, [email protected])
24. In the Password field, enter the password of the Active Directory user. These credentials should have write access to target OU, as well as any Domains or subdomains that may contain matched users.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 16
25. In the Global Catalog Server field, enter the IP Address or fully qualified domain name of the server (FQDN) of the Global Catalog Server or Domain Controller that will be used for all write operations.
26. In the Target OU, Click Browse to select a target OU. Any newly created objects will be written to this OU.
27. Check the Do not create source OUs in target option if you do not want the source OU structure to be created as objects are synchronized to the target. All objects will be created directly in the Target OU specified for that profile.
28. Select an option from the Synchronize Passwords drop-down list: o No – (default) Passwords will not be copied to the target o Yes – Passwords will be copied to the target.
The password policy on the source must meet or exceed the password policy strength on the target.
An error will occur if the Administrator password contains double quotes (") when performing password synchronization. To work around this, ensure the administrator password does not contain double quotes.
29. Enter a default password for new users in the Default Password field.
The default password cannot exceed 128 characters in length.
Even if Passwords are being copied, and default password value is still required as the initial account is created with the default password, and then the source password is copied over.
30. Select an option from the Preserve Objects in Target drop-down list to control what happens to target objects when the corresponding source objects are deleted:
No – (default) When objects are deleted in the source, the corresponding objects will be deleted from the target. This only applies to objects created in the target by SMART Directory Sync.
Yes – Objects that are deleted in the source will not be deleted in the target.
31. Select an option from the Preserve Deleted Objects in Target As Is drop-down list to control what happens to target objects if they are deleted:
No – (default) If an object previously synchronized is deleted on the target, it will be recreated.
Yes – If an object previously synchronized is deleted on the target, it will not be recreated.
32. Click the AD Target Options tab.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 17
33. Click the Users sub-tab.
34. Select an option from the Create Mail Enabled Users as drop-down list:
For Inter-Forest:
As Is – (default)
Mail-Enabled Users in the source will be Mail-Enabled Users in the target
Mailbox-Enabled Users in the source will become Mail-Enabled Users in the target
The Active Directory User Account Control property for enabled or disabled will be copied as is. In other words, user accounts that are enabled in the source, will be enabled in the target.
Mail-Enabled Contacts in the source will be Mail-Enabled Contacts in the target
Mail-Enabled, AD Enabled –
The Active Directory User Account Control property for enabled or disabled will always be set to Enabled. In other words, user accounts that are disabled in the source, will be enabled in the target
Mail-Enabled Users in the source will be Mail-Enabled Users in the target
Mailbox-Enabled Users in the source will become Mail-Enabled Users in the target
Mail-Enabled Contacts in the source will be Mail-Enabled Contacts in the target
Mail-Enabled, AD Disabled –
The Active Directory User Account Control property for enabled or disabled will always be set to Disabled. In other words, user accounts that are enabled in the source, will be disabled in the target.
Mail-Enabled Users in the source will be Mail-Enabled Users in the target
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 18
Mailbox-Enabled Users in the source will become Mail-Enabled Users in the target
Mail-Enabled Contacts in the source will be Mail-Enabled Contacts in the target
Contact –
This option IS NOT RECOMMENDED for Active Directory Migrator projects as user accounts will NOT be created in the target
Contacts, Mailbox-Enabled Users, Mail-Enabled Users will be created as Mail Enabled
Contacts in the target
This option does not have logon capabilities, but can be used for maintaining mail flow for existing users, contacts and distribution lists
For Intra-Forest:
Microsoft Exchange cannot have duplicate objects in the same organization. As a result, all mail-enabled objects will have Microsoft Exchange properties removed, effectively creating non-mail enabled objects regardless of the source object type.
As Is – (default)
Mail-Enabled Users in the source will be non-mail enabled users in the target
Mailbox-Enabled Users in the source will become non-mail enabled users in the target
The Active Directory User Account Control property for enabled or disabled will be copied as is. In other words, user accounts that are enabled in the source, will be enabled in the target
Mail-Enabled Contacts in the source will be Non-Mail Enabled Contacts in the target
Mail-Disabled, AD Enabled –
The Active Directory User Account Control property for enabled or disabled will always be set to Enabled. In other words, user accounts that are disabled in the source, will be enabled in the target
Mail-Enabled Users in the source will be Non-Mail Enabled Users in the target
Mailbox-Enabled Users in the source will become Non-Mail Enabled Users in the target
Mail-Enabled Contacts in the source will be Non-Mail Enabled Contacts in the target
Mail-Disabled, AD Disabled –
The Active Directory User Account Control property for enabled or disabled will always be set to Disabled. In other words, user accounts that are enabled in the source, will be disabled in the target.
Mail-Enabled Users in the source will be Non-Mail Enabled User in the target
Mailbox-Enabled Users in the source will become Non-Mail Enabled Users in the target
Mail Enabled Contacts in the source will be Non-Mail Enabled Contacts in the target
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 19
Contact –
This option IS NOT RECOMMENDED for Active Directory Migrator projects as user accounts will NOT be created in the target.
Contacts, Mailbox-Enabled Users, Mail-Enabled Users will be created as Non-Mail Enabled
Contacts in the target.
This option does not have logon capabilities, but can be used for maintaining mail flow for existing users, contacts and distribution lists.
The Mail-Enabled, AD Enabled option creates Active Directory users with logon capabilities in the target domain and all properties from the source’s object, including mail addresses.
The Mail-Enabled, AD Enabled option can override the properties found in the Source AD environment.
For example, a Disabled Mail-Enabled User found in the source will be enabled in the target if the Mail-
Enabled, AD Enabled option is selected. Conversely, an enabled user found in the source will be disabled in the target if the Mail-Enabled, AD Disabled option is selected.
Directory Sync will not create Mailbox-Enabled Users in the target directory.
Due to a sAMAccountName size limit of 20 characters in Active Directory, user objects with calculated sAMAccountName names greater than 20 characters in length are truncated to 20 characters. Truncated sAMAccountNames will be appended with a random number from 1 to 9999 to ensure uniqueness. This does not apply to group objects.
36. Select an option from the Create Non-Mail Enabled Users as drop-down list: o As Is – (default) The Active Directory User Account Control property for enabled or disabled will be copied as is. o Enabled – The Active Directory User Account Control property for enabled or disabled will always be set to Enabled for Non-Mailed Enabled Contacts and Users. Non-Mailed Enabled contacts are always copied as is. o Disabled – The Active Directory User Account Control property for enabled or disabled will always be set to Disabled for Non-Mailed Enabled Users. Non-Mailed Enabled contacts are always copied as is.
37. Select an option for handling user account collisions when two users of the same name are found from the Users
Collisions drop-down list:
Update – (default) If a user with the same name is found in the target domain, the users will be updated in the target AD. User collisions are determined based on the options selected on the Matching tab of the profile.
Skip – The user will not be synchronized into the target AD and a warning entry will be entered into the log entry stating that the source user will not be synchronized to the target directory.
A user that was previously synchronized to the target will fail to sync if a manual /repushpull /resync is run. This occurs because a target object with a matching sAMAccountName will already exist. If this is not the desired behavior, before running the /repushpull and /resync commands, administrators should clear the target directory of any previously created objects.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 20
Rename - This allows you to define a prefix or suffix to be added to the sAMAccountName of the user when it is written in the target directory. This option creates a new user using the existing name and the prefix or suffix to bypass the user collision when selected. Prefix is selected by default. To define a specific value for the prefix or suffix, select the Specific Value option and enter the value. To use a value from an internal field, select the Internal Field option and select a field from the drop-down list.
If selecting an internal field, a Boolean (True/False) field or an empty field should not be selected.
User accounts where the sAMAccountName exceeds 20 characters will not be created in the Target and an error will be logged.
37. Select an option from the Do not overwrite target Proxy Addresses drop-down list: o Yes – Proxy Addresses will only be updated during initial sync if the target object has no proxy addresses.
Proxy addresses will not be updated on subsequent syncs. o No – (default) Proxy Addresses on the target are overwritten.
38. Select an option from the Sync Objects drop-down list: o One-Time – objects are synced once after being marked as "Ready to Sync" in the SMART AD Migrator console. Additional syncs are not performed if there are changes in the source.
Groups are not continuously synced. However, group membership is continuously updated. o Continuous – (default) objects are continually synced between the source and target after being marked as "Ready to Sync" in the SMART AD Migrator console.
39. Select an option from the Synchronize SID History drop-down list: o Yes – SID history is synchronized. This option is not available for Intra-Forest profiles.
Review the Requirements for more information on Synchronizing SID History Prerequisites. o No – (default) SID history is not migrated.
Synchronizing SID History is recommended.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 21
40. Click the Groups sub-tab.
41. Select an option from the Create Domain Local Groups as drop-down list:
Domain Local – (default) Domain Local Groups in the source will be Domain Local Groups in the target.
Universal – Domain Local Groups in the source will be Universal Groups in the target.
Do Not Create – Domain Local Groups in the source will not be created in the target.
42. Select an option from the Create Global Groups as drop-down list:
Global – (default) Global Groups in the source will be Global Groups in the target.
Universal – Global Groups in the source will be Universal Groups in the target.
Do Not Create – Global Groups in the source will not be created in the target.
43. Select an option from the Create Universal Groups as drop-down list:
Universal – (default) Universal Groups in the source will be Universal Groups in the target.
Domain Local – Universal Groups in the source will be Domain Local Groups in the target.
Do Not Create – Universal Groups in the source will not be created in the target.
44. Select an option for handling group collisions when two groups of the same name are found from the Group
Collisions drop-down list:
Merge – If a group with the same name is found in the target domain, the members of the source group will be added to the target group. Group collisions are determined based on Name first, then based on the options selected on the Matching tab of the profile.
Skip – The group will not be synchronized into the target AD and a warning entry will be entered into the log entry stating that the source group will not be synchronized to the target group.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 22
A group that was previously synchronized to the target will fail to sync if a manual /repushpull /resync is run. This occurs because a target object with a matching sAMAccountName will already exist. If this is not the desired behavior, before running the /repushpull and /resync commands, administrators should clear the target directory of any previously created objects.
Rename - This allows you to define a prefix or suffix to be added to the name of the group when it is written in the target directory. This option creates a new group using the existing name and the prefix or suffix to bypass the group collision when selected. Prefix is selected by default. To define a specific value for the prefix or suffix, select the Specific Value option and enter the value. To use a value from an internal field, select the Internal Field option and select a field from the drop-down list.
If selecting an internal field, a Boolean (True/False) field or an empty field should not be selected.
No option is selected by default for the Group Collisions field and an error message will appear if attempting to save the profile without selecting an option.
Directory Sync will attempt to add a group member to the target if it can find the member in the source. If the member in the source is in a different Domain than the group, the member will only be added to the group in the target if it already exists in the target. If Directory Sync cannot find the member in the source, the member will not be added to the group in the target. The Sync Report will explain why a member could or could not be synchronized.
45. Click the Devices sub-tab.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 23
A separate Synchronization Profile must be used when synchronizing device objects, and the Automatically
Mark Objects as Ready to Sync option on the AD Source tab should be left as the default No, so the device objects are not inadvertently created in the target.
46. Select an option from the Create Devices as drop-down list:
As Is - (default)
Enabled devices in the source will be enabled devices in the target.
Disabled devices in the source will be disabled devices in the target.
Enabled - Enabled and disabled devices in the source will be enabled devices in the target.
Disabled - Enabled and disabled devices in the source will be disabled devices in the target.
47. Select an option for handling user account collisions when two devices of the same name are found from the
Device Collisions drop-down list:
Update – (default) If a device with the same name is found in the target AD, the device will be updated in the target AD.
Skip – If a device with the same name is found in the target AD, the device will not be added to the target
AD.
Rename – This allows you to define a prefix or suffix to be added to the name of the device when it is written in the target directory. This option creates a new device using the existing name and the prefix or suffix to bypass the device collision when selected. Prefix is selected by default. To define a specific value for the prefix or suffix, select the Specific Value option and enter the value. To use a value from an internal field, select the Internal Field option and select a field from the drop-down list.
If selecting an internal field, a Boolean (True/False) field or an empty field should not be selected.
Devices where the sAMAccountName exceeds 20 characters will not be created in the Target and an error will be logged.
Child objects of an AD computer object will be migrated, specifically connectionPoint Object class items, during synchronization with the target. This is a one-time migration of these item objects.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 24
48. Click the Exchange Target Options tab.
49. Select an option from the GAL Visibility drop-down list:
Visible – (default) Users and groups are visible in the GAL.
Hidden – Users and groups are hidden in the GAL.
As Is – Users and groups that are hidden in the GAL in the source are hidden in the GAL in the target.
Users and groups that are visible in the GAL in the source are visible in the GAL in the target.
When synchronizing objects into Exchange 2003 (only), the option to hide from the GAL will not function if the
Recipient Update Service (RUS) is enabled.
If synchronizing to an Active Directory that does not have Exchange in the environment, select the Hidden option to avoid Active Directory constraint errors.
This option does not apply to Intra-Forest profiles.
If you select Yes for the Only Update Mailbox Enabled Objects option, only mailbox-enabled objects in the target directory will be updated with values from the source object based on the mapping table settings. If this is set to No (default), mailbox-enabled objects in the target directory will be skipped and noted in the sync report. If you intend to update both, you must use two separate profiles.
CAUTION: This is not a commonly occurring preference as the authoritative object is most often where the mailbox is located.
50. The Add x500 Proxy to Source option allows you to add the LegacyExchangeDN of any mail enabled object in the target as an additional X500 proxy address to the source mailboxes. If Yes is selected, an x500 proxy address is added to all corresponding objects in the AD Source forest. If selecting Yes, you must check the statement of understanding that appears below the option. No is selected by default.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 25
This option must be set to No for Intra-Forest profiles.
51. The Resource Forest option allows you to define the AD Target as a Resource Forest. This is required if you plan to later migrate mailboxes to your Target forest. If Yes is selected, the Master Account SID will be set on the AD
Target objects. No is selected by default.
This option must be set to No for Intra-Forest profiles.
52. The Allow Enable/Disable of Mailbox Enabled Source Objects option allows you to define if enabling or disabling Mailbox Enabled Source objects is allowed. If Yes is selected, the enabling or disabling of Mailbox
Enabled Source objects is allowed. No is selected by default.
This option should be set to Yes if the ability to change the User Account Control (UAC) on the Source account is desired. If this is not changed, the Disable/Enable Source Actions in SMART AD Migrator will not work (for the
Source account).
53. Select Email Address Policy options for Users, Contacts, and Groups:
Unselected – (default) Directory Sync will not enable the target object attribute to ‘Automatically update email addresses based on email address policy’ in Exchange.
Selected – Directory Sync will enable the target object attribute to ‘Automatically update email addresses based on email address policy’ in Exchange.
Directory Sync will only apply the attribute to ‘Automatically update email addresses based on email address policy’ to the target object. It cannot apply the email address policy.
This option does not apply to Intra-Forest profiles.
55. If selected the Email Address Policy option for User, Contacts, or Groups, a drop-down list appears with the following options:
Enable email policy for objects created by DirSync
Enable email policy for objects updated by DirSync
Enable email policy for objects created or updated by DirSync
Disable email policy for objects created by DirSync
Disable email policy for objects updated by DirSync
Disable email policy for objects created or updated by DirSync
56. Click the Target DCs tab to define the list of target Domain Controllers (DC’s) to use when Directory Sync is searching for matched objects.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 26
57. Click Add DC(s) to open the Active Directory DC Selection window. Click Refresh DCs to find all available
Domain Controllers. Available options include Ping Servers to test the availability of the selected Domain
Controllers and Test Connections to test the connection to the LDAP server. Select one or more Domain
Controller (use Ctrl+Click to select more than one) and click OK to add the Domain Controllers to the list of
Target DCs.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 27
If you selected Domain level matching in the Target tab, only select Domain Controllers for the target Domain.
No other Domains will be searched.
If you have selected Forest level matching in the Target tab, you must add at least one Domain Controller for each Domain that should be searched for matched objects. If you do not select at least one Domain Controller for a Domain, that Domain will not be searched during synchronization.
Select more than one Domain Controller in a Domain for failover purposes.
Additionally, defined Domain Controllers are only searched for matches if the previous Domain Controller is unavailable.
58. The Active Directory DC Selection window closes and the selected Domain Controllers appear in the Target DC’s list. The order the domain controllers are used can be selected by entering a number value in the Priority column
(lowest number = first). Available options include Ping Servers to test the availability of the selected Domain
Controllers and Test Connections to test the connection to the LDAP server.
Domain Controllers with no priority set will be used after those with a priority.
If no priority is set for the servers in a Domain, they will be used in the order listed in the table.
A Domain Controller that is the Global Catalog Server selected on the AD Target tab is given top priority regardless of the value in the Priority field.
No two DC’s in a Domain can have the same priority.
59. Click the Matching tab.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 28
AD attributes used for matching should be indexed. Follow the procedure at https://technet.microsoft.com/enus/library/aa995762(v=exchg.65).aspx
to index AD attributes.
60. Select an option from the Matching Level drop-down list:
Forest – (default) Matching is done against the target Forest
Domain – Matching is done against the target Domain
This option is set to Domain for Intra-Forest profiles.
61. Select an option from the Matching Action drop-down list: o Create or Update – (default) Creates objects that do not have matching objects in the Target and updates objects that have matching objects in the Target. o Create only – Creates objects that do not have matching objects in the Target. Objects that have matching objects in the Target are NOT updated, unless the object was created by Directory Sync. This means that even during an initial sync or a sync after a reset, objects previously created by Directory
Sync will be updated. o Update only – Updates objects that have matching objects in the Target. Objects that do not have matching objects in the Target are NOT created. o Match only, No Update – Matching objects are updated in SQL, but no updates are done in the Target and no new objects are created in the Target.
62. Select the Match object types option to enable object type matching. Object types are Users, Contacts,
Groups, and Devices. This option is enabled (checked) by default.
63. The default source to target attribute matching pairs are displayed. This defines what attributes Directory Sync will use to match objects in the Source to objects in the Target, as well as the order in which they will be used.
The below table displays the default matching attribute pairs:
Source Target
sAMAccountName sAMAccountName mail cn mail cn
To customize the matching, select attributes from the drop-down lists under Source and/or Target or type in the names of attributes in the fields. The matching pairs are “either/or” statements (not “and” statements) with the first match attempted on the top row pair (Default: sAMAccountName -> sAMAccountName) and then proceeding in descending order to the next row pair and so on. At least one matching pair is required for the profile to be saved.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 29
64. Select an option from the Re-Link drop-down list:
Enabled – (default) SMART Directory Sync will attempt to re-link objects in the target by first looking for an object that has the adminDisplayName stamped with the source object's unique identifier. If an object is found, then those two objects are linked and no other attempts at matching are performed. If an object is not found, then the process attempts to match to an object by searching based on the matching criteria. If a matching object is not found, then a new object is created.
Disabled – SMART Directory Sync will not attempt to re-link objects in the target and will always match based on the matching criteria.
Whenever SMART Directory Sync creates a new object in the target or matches to an existing object in the target, it stamps the adminDisplayName attribute (for Active Directory) or the $BTSourceDirectoryID property
(for Domino) of the target object with the source object's unique identifier (objectGUID for AD objects and UNID for Domino objects). This effectively links these two objects together. This link is also maintained between the two objects in the SQL database and future updates are based on this SQL link. However, when a profile is reset, these SQL records are deleted.
When Re-Link is enabled, performance can be improved by indexing the adminDisplayName attribute. Follow the procedure at https://technet.microsoft.com/en-us/library/aa995762(v=exchg.65).aspx
to index
AD attributes.
65. If the Re-Link option is enabled, select an option from the Restore Ready to Sync drop-down list:
Yes – (default) The re-link process will set all re-linked objects to Ready To Sync.
No – The re-link process will not reset the Ready To Sync setting on re-linked objects. This would allow you to prevent changes to objects until they are prepared.
66. Click the Mapping tab to view the default mapping or to edit how attributes should be translated from the source to the target Active Directory. Review the table and make the appropriate changes for your environment.
Double-click a cell in the mapping table select a different field or type from a drop-down list. Click above the first row to create a new entry. Double-click on a cell in the Comments column to enter a comment. Appendix A contains the default mapping.
To revert to the default mappings, use CTRL+A to select all mappings, delete the mappings (Delete key), and click Yes when prompted to remove all entries.
The default mapping for attributes will be applied unless deleted. When creating custom mapping for an attribute, the default mapping for the attribute should be deleted.
There are two Target Type columns in the table. This allows you to restrict the type of object in the target directory that can be updated. If you set both types to the same value, then this mapping will only apply to that object type. If you set one to person and the other to group, the mapping will apply to user and group objects only. If both are set to any, the mapping is unrestricted and will apply to all object types.
The msExch mappings are not valid for Intra-Forest profiles.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 30
Values that can be used for either mapping or matching can be entered manually or imported from a CSV file in the Mapped Values dialog box.
Mapped values for device objects is not currently supported. This feature will be supported in a future release.
1. Click the Mapped Values button. The Mapped Values window appears.
2. Values can be entered manually by clicking on the first row.
3. Values can also be imported from a CSV file by clicking the Import button.
4. Select a CSV file that has Source fields and values, Target fields and values, and the application of the mapping or matching. The final value of each row can be “Match”, “Map”, or “MatchMap”. “MatchMap” applies both matching and mapping.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 31
67. Click Save to verify all required fields are populated and save the profile. You can save an incomplete profile as long as it is suspended.
68. Click Overrides to open the table of mapping overrides. These represent default system mappings specifically for the internal SQL fields, and are used to transpose values during creation and synchronization. Overrides are customizable and apply to all profiles. See Appendix B for more information on editing Overrides.
Overrides for device objects is not currently supported. This feature will be supported in a future release.
69. Create additional synchronization profiles as needed. To copy an existing profile, right-click on a profile in the table and select Copy. All profile settings will be copied into a new profile that can then be edited as necessary.
New profiles created by copy are suspended by default. Select the profile in the table and click Activate Profile.
3.3 Active Directory Migrator Sync Report
Overview
The Sync Report has two primary functions. The first is as an analytical tool used prior to synchronizing any objects into a target directory, and the second is as a logging feature to view the details of each synchronization.
Prior to synchronizing any object into the target, the source directory(ies) must be analyzed to identify any objects that could be problematic. This is a critical step to a successful sync and should not be overlooked.
The Sync Report reads the source directory(ies) and writes the data into SQL. This is the same action taken if you were to initiate a Push command. The source data is analyzed to determine the result if you were to Pull the data into the target directory. The Sync report should be run prior to the first sync, as well as prior to running a sync after you have made a change to the profile, to confirm the intended results.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 32
Common issues that must be corrected prior to synchronizing Active Directories.
SMTP
Addresses
Duplicate SMTP Addresses - These objects will be skipped with a warning that the SMTP address is already in SQL. Any object you wish to sync must have a valid and unique SMTP
Address.
Unique
Match
Values
SMART Directory Sync allows you to define up to 4 field/attribute pairs to match objects in the source to objects in the target. If the source value matches to more the one target object value, SMART Directory Sync will skip the object. This must be corrected if you intend for this object to synchronize to the target directory. The Sync Report allows you to see the matched objects between the source and target. These should be reviewed to ensure that your match criteria are valid for your environment.
Running a Sync Report
To run a Sync Report:
1. Once you have created a profile, Click the Sync Report button. This opens the Sync Report window. The example in this section is a Domino to Active Directory profile.
2. Click Run Report and Yes to confirm. Click the Refresh button to populate the UI with the most recent data.
A sync report performs a Push into SQL, so it is important that you reset the profile prior to running a sync if you have made any changes to the source data or the profile settings. If you do not clear the profile, the data that is in SQL from the Sync Report will be pulled to the target directory.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 33
Objects tab
This contains all of the objects in the source and the action that would have been taken had the profile been synched to the target. All of the columns can be sorted, filtered or reordered (drag and drop). Review any objects that were skipped
(in the Operations column, as well as any warnings in the Status column. You can double click on any entry to open the details for that object. The Details windows displays all of the details for the object, including the attributes and values that would be written to Active Directory. The Internal Fields tab displays the values that are written to SQL. Once corrected, you can run another sync report to validate the changes.
Members tab
The Members tab displays details for group synchronization. Here you can see each member of all of the groups that would be synched to Active Directory. You can filter the Status column for warnings to easily view any issues that should be resolved.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 34
Object Summary tab
The Object Summary tab display a summary of each object type, the operation performed, the status and the object count.
Members Summary tab
The Members Summary tab displays a summary of group membership synchronization. It displays the number of members added to groups, number of skipped members and the total number of errors or warnings.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 35
Profile tab
The Profile tab lists all of the settings for the profile for which the sync was run. This can be easily exported for troubleshooting purposes.
Source DCs tab
The Source DCs tab displays the Domain Controllers listed in the Source AD tab of the profile.
Target DCs tab
The Target DCs tab will display all of the Domain Controllers configured in the Target DC's tab. It also shows the priority in which they will be used. The default will always be used unless it is unreachable.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 36
Section 4. Using the SMART Active Directory
Migrator Console
4.1 Launching the Active Directory Migrator Console
To launch the Active Directory Migrator console:
1. Double-click the SMART AD Migrator Console desktop shortcut.
OR
Select SMART AD Migrator Console in the Start menu.
2. The SMART Active Directory Migrator screen appears briefly and the application opens.
The SMART AD Migrator Console will not launch until a license for AD Migration/Synchronization is applied in the
SMART Directory Sync Console.
4.2 Refreshing Data
Use the Refresh button to refresh the data currently displayed in the table. The refreshed data will display all previous changes to the database and the currently available right click-options. All selected filter options will not be affected by refreshing.
To refresh the data displayed in the table:
1. Click the Refresh button .
4.3 Creating Mapping Files
Use the Create Mapping Files button to generate the User Mapping File (Map.usr) and Group Mapping File (Map.gg).
These files are automatically created during the ReACL process so the only time they need to be created manually is when re-permissioning SQL databases. This process is otherwise not required.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 37
To create the mapping files:
1. Click the Create Mapping Files button .
2. The Mapping Files window appears and displays the location of the created Map.usr and Map.gg files. Click OK.
Each time the Create Mapping Files process is run, the Map.usr and Map.gg files are overwritten.
If the Active Directory environment is non-English, the values in the sAMAccountName column of the
BT_SystemGroup table in the SQL database will need to be changed after SMART Directory Sync is installed to have the appropriate non-English values.
4.4 Migration Groups
Objects in the table can be grouped into Migration Groups for migration process management. Migration Groups allow you to filter and sync smaller groups of objects. An item can be part of a single Migration Group only.
To set Migration Group for objects:
1. Click on table rows to select one or more objects in the list. (Use Ctrl-Click to select more than one row.)
2. Right-Click to view the options menu and select Set Migration Group.
3. Select a migration group from the drop-down list or click New to create a new Migration Group for the selected objects. To remove a previously select migration group, select <None> from the drop-down list.
4. If creating a new Migration Group, enter a Migration Group Name.
5. Click Save. The Migration Group column is populated for the selected objects.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 38
Import Migration Groups
The import Migration Groups feature allows you to import a CSV file with objects and their matching migration groups
Duplicate objects in the CSV will not be stamped with a migration group.
Objects names can be the sAMAccountName (for Users, Rooms, Groups, and Devices) or the Distinguished
Name (for Users, Rooms, Contacts, Groups, and Devices).
To import Migration Group values:
1. Click the Import Migration Groups button .
2. Select a CSV file containing the Migration Group names and click Open.
The CSV file should have two columns. The first column is Object Name and the second column is Migration
Group Name. An example file is below: jsmith,Windows 7 Group mjones,Windows 7 Group jtaylor,Windows 8 Group
An example file entry for Contacts is below:
CN=John Smith,DC=domain,DC=dom,Windows 7 Contacts
3. Click OK on the confirmation window. Click Export Results to export a file containing the matching results.
4.5 Using Blacklists
Objects can be added to the blacklist. Blacklisted objects will not be displayed unless the "Show Blacklisted" option is selected. Blacklisted objects cannot have actions performed on them, except Set Migration Group and Mark as
Migrated.
To add objects to the blacklist:
1. Click on table rows to select one or more objects in the list. (Use Ctrl-Click to select more than one row.)
2. Right-Click to view the options menu and select Add to Blacklist. The selected objects are removed from the displayed list.
3. Select the Show Blacklisted option to view the blacklisted objects.
To remove objects from the blacklist:
1. Select the Show Blacklisted option to view the blacklisted objects.
2. Click on table rows to select one or more objects in the list. (Use Ctrl-Click to select more than one row.)
3. Right-Click to view the options menu and select Remove from Blacklist. The selected objects are removed from the displayed list.
4. Deselect the Show Blacklisted option to view the non-blacklisted objects.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 39
4.6 Grouping, Sorting, and Filtering Tables
The data table can be grouped by column headers, sorted by column or filtered.
Grouping
To group the data table by column headers:
1. Click and drag a column header to the area above the column headers to group by that column header.
2. Click and drag additional column headers to create child groups.
3. To remove a grouping, rollover and click the "X" in the grouped by column heading.
Sorting
To sort the data table by column headers:
1. Click a column header to sort the table by the column in ascending order.
2. Click the column header again to sort the table by the column in descending order.
3. Click the column header a third time to remove the column sort and return to the default sort.
Filtering
To filter the data table with the column filters:
1. Click the filter icon in the column header. The filter options window appears.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 40
2. Select filter options and then click Filter. The table is updated as you select the options. The filter icon is darkened when applied.
3. To remove the column filter, click the filter icon and click Clear Filter.
4. To clear all column filters, click the Clear All Column Filters button select Clear All Column Filters.
To filter the data table by DirSync Profile:
or right-click on the header row and
1. Select a profile from the DirSync Profiles drop-down list. The table is updated to display only objects associated with the selected DirSync profile. By default, objects from All Profiles are displayed.
To filter the data table by Migration Group:
1. Select a migration group from the Migration Group drop-down list. The table is updated to display only objects in the selected migration group. By default, objects from All batches are displayed.
4.7 Customizing Columns
The default data tables do not display every available column. However, the displayed columns can be customized. Also the column order can also be changed.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 41
To choose displayed columns:
1. Click the Choose Columns button in the table header
Columns. The Choose Columns window appears.
or right click on the header row and select Choose
2. Select the columns to display in the table.
3. Click OK. The table is updated with the selected columns.
To change the order of columns:
1. Click and drag the column header and drop it in a new location. The table is updated.
4.8 Selecting Multiple Table Rows
There are several ways to select multiple table rows.
To select all table rows:
1. Click the Select All button in the table header or use Ctrl+A. The first 1000 rows are selected by default.
By default, the first 1000 rows are selected. This setting can be changed in SQL in the ADM_Setting table field
SelectAllLimit.
2. Perform a right-click action to the selected rows.
If attempting to select more than 1000 rows at time, perform the action on the first 1000, filter the list based on the action, and then select all again.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 42
To select more than one table row: o Use Ctrl+Click to select more than one row. o Use Shift+Up/Down Arrow to select additional rows before or after the currently selected row. o Use Shift+Pg Up/Pg Dn to select all rows before or after the currently selected row.
The following key shortcuts do not work: Shift+Ctrl+End, Shift+Ctrl+Home, Shift+Ctrl+Page Down, Shift+Ctrl+Page Up,
Shift+Left Click, Click+Shift+Left Click.
4.9 Triggering a Sync
Use the Sync button to sync the data currently displayed in the table. Select a different DirSync Profile before starting a sync to synchronize just that configured Source to Target. If All Profiles is selected, all of the DirSync AD Migrator profiles will be synchronized. If the DirSync AD Migrator profile has been set to synchronize on a schedule, manually starting a sync is not necessary.
Only objects marked as "Ready to Sync" will be synced to the target.
To sync the data displayed in the table:
1. Click the Sync button .
2. After clicking the Sync button the following confirmation for the synchronization of the selected DirSync Profile will be displayed.
3. If All Profiles are selected the prompt will appear as follows:
4. If a sync is already running the following will be displayed:
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 43
4.10 Exporting the Grid
The view as it is currently sorted and filtered can be exported to a file.
To export the grid:
1. Click the Export Grid button .
2. Click OK on the Export All? confirmation window.
Select a location, enter a file name, select a type and then click
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 44
Section 5. Migrating Users
The Users screen allows you to sync users to the target as well as enable and disable users on the source and target before cutover occurs.
Sync Users
To sync users to the target:
1. Click on table rows to select one or more users in the list (Use Ctrl-Click to select more than one row).
2. Right-Click to view the options menu and select Ready to Sync. The Ready to Sync column for the selected users becomes checked. The selected users are synced during the next sync cycle (scheduled in
SMART Directory Sync or triggered manually with the Sync button in SMART AD Migrator).
If the Ready to Sync column doesn’t display all of the check marks expected, click on the Refresh button to refresh the data in the table.
3. To prevent the users from syncing, select the users and select Not Ready to Sync from the right-click menu.
Enable and Disable Users
To enable/disable users on the source or target.
1. Click on table rows to select one or more users in the list (Use Ctrl-Click to select more than one row).
2. Right-Click to view the options menu and select one of the following options: o Enable on Target only o Enable on Target/Disable on Source o Enable on Source only o Enable on Source/Disable on Target
The Source UAC and/or Target UAC columns of the selected users is updated.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 45
A sync must be performed before the selected Enable/Disable User option takes effect.
The Allow Enable/Disable of Mailbox Enabled Source Objects option in the AD Migrator Directory Sync Profile must be set to Yes if the ability to change the User Account Control (UAC) on the Source account is desired. If this is option is set to No, the Disable/Enable Source Actions in AD Migrator will not work (for the Source account).
Set as Migrated
As a way to mark the User Accounts that are fully completed, that require no further action, they can be set as migrated:
1. Click on table rows to select one or more users in the list.
2. Right-Click to view the options menu and select Set as Migrated.
3. Click Save. The Migrated column of the selected users is checked.
User Columns
The following columns appear on the Users screen by default: o Migration Group- The Migration Group name. Use the Right-click Set Migration Group option to change. o First Name - the first name attribute of the source user account o Last Name - the last name attribute of the source user account o sAMAccountName - the sAMAccountName attribute of the source user account o Display Name - the display name attribute of the source user account o Distinguished Name - the distinguished name attribute of the source user account o Target Distinguished Name - the distinguished name attribute of the target user account. This column is populated when a user is synced. o Description - the description attribute of the source user account o Migrated – An optional tag that can be manually set to track migration progress. Use the Right-click Set as
Migrated option to change.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 46
o Ready to Sync - This is checked if the user account is currently ready to sync. Use the Right-click Ready to Sync option or Not Ready to Sync option to change. o Created - This is checked if the user account has been created in the target o Source UAC - Indicates if the user account is enabled in the source. Use the Right-click Enable/Disable User options to change. o Target UAC - Indicates if the user account is enabled in the target. Use the Right-click Enable/Disable User options to change. o Last Sync - Displays the date/time of the last sync.
The following additional fields can be displayed by customizing the columns: o ID - SQL record number o Migration Group ID o Blacklisted - This is checked if the user is currently on the blacklist. Use the Right-click Add to Blacklist option or
Remove from Blacklist option to change. o Alias o Assistant o Company o Country o Country Code o Country Name o Deleted Item Flags o Delivery Content Length o Department o Department Number o Division o Employee ID o Employee Number o Employee Type o Extension 1 - 15 o Manager o Object SID
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 47
Section 6. Migrating Rooms
The Rooms screen allows you to sync rooms to the target.
Sync Rooms
To sync rooms and resources to the target:
1. Click on table rows to select one or more rooms in the list (Use Ctrl-Click to select more than one row).
2. Right-Click to view the options menu and select Ready to Sync. The Ready to Sync column for the selected rooms becomes checked. The selected rooms are synced during the next sync (scheduled in SMART Directory
Sync or triggered manually with the Sync button).
3. To prevent the rooms from syncing, select the rooms and select Not Ready to Sync from the right-click menu.
Room Columns
The following columns appear on the Rooms screen by default: o Migration Group - The Migration Group name. Use the Right-click Set Migration Group option to change. o Room Number - the room number attribute of the source room o Display Name - the display name attribute of the source room o Distinguished Name - the distinguished name attribute of the source room o Target Distinguished Name - the distinguished name attribute of the target room. This column is populated when a room is synced. o Description - the description attribute of the source room o Ready to Sync - This is checked if the room is currently ready to sync. Use the Right-click Ready to Sync option or Not Ready to Sync option to change. o Created - This is checked if the room has been created in the target. o Last Sync - Displays the date/time of the last sync.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 48
The following additional fields can be displayed by customizing the columns: o ID - SQL record number o Migration Group ID o Blacklisted - This is checked if the room is currently on the blacklist. Use the Right-click Add to Blacklist option or Remove from Blacklist option to change. o Alias o Assistant o Company o Country o Country Code o Country Name o Deleted Item Flags o Delivery Content Length o Department o Department Number o Division o Extension 1 - 15 o Manager o Object SID
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 49
Section 7. Migrating Contacts
The Contacts screen allows you to sync contacts to the target.
Sync Contacts
To sync contacts to the target:
1. Click on table rows to select one or more contacts in the list (Use Ctrl-Click to select more than one row).
2. Right-Click to view the options menu and select Ready to Sync. The Ready to Sync column for the selected contacts becomes checked. The selected contacts are synced during the next sync (scheduled in
SMART Directory Sync or triggered manually with the Sync button).
3. To prevent the contacts from syncing, select the contacts and select Not Ready to Sync from the right-click menu.
Contact Columns
The following columns appear on the Contacts screen by default: o Migration Group - The Migration Group name. Use the Right-click Set Migration Group option to change. o First Name - the first name attribute of the source contact o Last Name - the last name attribute of the source contact o Display Name - the display name attribute of the source contact o Distinguished Name - the distinguished name attribute of the source contact o Target Distinguished Name - the distinguished name attribute of the target contact. This column is populated when a contact is synced. o Description - the description attribute of the source contact o Ready to Sync - This is checked if the contact is currently ready to sync. Use the Right-click Ready to Sync option or Not Ready to Sync option to change. o Created - This is checked if the contact has been created in the target. o Last Sync - Displays the date/time of the last sync.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 50
The following additional fields can be displayed by customizing the columns: o ID - SQL record number o Migration Group ID o Blacklisted - This is checked if the contact is currently on the blacklist. Use the Right-click Add to Blacklist option or Remove from Blacklist option to change. o Alias o Assistant o Company o Country o Country Code o Country Name o Deleted Item Flags o Delivery Content Length o Department o Department Number o Division o Employee ID o Employee Number o Employee Type o Extension 1 - 15 o Manager o Object SID
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 51
Section 8. Migrating Groups
The Groups screen allows you to sync groups to the target.
How different types of groups (Domain Local, Global, and Universal Group) are created on the target and how group collisions are handled is defined on the AD Target Options tab of the Active Directory Migrator synchronization profile.
Sync Groups
To sync groups to the target:
1. Click on table rows to select one or more groups in the list (Use Ctrl-Click to select more than one row).
2. Right-Click to view the options menu and select Ready to Sync. The Ready to Sync column for the selected groups becomes checked. The selected groups are synced during the next sync (scheduled in SMART Directory
Sync or triggered manually with the Sync button).
3. To prevent the groups from syncing, select the groups and select Not Ready to Sync from the right-click menu.
Group Columns
The following columns appear on the Groups screen by default: o Migration Group - The Migration Group name. Use the Right-click Set Migration Group option to change. o sAMAccountName - the sAMAccountName attribute of the source group account o Display Name - the display name attribute of the source group account o Group Type - The type of group of the source group account o Distinguished Name - the distinguished name attribute of the source group account o Target Distinguished Name - the distinguished name attribute of the target group account. This column is populated when a group is synced. o Description - the description attribute of the source group account o Ready to Sync - This is checked if the group is currently ready to sync. Use the Right-click Ready to Sync option or Not Ready to Sync option to change.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 52
o Created - This is checked if the group account has been created in the target. o Last Sync - Displays the date/time of the last sync.
The following additional fields can be displayed by customizing the columns: o ID - SQL record number o Migration Group ID o Blacklisted - Checked if the group is currently on the blacklist. Use the Right-click Add to Blacklist option or
Remove from Blacklist option to change. o Alias o Assistant o Company o Country o Country Code o Country Name o Deleted Item Flags o Delivery Content Length o Department o Department Number o Division o Extension 1 - 15 o Managed By o Object SID
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 53
Section 9. Settings
The Settings screen allows you to define the settings used when the device Cutover process is started, create
ReACL Profiles, and add custom Menu Actions.
9.1 Migration Options
To add migration options:
1. Click the Migration Options tab.
2. Click the Add button. The Migration Options window appears.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 54
3. Enter values in the following fields: o Option Name - the name to identify the options (for example, "10 Second Reboot Delay") o Domain Join Delay - the delay (in seconds) before joining the domain o Reboot Delay - the delay (in seconds) before rebooting
If set to any value other than zero (0), the user will receive a pop-up notification informing them that the workstation will be rebooted when the cutover is performed. If set to zero, no notification will appear. o Recycle Bin - select how to handle the Recycle Bin during cutover, either Empty or Don't Empty
Users may get an error message that their Recycle Bin has been corrupted after migration if the Recycle
Bin is not empty. See Troubleshooting for more information about this issue. o Target OU - the target OU where the devices will be created. If you leave this field blank, the devices will default to the Computers container.
4. Check Join to Existing Device if you want the device to join to the existing target computer during cutover.
5. Click Save. The migration options are added to the list.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 55
9.2 Cutover Credentials
The specified credentials must be able to join and disjoin a computer from the specified domain and well as disable a computer in the specified domain. A trust between the source and target domain is not required.
To add cutover credentials:
1. Click Cutover Credentials tab.
2. Click the Add button. The Cutover Credentials window appears.
3. Enter values in the following fields: o Name - the name to identify the cutover credentials (for example, "DomA to DomB Admins") o Source Domain FQDN - the domain FQDN of the source in source.domain.dom format o Source Username - the username to access the source domain in domain\username or UPN
([email protected]) format o Source Password - the password to access the source domain o Target Domain FQDN - the domain FQDN of the target in target.domain.dom format o Target Username - the username to access the target domain in domain\username or
UPN ([email protected]) format o Target Password - the password to access the target domain
4. Click Save. The cutover credentials are added to the list.
9.3 Network Profiles
To add network profiles:
1. Click the Network Profiles tab.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 56
2. Click the Add button. The Network Profiles window appears.
3. Enter values in the following fields: o Profile Name - the name to identify the network profile o Obtain DNS server address automatically? - options include No Change, Manually Assign, or Use DHCP
If you manually assign DNS settings, be sure that the DNS server(s) that you include here can resolve the
ADM Agent SRV record. o Preferred DNS Server - the preferred DNS server o Alternate DNS Server - the alternate DNS server o Append primary and connection specific DNS suffixes - options include No Change, Obtain from NIC, or
Manually Assign. o DNS Suffixes - Enabled if Manually Assign is selected to the Append primary and connection specific
DNS suffixes option. The list of DNS suffixes. Enter each suffix and then press Enter. o DNS Suffix for this Connection - the DNS suffix once cutover is complete o Register the connection's addresses in DNS - options include No Change, No, or Yes o Use this connection's DNS suffix in DNS registration - Enabled if Yes is selected to the Register the connection's addresses in DNS option, select No Change, Don't register manual DNS suffix, or Register
manual DNS suffix. o Preferred WINS Server - the preferred WINS server
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 57
o Alternate Wins Server - the alternate WINS server
4. Click Save. The network profile is added to the list.
9.4 Device ReACL Profiles
The default Device ReACL profile is used if a different profile is not defined and set on the devices. The default Device
ReACL profile can be edited.
To add Device ReACL profiles:
1. Click the Device ReACL Profiles tab.
2. Click the Add button. The Device ReACL Profile window appears.
3. In the Profile Name field, enter a name to identify the Device ReACL Profile.
4. Under the Basic tab:
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 58
In the Blacklist Folders box, enter folder paths that will not be included in the ReACL process. Wild card characters (* and ?) can be used when specifying blacklist folders. Separate the paths by pressing Enter.
By default, the following folders are blacklisted:
\Windows
\WINNT
\I386
\Windows\I386
\Program Files
\PROGRAM FILES (x86)
\MSOCACHE
\System Volume Information
\Recycler
\$RECYCLE.BIN
\CONFIG.MSI
\RECOVERY
\OEM
\Quarantine
\BOOT
Select an option from the Logging Level drop-down list. Options include Info (default) and Debug.
5. Click the Advanced tab.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 59
The Advanced tab allows you a more granular selection of the components to be included or excluded from the
ReACL process. Select the components to be included by checking the desired items.
We recommend that you leave the Windows Services Accounts box UNCHECKED. A change in the ACL of the services accounts of the target may have an impact on the applications currently running. Although the ReACL process can usually be rolled back in case of issues, there could be a temporary disruption in service until resolved.
If you select Roaming Profiles, users must be logged out of their roaming profiles during the ReACL process.
6. If the Local/Files folders box is selected on the left, normally all files and folders are included in the ReACL process. If you prefer to provide a specific list, enter the list in the Only ReACL These Local Folders box.
Separate each entry by pressing Enter. You may use just a file path using backslashes, or provide an exact drive letter. If you provide a drive letter, the ReACL is limited to that exact path.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 60
Note that if you choose to list folders here, these are the ONLY folders that will be included in the ReACL process. (The exception is if you check the User Profiles box: those Profiles will always be included automatically in addition to your list.)
7. Select an option from the Elevate Failure Action drop-down list to choose the action that should be taken if any part of the ReACL process encounters errors.
In order to successfully adjust permissions, AD Migrator must create a process with a security token that has been assigned additional permissions. The token is said to have elevated rights/permissions. If this process fails, it is likely that the ReACL will be largely unsuccessful in updating the operating system for use by target user accounts.
The default is Terminate ReACL, meaning the ReACL process for that device is stopped as soon as an error occurs. This is a time-saving option. The ReACL process is reported as Failed in the Devices View. A device cannot be Cutover if the ReACL process reports as Failed. This is the recommended setting.
If you choose Error, the entire process will attempt to complete when an Elevate Failure error is encountered, but the process will still be reported as Failed. This selection may take significantly more time than Terminate ReACL, as the entire process will attempt to finish before reporting as Failed.
If you choose Warn, a warning entry will be logged, however the process will be reported as Successful.
This choice allows experienced migration architects to analyze the logs and choose to Cutover anyway based on their analysis of the results.
If you choose Info, an info entry will be logged, however the process will be reported as Successful. This choice allows experienced migration architects to analyze the logs and choose to Cutover anyway based on their analysis of the results. We suggest choosing Warn over Info as this will make the entries easier to locate in the log.
8. Select an option from the Invalid/Duplicate Target Profile Action drop-down list to choose the action that should be taken when an invalid or duplicate profile exists in the target.
The default is Terminate ReACL, meaning the ReACL process for that device is stopped as soon as an error occurs. This is a time-saving option. The ReACL process is reported as Failed in the Devices View. A device cannot be Cutover if the ReACL process reports as Failed. This is the recommended setting.
If you choose Error, the entire process will attempt to complete when an Elevate Failure error is encountered, but the process will still be reported as Failed. This selection may take significantly more time than Terminate ReACL, as the entire process will attempt to finish before reporting as Failed.
If you choose Warn, a warning entry will be logged, however the process will be reported as Successful.
This choice allows experienced migration architects to analyze the logs and choose to Cutover anyway based on their analysis of the results.
If you choose Info, an info entry will be logged, however the process will be reported as Successful. This choice allows experienced migration architects to analyze the logs and choose to Cutover anyway based on their analysis of the results. We suggest choosing Warn over Info as this will make the entries easier to locate in the log.
9. Select an option from the Add Rollback Metadata drop-down list.
AD Migrator inserts a "breadcrumb” during the ReACL process to allow seamless rollback of the ReACL process if needed. You can control the insertion of these breadcrumbs (which are removed during the
Cleanup process) if desired, here.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 61
The default is Always and does not affect performance. We recommend this setting. This is the only setting where the changes performed by the ReACL process can be rolled back, or undone, in all scenarios.
If you choose Only If Ambiguous, metadata will only be included when the rollback settings would be ambiguous. Only If Ambiguous results in the addition of fewer breadcrumbs, preserving usage for times when it may be impossible to determine the original file or folder permissions. This would occur, for example, when users have accounts in multiple domains that will be consolidated into a single domain.
Note that Only If Ambiguous guarantees a ReACL can be rolled back to the original state only when the file system permissions remained unchanged. Modification of ACLs on the file system could create a state where a rollback cannot complete with 100% success. To ensure the ability for a ReACL Rollback in all scenarios, Always should be selected.
If you are an experienced migration architect, you may choose Never to never include metadata.
If this is selected, a complete rollback may not be possible.
10. Check the Simulation Only (No Actual Changes) box to simulate the results of the ReACL process without actually making any changes to the ACL. Visit the logs/reports to determine any potential issues and correct them before an actual ReACL process. You might use this to create a Device ReACL Profile specifically for testing purposes.
11. Click Save. The Device ReACL Profile is added to the list.
Click the Restore Defaults button to reset the profile values back to the default settings.
9.5 NAS ReACL Profiles
The default NAS ReACL profile is used if a different profile is not defined and set on the NAS devices. The default NAS
ReACL profile can be edited.
To add NAS ReACL profiles:
1. Click the NAS ReACL Profiles tab.
2. Click the Add button. The NAS ReACL Profile window appears.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 62
3. In the Profile Name field, enter a name to identify the NAS ReACL Profile.
4. Under the Basic tab:
In the Blacklist Folders box, enter folder paths that will not be included in the ReACL process. Wild card characters (* and ?) can be used when specifying blacklist folders. Separate the paths by pressing Enter.
By default, the following folders are blacklisted:
\Windows
\WINNT
\I386
\Windows\I386
\Program Files
\PROGRAM FILES (x86)
\MSOCACHE
\System Volume Information
\Recycler
\$RECYCLE.BIN
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 63
\CONFIG.MSI
\RECOVERY
\OEM
\Quarantine
\BOOT
Select an option from the Logging Level drop-down list. Options include Info (default) and Debug.
5. Click the Advanced tab.
The Advanced tab allows you a more granular selection of the components to be included or excluded from the
ReACL process. Select the components to be included by checking the desired items.
6. Enter the network errors that will trigger a retry in the Network Error Retry List field. By default errors 53 and
64 will trigger a retry.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 64
7. Enter the number of retries to attempt in the Network Error Retry Count field. The default retry count is 10 retries.
8. Enter the number of seconds between network error retries in the Network Error Retry Interval Seconds field.
The default interval is 1 second.
9. Select an option from the Elevate Failure Action drop-down list to choose the action that should be taken if any part of the ReACL process encounters errors.
In order to successfully adjust permissions, AD Migrator must create a process with a security token that has been assigned additional permissions. The token is said to have elevated rights/permissions. If this process fails, it is likely that the ReACL will be largely unsuccessful in updating the operating system for use by target user accounts.
The default is Terminate ReACL, meaning the ReACL process for that device is stopped as soon as an error occurs. This is a time-saving option. The ReACL process is reported as Failed in the Devices View. A device cannot be Cutover if the ReACL process reports as Failed. This is the recommended setting.
If you choose Error, the entire process will attempt to complete when an Elevate Failure error is encountered, but the process will still be reported as Failed. This selection may take significantly more time than Terminate ReACL, as the entire process will attempt to finish before reporting as Failed.
If you choose Warn, a warning entry will be logged, however the process will be reported as Successful.
This choice allows experienced migration architects to analyze the logs and choose to Cutover anyway based on their analysis of the results.
If you choose Info, an info entry will be logged, however the process will be reported as Successful. This choice allows experienced migration architects to analyze the logs and choose to Cutover anyway based on their analysis of the results. We suggest choosing Warn over Info as this will make the entries easier to locate in the log.
10. Select an option from the Add Rollback Metadata drop-down list.
AD Migrator inserts a "breadcrumb” during the ReACL process to allow seamless rollback of the ReACL process if needed. You can control the insertion of these breadcrumbs (which are removed during the Cleanup process) if desired, here.
The default is Always and does not affect performance. We recommend this setting. This is the only setting where the changes performed by the ReACL process can be rolled back, or undone, in all scenarios.
If you choose Only If Ambiguous, metadata will only be included when the rollback settings would be ambiguous. Only If Ambiguous results in the addition of fewer breadcrumbs, preserving usage for times when it may be impossible to determine the original file or folder permissions. This would occur, for example, when users have accounts in multiple domains that will be consolidated into a single domain.
Note that Only If Ambiguous guarantees a ReACL can be rolled back to the original state only when the file system permissions remained unchanged. Modification of ACLs on the file system could create a state where a rollback cannot complete with 100% success. To ensure the ability for a ReACL Rollback in all scenarios, Always should be selected.
If you are an experienced migration architect, you may choose Never to never include metadata.
If this is selected, a complete rollback may not be possible.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 65
11. Check the Simulation Only (No Actual Changes) box to simulate the results of the ReACL process without actually making any changes to the ACL. Visit the logs/reports to determine any potential issues and correct them before an actual ReACL process. You might use this to create a Device ReACL Profile specifically for testing purposes.
12. Click Save. The NAS ReACL Profile is added to the list.
Click the Restore Defaults button to reset the profile values back to the default settings.
9.6 Menu Actions
Menu Selections and Menu Actions
New menu selections that appear as a right-click option on Devices or NAS screens can be created in the Menu Actions tab. Menu selections are a sequence of menu actions to complete a process.
The Menu Selection area will allow you to create a new right-click job menu for devices or NAS shares. Existing or new
Menu Action entries should be dragged over to the desired Menu Selection item to complete the custom job process.
The Menu Action area will allow you to create the action(s) that will be downloaded and executed against devices or
NAS shares. You can associate a single action or multiple actions with a Menu Selection object by dragging each Menu
Action item over to the desired Menu Selection.
It is important to note that system menu selections and actions can only be viewed or copied, they are not editable.
Adding or copying a Menu Action
To add or copy a menu action: Above the Menu Action table, click Add or select an existing menu action and click
Copy (or right-click and select Copy). Check Show System to view and select an existing system menu action.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 66
Menu Action Name (Required): Enter a name for the menu action. The Menu Action Name cannot begin with
"BT-" which is used to identify system menu actions.
Menu Action Type (Required): Select one of the options from the drop-down list.
PowerShell Script: Allows you to define a PowerShell script for the process on the Command and
Rollback tabs. Global Variables can be added and used in the script.
Command Line: Allows you to define a Command line for the process on the Command and Rollback tabs. Global Variables can be added and used in the command line.
Download File: Downloads a file to the predefined Downloads folder.
Description: Enter a description for the menu action.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 67
General tab: Mark or unmark the following checkboxes and enter the following options if adding or copying a
PowerShell Script or Command Line:
Automatic Rollback: if checked, automatic rollback is added to the menu action.
Requires Cutover Credentials: if checked, the script or command line includes the
$CutoverCredentials_XXXXX parameters.
Requires Network Profile: if checked, the script or command line includes the $NetworkProfile_XXXXX parameters.
Requires Migration Options: if checked, the script or command line includes the
$MigrationOption_XXXXX parameters.
Requires Global Variables: if checked, the script or command line includes the Global Variables.
Timeout (Seconds): For PowerShell Script or Command Line, enter the number of seconds the process will be attempted before timing out.
Retry Count: For PowerShell Script or Command Line, enter the number of times the process will be retried.
Update Interval (Seconds): For PowerShell Script or Command Line, enter the number of seconds between process runs.
Command tab: Enter a PowerShell scrip to command line. If creating a PowerShell Script, click Starter Script to populate the entry box with the basic framework of a script. Enter or edit the command line or PowerShell
Script. Text is required.
Rollback tab: Enter a PowerShell scrip to command line. If creating a PowerShell Script, click Starter Script to populate the entry box with the basic framework of a script. Enter or edit the command line or PowerShell
Script. Text is required.
Download tab: Enter the following options if adding or copying a Download File menu action. When a new download job is created for a managed workstation, the specified file that is stored on the SMART AD Migrator server (c:\Program files\Binary Tree\ADMigrator\Downloads\) will be downloaded to c:\Program files\Binary
Tree\ADMigrator Agent\Downloads\ on the workstation’s local disk.
File Name (required): The file name. Based on the File Location for Download Jobs used during installation The File Name cannot contain invalid file characters and cannot use reserved file names: map.usr, map.gg, ReACL-config.json.
Target Location: The target location of the download job. The Target Location cannot contain invalid file characters and cannot use reserved file names: map.usr, map.gg, ReACL-config.json.
Retry Count: For PowerShell Script or Command Line, enter the number of times the process will be retried.
Update Interval (Seconds): For PowerShell Script or Command Line, enter the number of seconds between process runs.
Timeout (Seconds): For PowerShell Script or Command Line, enter the number of seconds the process will be attempted before timing out.
The local download folder on an AD Migrator managed machine will be secured with permissions only for the
BUILTIN\Administrators group.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 68
If rights other than BUILTIN\Administrators are required then the administrator will need to make a change on the local downloads folder (c:\Program files\Binary Tree\ADMigrator Agent\Downloads\) on the Agent machine.
Adding or copying a Menu Selection
To add or copy a menu selection: above the Menu Selection table, click Add or select an existing menu selection and click Copy (or right-click and select Copy). Check Show System to view and select an existing system menu selection.
Cover adding menu actions to menu selections (drag and drop), expand, collapse, sequence.
Menu Selection Name (Required): Enter a name for the menu selection. The Menu Action Name must be unique.
Display Name: Enter the name that appears in the right-click menu on the Devices or NAS screen.
Object Type: Select one of the options from the drop-down list.
Device: The menu selection will appear in the right-click menu on the Devices screen.
NAS: The menu selection will appear in the right-click menu on the NAS screen.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 69
Activity: Select one of the options from the drop-down list. The Activity determines what validations are applicable to the job, and which status columns are updated when the job runs. for example, a custom menu selection with the ReACL activity, it will have the same validations as the system ReACL menu selection.
Discovery: Gathers properties from the device.
ReACL: Updates device domain user profiles for use by the matching target user after cutover.
ReACLRollback: Rolls back all changes made by the ReACL process.
ReACLShare: Updates the NAS’s domain user profiles for use by the matching target user after cutover.
ReACLRollbackShare: Rolls back all changes made by the ReACL process.
Cutover: Moves a device from the source domain to the new target domain.
Cleanup: Removes the Source SIDs after the Cutover process completes.
CleanupShare: Removes the Source SIDs after the Cutover process completes.
ExplicitRollback: Rejoins a device back to the source domain.
UploadLogs: Uploads log files from the AD Migrator Device Agent to the AD Migrator Web Server using
Microsoft BITS.
Other (default): An activity not related to any system activity. No predefined validations are applicable.
By default, new menu selections are assigned as Other.
Menu Selection Type: This option is not editable. System types are read-only. User types can be edited.
Description: Enter a description for the menu action.
Adding Menu Actions to Menu Selections
Drag and drop system or custom menu actions from the Menu Action list to the menu selection in the Menu Selection list. Menu actions are listed in the order in which they will be executed. Drag and drop menu actions to reorder them.
Menu Actions can be viewed, copied, or removed by clicking the selecting the menu action and clicking the appropriate button or by right-clicking and selecting an option from the menu.
Activating Menu Selections
Only menu selections marked as Active will appear in the right-click menus. Click the Deactivate or Activate button to change the active status of the menu selection. Inactive menu selections can be displayed in the table by marking the
Show Inactive check box. You may want to create a new menu selection, activate it, and then deactivate the system menu selection.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 70
9.7 Custom Menu Action Example
Scenario: The administrator wants to download the Get-DiskSpace.ps1 file on selected workstations.
Steps:
1. Copy the Get-DiskSpace.ps1 file in the file location for download jobs selected during the installation of
SMART AD Migrator, c:\Program files\Binary Tree\ADMigrator\Downloads\ by default.
2. Under the Menu Actions tab in Settings, add a menu action.
3. Select the "Download File" Menu Action Type and enter the File Name. The full path to the file should not be entered.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 71
4. Add a menu selection. The Display Name is how the option will appear in the right-click menu. Select the
"Device" Object Type so the menu option will appear on the Devices screen.
5. Drop and drag the new menu action to under the new menu selection and ensure the menu selection is active.
The menu selection can be expanded to view the associated menu action.
6. On the Devices screen, select the devices and then select the new "Get Disk Space" option from the right-click menu. When the new download job is run successfully against a managed machine, the Get-DiskSpace.ps1 file will reside locally on disk at c:\Program files (x86)\Binary Tree\ADMigrator Agent\Downloads.
9.8 Global Variables
Global variables can be defined and be used across multiple scripts when defining menu actions. For example, you may add a global variable to add the current date to multiple scripts. Global variables will appear when selecting a starter script when creating a Menu Action if the Requires Global Variables option is selected.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 72
Adding a Global Variable
To add a Global Variable click Add under the Global Variables tab.
Variable Name (Required): Enter a name for the global variable. The name must contain alphanumeric and underscores only.
Variable Value (Required): The value of the global variable. Check the Encrypted box to encrypt the value in the database and hide the variable value in the interface.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 73
Section 10. Migrating Devices
Workstations and Servers are referred to as Devices in SMART AD Migrator. The Devices screen allows you to register devices, change the polling interval, and manage the device Discovery, ReACL, Cutover, and Cleanup processes.
The SMART AD Migrator Agent must be installed on the device before a device can be registered or any actions taken on it. Refer to Installing the SMART AD Migrator Agent on Devices topic for more information.
Job Scheduling Options
The Job Scheduling option allows the administrator to effectively manage the server and workstation environment during the migration event by scheduling device jobs to run at specific points of time in the future. Each job that is available by right-clicking a device will surface the ability to set a “Do not start before” date and time. If a job is scheduled, then it sits in the queue and is not an active job for the device as it polls in looking for jobs based on the configured polling interval.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 74
View Jobs
To view device jobs:
1. Click on table rows to select one or more devices in the list (Use Ctrl-Click to select more than one row).
2. Right-Click to view the options menu and select View Jobs. The Device Jobs window appears.
3. The Device Jobs table includes the following columns: o Job ID - the ID of the job o Queued Timestamp - the date and time the job was queued o Command Name - the command name of the job o Status - the current status of the job o Cancel Requested - checked in a cancel of the job has been requested o Message - Result codes and messages for the job o Timeout (sec) - the timeout in seconds o Retry Count - the number of times the job has been retried o Rollback Status - the status of a rollback o Rollback Message - the status of a rollback
4. To cancel a job, select the job and click the Cancel button or select Cancel from the right-click menu. To refresh the jobs list, click the Refresh button.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 75
Jobs can be canceled when the Status or Rollback Status is either Queued, Scheduled, Started, or In Progress.
View Properties
After the Discovery process has been completed for a device, you view the properties of the device.
To view a device’s properties:
1. Click on table rows to select a device in the list.
2. Right-Click to view the options menu and select View Properties. The Device Properties window appears displaying the properties of the device and the user profiles associated with the device.
3. Click the Export All button to export the content of the window in Excel, text, CSV, or HTML format.
Polling Interval
The polling interval is set to 900 seconds (15 minutes) by default. The polling interval tells devices how frequently to contact the SMART AD Migrator Server and check for jobs. If the polling interval is set to a high number, such as 14400 seconds (4 hours), it is possible that any command sent to the device may not execute for up to four hours. You may decide to set the polling interval to a high number to keep the load off of the web servers until devices are closer to the actual date of cutover.
A lengthy time between sending a command to a device and the device executing the command is not likely to be effective on the day of cutover. To ensure adequate response time on the day of cutover, it is recommended to decrease this interval in advance of the Cutover process.
Devices will only obtain an updated polling interval when next contacting the SMART Active Directory Migrator web service.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 76
To set polling interval:
1. Click on table rows to select one or more devices in the list (Use Ctrl-Click to select more than one row).
2. Right-click to view the options menu and select Set Polling Interval. The Set Polling Interval window appears.
3. Edit the Polling Interval (seconds) field and click Save.
The polling interval default for all newly registered devices can be changed in SQL in the ADM_Setting table field PollIntervalSeconds.
If upgrading from a release prior to SMART Active Directory Migrator 9.2, the polling interval default was 14400 seconds. This default value will not be changed during an upgrade and will need to be updated in the
ADM_Setting table per above.
Set ReACL Profile
To set ReACL Profile:
1. Click on table rows to select one or more devices in the list (Use Ctrl-Click to select more than one row).
2. Right-click to view the options menu and select Set ReACL Profile. The Set ReACL Profile window appears.
3. Select the ReACL Profile and click Save.
Discovery
The Discovery process gathers properties (OS versions, network properties, and so on) from the device to allow additional future functionality. The first discovery process begins for a device when the device becomes registered which will automatically occur after the Device Agent has been installed, as long as the environment is properly configured.
To start the device Discovery process manually:
1. Click on table rows to select one or more devices in the list (Use Ctrl-Click to select more than one row).
2. Right-Click to view the options menu and select Discovery.
3. In Job Scheduling Options window, click OK to begin the Discovery process as soon as possible. Check Do not
start before and then enter or select a date and time when the process will begin. If using the Do not start before option, the Discovery Status will be displayed as Queued in the Devices table and the Do Not Start
Before column in the Device Jobs table will be populated with the selected date.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 77
4. The Queue Summary window appears.
5. Click OK. The Discovery Status column is populated with the current status. Use the Right-click View Jobs option or double-click a row in the Devices table to view the list of jobs for the specific Device.
ReACL
The ReACL process updates the device’s domain user profiles for use by the matching target user after cutover.
At least one group must be migrated to populate the map.gg file or the ReACL process will fail.
Before ReACL can occur, the target users and groups which have permissions set on the device must be migrated to the target.
To start the device ReACL process:
1. Click on table rows to select one or more devices in the list (Use Ctrl-Click to select more than one row).
2. Right-Click to view the options menu and select ReACL.
3. In Job Scheduling Options window, click OK to begin the ReACL process as soon as possible. Check Do not start
before and then enter or select a date and time when the process will begin. If using the Do not start before option, the ReACL Status will be displayed as Queued in the Devices table and the Do Not Start Before column in the Device Jobs table will be populated with the selected date.
4. The Queue Summary window appears.
5. Click OK. The ReACL Status column is populated with the current status. Use the Right-click View Jobs option or double-click a row to view the list of jobs.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 78
Two checks are performed at the start of the ReACL process. The first check is against invalid Source Profiles, which will be logged as a WARNING and those profiles will be skipped. The second check is against invalid Target Profiles, where a user may create a profile with the target account before their machine is ReACL’d and cutover. By default, this is logged as a FATAL ERROR and will halt the ReACL process. However, it can be changed to a WARNING with the –t switch passed by editing the command in SQL.
The ReACL Agent will automatically create two files on the device being ReACL’d, map.usr and map.gg. These files are used to find the source permissions and add the appropriate target permissions during the ReACL process. System groups, such as Domain\Domain Admins and Domain\Domain Users are included in the map.gg file for updating the group permissions during the ReACL process. If the Active Directory environment is non-English, the values in the sAMAccountName column of the BT_SystemGroup table in the SQL database will need to be changed after SMART
Directory Sync is installed to have the appropriate non-English values.
If the Mapped Network Drive is being mapped via GPO or using an integrated credential such as the current windows logon session, ReACL will create a warning entry in the log “…WARNING: The UserName value for drive U was empty and could not be mapped to the target user.” This warning does not mean that the mapped drive cannot be accessed after Cutover.
Cutover
The Cutover process moves a device from the source domain to the new target domain.
To start the Cutover process:
1. Click on table rows to select one or more devices in the list (Use Ctrl-Click to select more than one row).
2. Right-Click to view the options menu and select Cutover.
3. The Cutover Options window appears. Select Cutover Credentials, a Network Profile, and Migration Option from the drop-down lists.
4. Check Do not start before and then enter or select a date and time when the process will begin. If using the Do
not start before option, the Cutover Status will be displayed as Queued in the Devices table and the Do Not
Start Before column in the Device Jobs table will be populated with the selected date. The Cutover process will begin as soon as possible if not using this option.
5. The Queue Summary window appears.
6. Click OK. The Cutover Status column is populated with the current status. Use the Right-click View Jobs option or double-click a row to view the list of jobs.
The Cutover Options are set on the Settings screen.
Rollback
The Rollback process moves a device back to the original source domain and restores any modified network settings.
The device must have attempted Cutover for this explicit Rollback process to work.
To start the Rollback process:
1. Click on table rows to select one or more devices in the list (Use Ctrl-Click to select more than one row).
2. Right-Click to view the options menu and select Rollback.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 79
3. In Job Scheduling Options window, click OK to begin the Rollback process as soon as possible. Check Do not
start before and then enter or select a date and time when the process will begin. If using the Do not start
before option, the Do Not Start Before column in the Device Jobs table will be populated with the selected date.
4. Click OK. The Queue Summary window appears.
5. Click OK. The selected devices are sent back to their original domain and any modified network settings are restored. The Cutover Status column is updated with the current status.
Cleanup
The Cleanup process removes the Source SIDs after the Cutover process completes.
Cleanup should be done when the migration project is completed. Before running the Cleanup process, it is recommended to disable SID filtering/quarantine to verify there are no issues with application access before completing the cleanup process.
To start the Cleanup process:
1. Click on table rows to select one or more devices in the list (Use Ctrl-Click to select more than one row).
2. Right-Click to view the options menu and select Cleanup.
3. In Job Scheduling Options window, click OK to begin the Cleanup process as soon as possible. Check Do not
start before and then enter or select a date and time when the process will begin. If using the Do not start
before option, the Cleanup Status will be displayed as Queued in the Devices table and the Do Not Start Before column in the Device Jobs table will be populated with the selected date.
4. The Queue Summary window appears.
5. Click OK. The Cleanup Status column is populated with the current status. Use the Right-click View Jobs option or double-click a row to view the list of jobs.
ReACL Rollback
The ReACL Rollback feature rolls back all changes made by the ReACL process. ReACL Rollback can be performed on devices that have completed the ReACL process.
To rollback ReACL:
1. Click on table rows to select one or more devices in the list (Use Ctrl-Click to select more than one row).
2. Right-click to view the options menu and select ReACL Rollback.
3. In Job Scheduling Options window, click OK to begin the ReACL Rollback process as soon as possible. Check Do
not start before and then enter or select a date and time when the process will begin. If using the Do not start
before option, the Do Not Start Before column in the Device Jobs table will be populated with the selected date.
4. View rollback results by viewing the device's job view.
Device Columns
The following columns appear on the Devices screen by default: o Migration Group - The Migration Group name. Use the Right-click Set Migration Group option to change. o sAMAccountName - the sAMAccountName attribute of the source device
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 80
o Distinguished Name - the distinguished name attribute of the source device o Registered - This is checked if the device is registered with the server. o Agent Last Contact - Displays the time and date of the last contact between the agent and the
SMART AD Migrator Server. o Description - the description attribute of the source device o Polling Interval - The time interval (in seconds) between polls. This is set to 900 seconds (15 minutes) by default.
Use the Right-click Set Polling Interval option to change. The SMART AD Migrator agent will pick up the new polling interval value the next time it contacts the Web Service. o Discovery Status - The status of the discovery process. Use the Right-click Discovery option to start the
Discovery process. o ReACL Status - The status of the ReACL process. Use the Right-click ReACL option to start the ReACL process. o ReACL Profile - The ReACL Profile set for the device. Use the Right-click Set ReACL Profile option to change.
Device ReACL Profiles are defined in Settings. o Cutover Status - The status of the Cutover process. Use the Right-click Cutover option to start the Cutover process. o Cleanup Status - The status of the Cleanup process. Use the Right-click Cleanup option to start the Cleanup process. o Last Job Message - The last job status.
The following additional fields can be displayed by customizing the columns: o ID - SQL record number o Migration Group ID - The Migration Group ID. o Agent Version - The version of the agent installed on the device. o Blacklisted - checked if the device is currently on the blacklist. Use the Right-click Add to Blacklist option or
Remove from Blacklist option to change.
Upload Logs
Log files from the AD Migrator Device Agent can be uploaded to the AD Migrator Web Server using Microsoft BITS. To enable this functionality, the installer will enable BITS Server Extensions for IIS and create a virtual directory called
DeviceLogs where all uploaded files will be stored.
To upload Log files from the AD Migrator Device Agent:
1. Click on table rows to select one or more devices in the list (Use Ctrl-Click to select more than one row).
2. Right-Click to view the options menu and select Upload Logs.
3. In Job Scheduling Options window, click OK to begin the Upload Logs process as soon as possible. Check Do not start before and then enter or select a date and time when the process will begin. If using the Do not start before option, the Do Not Start Before column in the Device Jobs table will be populated with the selected date.
4. Review the device jobs to see when the Upload Logs job has completed.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 81
The logs will be stored at the following location: C:\Program Files\Binary Tree\ADMigrator\DeviceLogs
The device logs will be zipped, and the file names will be in the following format with a unique file name:
SMART-WIN7X86-1_201573111235
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 82
Section 11. Migrating NAS
The NAS screen allows you to ReACL NAS (Network Attached Storage) devices via a network share.
Add a NAS
To add a NAS device:
1. Click the Add button. The Network Storage window appears.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 83
2. Enter values in the following fields: o UNC Path - the UNC path that will be the starting location for ReACL on the NAS device o Device Name - The name of the device used to access the NAS device. This device must be local (same network, region, and so on) to the NAS device. This is a sAMAccountName, not an FQDN. o Username - The username to access the NAS device. UserPrincipalName values ([email protected]) or domain\username format are supported o Password - the password to access the NAS device
3. Click Save. The NAS device is added to the list.
Edit a NAS
To edit a NAS device:
1. Click on a table rows to select one a NAS device in the list.
2. Click the Edit button or select Edit from the right-click menu. The Network Access Storage window appears.
3. Edit the values.
4. Click OK. The NAS device is updated in the list.
Delete a NAS
To delete a NAS device:
1. Click on table rows to select one or more NAS devices in the list (Use Ctrl-Click to select more than one row).
2. Click the Delete button or select Delete from the right-click menu. The NAS device is removed from the list.
Set ReACL Profile
To set ReACL Profile:
1. Click on table rows to select one or more devices in the list (Use Ctrl-Click to select more than one row).
2. Right-click to view the options menu and select Set ReACL Profile. The Set ReACL Profile window appears.
3. Select the ReACL Profile and click Save.
ReACL
The ReACL process updates the NAS’s domain user profiles for use by the matching target user after cutover.
To start the device ReACL process:
1. Click on table rows to select one or more NAS devices in the list (Use Ctrl-Click to select more than one row).
2. Right-Click to view the options menu and select ReACL.
3. In Job Scheduling Options window, click OK to begin the ReACL process as soon as possible. Check Do not start
before and then enter or select a date and time when the process will begin. If using the Do not start before option, the ReACL Status will be displayed as Queued in the NAS table and the Do Not Start Before column in the NAS Device Jobs table will be populated with the selected date.
4. The Queue Summary window appears.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 84
5. Click OK. Use the Right-click View Jobs option to view the list of jobs.
Cleanup
The Cleanup process removes the Source SIDs after the Cutover process completes.
To start the Cleanup process:
1. Click on table rows to select one or more NAS devices in the list. (Use Ctrl-Click to select more than one row or
Shift-Click to select a range of rows.)
2. Right-Click to view the options menu and select Cleanup.
3. In Job Scheduling Options window, click OK to begin the Cleanup process as soon as possible. Check Do not
start before and then enter or select a date and time when the process will begin. If using the Do not start
before option, the Cleanup Status will be displayed as Queued in the NAS table and the Do Not Start Before column in the NAS Device Jobs table will be populated with the selected date.
4. The Queue Summary window appears.
5. Click OK. The Cleanup Status column is populated with the current status. Use the Right-click View Jobs option to view the list of jobs.
View Jobs
To view NAS device jobs:
1. Click on table rows to select one or more NAS devices in the list (Use Ctrl-Click to select more than one row).
2. Right-Click to view the options menu and select View Jobs. The Device Jobs window appears.
3. The Device Jobs table includes the following columns: o Job ID - the ID of the job o Queued Timestamp - the date and time the job was queued o Command Name - the command name of the job o Status - the current status of the job o Cancel Requested - checked in a cancel of the job has been requested o Message - Result codes and messages for the job o Timeout (sec) - the timeout in seconds o Retry Count - the number of times the job has been retried o Rollback Status - the status of a rollback o Rollback Message - the status of a rollback
4. To cancel a job, select the job and click the Cancel button or select Cancel from the right-click menu. To refresh the jobs list, click the Refresh button.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 85
ReACL Rollback
The ReACL Rollback feature rolls back all changes made by the ReACL process. ReACL Rollback can be performed on
NAS devices that have completed the ReACL process.
To rollback ReACL:
1. Click on table rows to select one or more NAS devices in the list (Use Ctrl-Click to select more than one row).
2. Right-click to view the options menu and select ReACL Rollback.
3. In Job Scheduling Options window, click OK to begin the ReACL Rollback process as soon as possible. Check Do
not start before and then enter or select a date and time when the process will begin. If using the Do not start
before option, the Do Not Start Before column in the NAS Device Jobs table will be populated with the selected date.
4. View rollback results by viewing the NAS device's job view.
NAS Columns
The following columns appear on the NAS screen by default: o ID - the migration ID o Device Name - The name of the device used to access the NAS device. This device must be local to the NAS device. o UNC Path - the UNC path to the network share used to access the NAS device o Username - the username to access the NAS device o ReACL Status - The status of the ReACL process. Use the Right-click ReACL option to start the ReACL process. o Cleanup Status - The status of the Cleanup process. Use the Right-click Cleanup option to start the Cleanup process.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 86
Section 12. Reports
The Reports screen allows you to view reports for the current AD migration, devices, migration groups, and users.
Reports are available only if the Reporting feature was installed and configured.
Dashboard
The Dashboard report is a high level status report of the current AD Migration.
To view the Dashboard report:
1. Select Dashboard from the drop-down list.
2. To filter the report to display a specific Migration Group, select an option from the Select Migration Group drop-down list and click the View Report button. If no Migration Groups have been created, the only option available is ALL which displays all objects.
The report displays the following data:
User Preparation Status - Displays the number of users prepared and not prepared for migration.
User Migration Status - Displays the number of users migrated and not migrated.
Device Preparation Status - Displays the number of devices prepared and not prepared for cutover.
Device Cutover Status - Displays the number of devices that have completed cutover and have not completed cutover.
Devices that Failed to Cutover - Displays the number of devices that failed cutover and completed cutover.
User Profiles to Device Relationship - Displays the users that have logged onto each device.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 87
Device Detail Report
The Device Detail Report is a detailed report of device information.
To view the Device Detail Report:
1. Select Device Detail Report from the drop-down list.
2. To filter the report to display a specific record, select an option from one or more drop-down lists and click the
View Report button.
The report displays the following data for each device:
Migration Group - The Migration Group name.
Name - The sAMAccountName attribute of the source device.
Device Not Checking In - Is the device checking in with the server.
Source DN - The distinguished name attribute of the source device.
Registered - Is the device registered with the server.
Discovery - The status of the Discovery process.
ReACL - The status of the ReACL process.
Cutover - The status of the Cutover process.
Cleanup - The status of the Cleanup process.
Prepared for Migration - The device has successfully started the cutover process.
Last Contact - The time and date of the last contact between the agent and the SMART AD Migrator Server.
This report includes an extra blank page that can be ignored.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 88
Devices that Failed to Cutover
The Devices that Failed to Cutover report is a report displaying devices that did not successfully complete the cutover process.
To view the Devices that Failed to Cutover report:
1. Select Devices that Failed to Cutover from the drop-down list.
2. To filter the report to display a specific Migration Group, select an option from the Select Migration Group drop-down list and click the View Report button. If no Migration Groups have been created, the only option available is ALL which displays all devices.
The report displays the following data for each device:
Device Name - The sAMAccountName attribute of the source device.
Migration Status - The status of the migration.
Last Job Message - The last job status.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 89
Migration Group Status
The Migration Group Status report displays metrics information about all migration objects.
To view the Migration Group Status report:
1. Select Migration Group Status from the drop-down list.
2. To filter the report to display a specific Migration Group, select an option from the Select Migration Group drop-down list and click the View Report button. If no Migration Groups have been created, the only option available is ALL which displays all objects.
User Status Report
The User Status Report is a detailed report of user information.
To view the User Status Report:
1. Select User Status Report from the drop-down list.
2. To filter the report to display a specific record, select an option from one or more drop-down lists and click the
View Report button.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 90
The report displays the following data for each user:
Migration Group - The Migration Group name.
Display Name - The display name attribute of the source user account.
Source User ID - The User ID of the source user account.
Target User ID - The User ID of the target user account.
Source DN - The distinguished name attribute of the source user account.
Target DN - The distinguished name attribute of the target user account.
Source UAC - Indicates if the user account is enabled in the source.
Target UAC - Indicates if the user account is enabled in the target.
Migrated - This column shows any users that have been manually tagged with the Migrated status. This is an optional tag for tracking purposes and does not necessarily represent a successful user migration.
Prepared for Migration - A value of True verifies that the user has been synchronized with the target.
Ready to Sync - User has been marked as Ready-to-Sync.
Failed to Sync - If the Ready-to-Sync value is true, AND Failed to Sync is a value of True, this means that the synchronization has actually failed. Examine the log for details. If the Ready-to-Sync value is False, and Failed to
Sync is a value of True, this means that synchronization has not yet been attempted for this user.
Status Message - The last status. No message is displayed if Failed to Sync is False.
Migration Group ID - The ID of the Migration Group.
User Profiles to Device Relationship Report
The User Profiles to Device Relationship Report is a report showing the users that have logged onto each device.
To view the User Profiles to Device Relationship Report:
1. Select User Profiles to Device Relationship from the drop-down list.
2. To filter the report to display a specific Migration Group, select an option from the Migration Group drop-down list and click the View Report button. If no Migration Groups have been created, the only option available is
ALL which displays all devices.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 91
The report displays the following data for each user:
Device Name - The name of the device.
sAMAccountName - The sAMAccountName of the user.
First Name - The first name of the source user.
Last Name - The last name of the source user.
Profile Last Used - The last date the profile was used.
Report Options
Report options are available above the displayed report.
Paging - Click the First Page, Previous Page, Next Page, and Last Page arrows to page through a multi-page report.
Refresh - Click the Refresh icon to update the data in the report. This option is also available in the right-click menu while hovering over the report.
Print - Click the Print icon to open printing options. This option is also available in the right-click menu while hovering over the report.
Print Layout - Click the Print Layout icon to view the report as it will be printed. This option is also available in the right-click menu while hovering over the report.
Page Setup - Click the Page Setup icon to open paper, orientation, and margin options. This option is also available in the right-click menu while hovering over the report.
Export - Click the Export icon to select a format to export. This option is also available in the right-click menu while hovering over the report.
Zoom - Click the drop-down list and select a zoom option. This option is also available in the right-click menu while hovering over the report.
Find / Next - Enter a value to search for in the report and click Find. Click Next to find the next instance of the value.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 92
Section 13. Using the SMART Directory Sync
Log Viewer
The SMART Directory Sync Log Viewer allows you to view, search, export, and clear synchronization logs.
To open and view logs in the SMART Directory Sync Log Viewer:
1. In the SMART Active Directory Migrator console, click the Logs icon
Viewer opens.
. The SMART Directory Sync Log
2. The Synchronization profile is automatically selected and log entries associated with the profile are displayed.
To change the profile, select a different profile from the Profile drop-down list. Click the Refresh icon next to the
Profile drop-down list to refresh the list of profiles and the log grid.
13.1 Searching Log Entries
To search for log entries: o Enter a search term in the Search field and then click the Find icon. The table refreshes to show the search results.
13.2 Pausing a Log
You can stop the continuous scrolling of the log to allow for easier reading. This feature pauses the display only, not the logging function.
To pause the log:
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 93
1. Click the Pause icon.
2. To restart the log display, click the Play icon (next to “Paused”).
13.3 Showing Log Entries for a Time Period
To show all log entries for a time period: o Select a “Show...” option from the drop-down list near the upper right corner of the console. The table refreshes to show all log entries for the selected time period.
13.4 Filtering the Log
To filter the log:
1. Click the filter button on any column header to open the filter window.
2. Enter the filter criteria, and then click Filter. The table refreshes to the filtered log entries.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 94
3. User the Clear Filter button to clear the filter.
13.5 Grouping the Log by Column
To group the log by a column: o Drag a column header to the bar above the log table to group the log by a specific column. The table refreshes grouped by the selected column.
13.6 Viewing Log Entry Details
To view log entry details: o Click the plus icon in the log entry. The entry expands to display the details of the log entry.
13.7 Exporting Log Entries
To export the log entries of the currently selected profile:
1. Click Export All.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 95
2. Enter a File name, location, a file type, and then click Save.
13.8 Clearing Log Entries
To clear old log entries of the currently selected profile:
1. Click Clear. The Clear Log window opens.
2. Select a number and time unit (Weeks, Days, or Hours) from the drop-down list to clear the log of older entries and then click OK.
3. Also, you have the option to clear the log entries of all profiles older than the selected time automatically by selecting Clear log automatically (applies to all profiles
Binary Tree recommends that the logs be set to clear automatically to prevent the accumulated data from becoming too large.
To clear all log entries of the currently selected profile:
Click Clear All. All log entries of the currently selected profile are cleared.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 96
Section 14. Troubleshooting
o Problem: What do you do when a user tries to use a network printer post ReACL process and/or cutover and receives an access denied error?
Solution: Synchronize the SID History for that user to resolve the problem. o Problem: ASP.NET will sometimes not register properly with IIS, which can cause errors when the SMART AD
Migrator agent tries to communicate with the Web Service. How do I address this?
Solution: During installation, the installer needs to enable the IIS feature for the server if the feature was not enabled so that web-service can be installed and configured. To address this problem, you should manually reregister the ASP.NET with IIS. To do this, run the below command on the server under
C:\Windows\Microsoft.NET\Framework\v4.5.2: aspnet_regiis -i o Problem: What do I do if the Agent_<datetime>.log shows an Error: Login failed for user 'IIS APPPOOL\ADM
AppPool' in System.Data.SqlClient.SqlException?
Solution: To fix this:
1. Open SQL Management Studio where DirSync databases were setup.
2. Go to SQL Server Security -> Logins.
3. New Login.
4. User name: IIS APPPOOL\ADM AppPool.
5. Click on User Mappings.
6. Select BTCodex for the database.
7. Select db_datareader and db_datawriter for Roles.
8. Click OK.
9. Restart the agent on the workstation or wait for the next polling interval o Problem: Observed Access Denied error when trying to ReACL a Windows NAS Shared Drive.
Solution: To fix this:
1. Add the user credential in the NAS screen in the SMART AD Migrator Console. This user should be installed on a workstation with Local Admin Rights.
2. After the agent installed on the workstation, change the SMART AD Migrator Agent Service account from Local System to the user credential specified in step 1. This user should also be logged in on the workstation as well.
3. Turn off UAC on the workstation.
4. ReACL the Windows NAS Shared Drive. o Problem: Users are getting an error message that their Recycle Bin has been corrupted once their computer has been migrated.
Solution: This is a common issue with Domain Migrations and is caused when the Recycle Bin is not empty. This is happening because the name of the Recycle Bin is the user’s SID and the Recycle Bin cannot be reACL’d. After the workstation has been reACL’d and migrated when the user logs on, if the existing Recycle Bin is not empty
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 97
the user cannot access it. But if the existing Recycle Bin is empty a new one is created and the Target user’s SID is the name of the Recycle Bin.
Resolution:
Empty the Recycle Bin as part of the Cutover process. o Problem: SMART Directory Sync does not start if SQL Authentication method is used with Windows
Authentication.
Solution: Manually add the computer account to the SQL server and granted with the sysadmin role. To accomplish this, perform the following steps.
1. Via the SQL Management Studio, open a new query window. Enter the below script.
2. CREATE LOGIN [Domain\machine_name$] FROM WINDOWS
3. Via the Security and Logins, located the newly created Computer Name.
4. Grant this user with sysadmin role. o Problem: A workstation that has been successfully cutover no longer responds to any additional jobs, such as
Cleanup.
Solution: If a workstation that has been successfully cutover now fails to respond to any additional jobs, such as
Cleanup, check the Application event log. If you see a "The remote name could not be resolved" error, this most likely means that the SRV record for the ADM server can no longer be resolved due to a DNS lookup failure.
If you cannot "Ping" the ADM server from any other machines in the target domain, then you will need to remedy this on a more global scale, such as creating a conditional forwarder on the target machines' current
DNS server pointing to the appropriate location.
If you are able to "Ping" the ADM server, then check the Network Profile that was used during the Cutover to verify that the DNS settings were correct in that profile.
Password Sync Troubleshooting
o Problem: If you encounter "Access is denied" errors when syncing passwords with Directory Sync.
Solution: This is most likely because the utility (psexec.exe) used for remote calls to the Global Catalog is failing.
Some things you can try are:
1. Try the GC server's IP address, FQDN and Shortname. IP address often works when others do not.
2. From the Directory Sync machine browse to \\[GC]\admin$ with the admin username\password.
3. Run the Directory Sync service with credentials that have access to the GC instead of as LocalSystem.
4. Firewalls\Anti-Virus software should not be a problem but turning them off may help.
AD Migrator BITS Troubleshooting
o Problem: The AD Migrator UI issued the ‘Upload Logs’ command to the Agent for a device, but nothing was uploaded to the web server.
Solutions:
IIS Web Server where ADM Web Service is installed:
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 98
1. Open IIS Manager.
2. Verify that Default Web Site > adm > DeviceLogs exists. a. Verify there is a BITS Uploads option icon in the Feature View (at the bottom).
If not, use PowerShell to install.
Import-Module ServerManager
Add-WindowsFeature BITS-IIS-Ext b. Verify in the BITS Upload view, that "Allow clients to upload files" is checked.
On the Device where the ‘Upload Logs’ command was issued:
1. Navigate to C:\Program Files (x86)\Binary Tree\ADMigrator Agent\Files.
2. Open the agent_<date>.log in Notepad. a. Verify the URI for the server /api and /devicelogs location is correct.
1. Open IIS Manager.
2. Go to Default Web Site -> adm -> DeviceLogs.
3. Click on Basic Settings in the right pane. a. Verify the Application Pool is set to "ADM AppPool".
4. Click on Edit Permissions -> Security tab a. Verify the IUSR account is in the list and has the following permissions: Modify, Ready & execute,
List folder contents, Read, Write
1. Navigate to C:\Program Files (x86)\Binary Tree\ADMigrator Agent\Files.
2. Open the PowerShell-<date>-<time>-BT-UploadLogs.log file. a. Check for problems or errors.
1. Go to Start -> Run -> services.msc.
2. Verify the Background Intelligent Transfer Service is started.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 99
Appendix A. AD Source – AD Target Default
Mapping
The below table displays the default values of the AD Source to AD Target mapping table.
Source Field Internal Field Target Field So urc e
Ty pe
Targ et
Typ e 1
Tar get
Typ e 2
Comments
accountExpires altRecipient assistant authOrig
C cn
Co codePage
AccountExpires
ForwardingAddress
Assistant
AuthOrig accountExpires altRecipient authOrig
CountryAbbreviation C
CommonName cn
CountryName
CodePage
Co codePage
Comment company countryCode deletedItemFlags
Comment
Company
CountryCode
DeletedItemFlags
Comment company countryCode deletedItemFlags any any any any any any any any delivContLength department
DelivContLength
Department delivContLength department any any any any departmentNumber DepartmentNumber departmentNumber any any description Description description any any any any any any any any any any any any any any any any any any
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 100
Source Field Internal Field Target Field So urc e
Ty pe
Targ et
Typ e 1
Tar get
Typ e 2
Comments
any any displayName DisplayName displayName division Division division any any dLMemSubmitPerms DLMemSubmitPerms dLMemSubmitPerms any any dLMemRejectPerms DLMemRejectPerms dLMemRejectPerms any any employeeID EmployeeID employeeID any any employeeNumber employeeType
EmployeeNumber
EmployeeType extensionAttribute1 Extension1 employeeNumber employeeType extensionAttribute1 any any any any any any extensionAttribute10 extensionAttribute11 extensionAttribute12
Extension10
Extension11
Extension12 extensionAttribute10 extensionAttribute11 extensionAttribute12 any any any any any any
These are
Exchange defined custom attributes.
These are
Exchange defined custom attributes.
These are
Exchange defined custom attributes.
These are
Exchange defined custom attributes.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 101
Source Field
extensionAttribute13 extensionAttribute14 extensionAttribute15 extensionAttribute2 extensionAttribute3 extensionAttribute4
Internal Field
Extension13
Extension14
Extension15
Extension2
Extension3
Extension4
Target Field So urc e
Ty pe
Targ et
Typ e 1
Tar get
Typ e 2
Comments
extensionAttribute13 any any extensionAttribute14 any any
These are
Exchange defined custom attributes.
These are
Exchange defined custom attributes. extensionAttribute15 any any These are
Exchange defined custom attributes. extensionAttribute2 any any extensionAttribute3 any any
These are
Exchange defined custom attributes.
These are
Exchange defined custom attributes. extensionAttribute4 any any These are
Exchange defined custom attributes.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 102
Source Field
extensionAttribute5 extensionAttribute6 extensionAttribute7 extensionAttribute8 extensionAttribute9
Internal Field
Extension5
Extension6
Extension7
Extension8
Extension9 facsimileTelephoneNum ber
OfficeFAXNumber generationQualifier givenName
Suffix
FirstName
Target Field So urc e
Ty pe
Targ et
Typ e 1
Tar get
Typ e 2
Comments
extensionAttribute5 any any extensionAttribute6 any any
These are
Exchange defined custom attributes.
These are
Exchange defined custom attributes. extensionAttribute7 any any These are
Exchange defined custom attributes. extensionAttribute8 any any extensionAttribute9 any any
These are
Exchange defined custom attributes.
These are
Exchange defined custom attributes. facsimileTelephoneNum ber any any generationQualifier givenName any any any any
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 103
Source Field Internal Field Target Field So urc e
Ty pe
Targ et
Typ e 1
Tar get
Typ e 2
Comments
any any homePhone
HomePostalAddress
Info initials
HomePhoneNumber
HomePostalAddress
Info
Initials homePhone
HomePostalAddress
Info initials any any any any any any internationalISDNNumb er
InternationalISDNNumb er internationalISDNNumb er any any internetEncoding internetEncoding internetEncoding any any ipPhone jpegPhoto l language legacyExchangeDN localeID mail mailNickname manager
IPPhone
JPEGPhoto
OfficeCity
Language
LegacyExchangeDN
LocaleID
InternetAddress
PrimaryAlias
Manager ipPhone jpegPhoto l language legacyExchangeDN localeID mail mailNickname any any any any any any any any any any any any any any any any any any
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 104
Source Field Internal Field Target Field So urc e
Ty pe
Targ et
Typ e 1
Tar get
Typ e 2
Comments
any any mAPIRecipient middleName
MAPIRecipient
MiddleName mAPIRecipient middleName any any mobile CellPhoneNumber mobile any any msDS-
PhoneticCompanyName msDSPhoneticCompany
Name msDS-
PhoneticCompanyName any any msDS-
PhoneticDepartment msDSPhoneticDepartme nt msDS-
PhoneticDepartment any any msDS-
PhoneticDisplayName msDSPhoneticDisplayNa me msDS-
PhoneticDisplayName any any any any msDS-
PhoneticFirstName msDS-
PhoneticLastName msDSPhoneticFirstName msDS-
PhoneticFirstName msDSPhoneticLastName msDS-
PhoneticLastName any any msExchAddressBookFlag s msExchAddressBookFlag s msExchAddressBookFlag s any any msExchALObjectVersion msExchALObjectVersion msExchALObjectVersion any any msExchArchiveGuid msExchArchiveGuid msExchArchiveGuid any any msExchArchivename msExchArchivename msExchArchivename any any msExchAssistantName msExchAssistantName msExchAssistantName any any
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 105
Source Field Internal Field Target Field So urc e
Ty pe
Targ et
Typ e 1
Tar get
Typ e 2
Comments
msExchBlockedSenders
Hash msExchBlockedSenders
Hash msExchBlockedSenders
Hash any any msExchBypassAudit msExchBypassAudit msExchBypassAudit any any msExchELCExpirySuspen sionEnd msExchELCExpirySuspen sionEnd msExchELCExpirySuspen sionEnd any any msExchELCExpirySuspen sionStart msExchELCExpirySuspen sionStart msExchELCExpirySuspen sionStart any any msExchELCMailboxFlags msExchELCMailboxFlags msExchELCMailboxFlags any any msExchExternalOOFOpti ons msExchExternalOOFOpti ons msExchExternalOOFOpti ons any any msExchHideFromAddres sLists msExchHideFromAddres sLists msExchHideFromAddres sLists any any msExchMailboxAuditEna ble msExchMailboxAuditEna ble msExchMailboxAuditEna ble any any msExchMailboxAuditLog
AgeLimit msExchMailboxAuditLog
AgeLimit msExchMailboxAuditLog
AgeLimit any any msExchMailboxGuid msExchMailboxGUID msExchMailboxGuid any any msExchMDBRulesQuota msExchMDBRulesQuota msExchMDBRulesQuota any any msExchMessageHygiene
Flags msExchMessageHygiene
Flags msExchMessageHygiene
Flags any any
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 106
Source Field Internal Field Target Field So urc e
Ty pe
Targ et
Typ e 1
Tar get
Typ e 2
Comments
msExchMessageHygiene
SCLDeleteThreshold msExchMessageHygiene
SCLDeleteThreshold msExchMessageHygiene
SCLDeleteThreshold any any msExchMessageHygiene
SCLJunkThreshold msExchMessageHygiene
SCLJunkThreshold msExchMessageHygiene
SCLJunkThreshold any any msExchMessageHygiene
SCLQuarantineThreshol d msExchMessageHygiene
SCLQuarantineThreshol d msExchMessageHygiene
SCLQuarantineThreshol d any any msExchMessageHygiene
SCLRejectThreshold msExchMessageHygiene
SCLRejectThreshold msExchMessageHygiene
SCLRejectThreshold any any msExchModerationFlags msExchModerationFlags msExchModerationFlags any any msExchPoliciesExcluded msExchPoliciesExcluded msExchPoliciesExcluded any any msExchPoliciesIncluded msExchPoliciesIncluded msExchPoliciesIncluded any any msExchProvisioningFlag s msExchProvisioningFlag s msExchProvisioningFlag s any any msExchRecipientDisplay
Type msExchRecipientDisplay
Type msExchRecipientDisplay
Type any any This mapping is ignored and msExchRecipi entDisplayTy pe is set to 6 when the profile is set to sync users as Mail-
Enabled
Users or
Disabled
Mail-Enabled
Users, or the
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 107
Source Field Internal Field Target Field So urc e
Ty pe
Targ et
Typ e 1
Tar get
Typ e 2
Comments
msExchRecipientTypeDe tails msExchRecipientTypeDe tails msExchRecipientTypeDe tails any any profile is set to sync users
“As-Is” and the object in the source is
Mailbox-
Enabled.
This mapping is ignored and msExchReci pientTypeD etails is set to 128 when the profile is set to sync users as
Mail-
Enabled
Users or
Disabled
Mail-
Enabled
Users, or the profile is set to sync users
“As-Is” and the object in the source is
Mailbox-
Enabled. msExchRequireAuthToS endTo msExchRequireAuthToS endTo msExchRequireAuthToS endTo any any
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 108
Source Field Internal Field Target Field So urc e
Ty pe
Targ et
Typ e 1
Tar get
Typ e 2
Comments
msExchResourceCapacit y msExchResourceCapacit y msExchResourceCapacit y any any msExchResourceDisplay msExchResourceDisplay msExchResourceDisplay any any msExchResourceMetaDa ta msExchResourceMetaDa ta msExchResourceMetaDa ta any any msExchResourceSearchP roperties msExchResourceSearchP roperties msExchResourceSearchP roperties any any msExchSafeRecipientsH ash msExchSafeRecipientsH ash msExchSafeRecipientsH ash any any msExchSafeSendersHas h msExchSafeSendersHas h msExchSafeSendersHas h any any msExchTransportRecipie ntSettingsFlags msExchTransportRecipie ntSettingsFlags msExchTransportRecipie ntSettingsFlags any any msExchUMDtmfMap msExchUMDtmfMap msExchUMDtmfMap any any msExchUMSpokenName msExchUMSpokenName msExchUMSpokenName any any msExchUserCulture msExchVersion name
O msExchUserCulture msExchVersion
Name
O msExchUserCulture msExchVersion name
O any any any any any any any any
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 109
Source Field
objectGUID
Internal Field Target Field
AdminDisplayName adminDisplayName
So urc e
Ty pe
Targ et
Typ e 1
Tar get
Typ e 2
Comments
any any otherFacsimileTelephon eNumber
OtherFacsimileTelephon eNumber otherFacsimileTelephon eNumber any any otherHomePhone otherIpPhone otherMobile
OtherHomePhone
OtherIpPhone
OtherMobile otherHomePhone otherIpPhone otherMobile any any any any any any otherPager otherTelephone pager personalPager personalTitle
Photo
OtherPager
OtherTelephone
PagerNumber
PersonalPager
PersonalTitle
Photo physicalDeliveryOfficeNa me
Location pOPCharacterSet pOPContentFormat postalAddress
POPCharacterSet
POPContentFormat
PostalAddress otherPager otherTelephone pager any any any any any any personalPager personalTitle
Photo any any any any any any physicalDeliveryOfficeNa me pOPCharacterSet pOPContentFormat postalAddress any any any any any any any any
Important, particularly for printers.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 110
Source Field Internal Field Target Field So urc e
Ty pe
Targ et
Typ e 1
Tar get
Typ e 2
Comments
any any postalCode postOfficeBox
OfficeZip
PostOfficeBox postalCode postOfficeBox any any preferredDeliveryMetho d
PreferredDeliveryMetho d preferredDeliveryMetho d any any primaryInternationalISD
NNumber
PrimaryInternationalISD
NNumber primaryInternationalISD
NNumber any any primaryTelexNumber PrimaryTelexNumber primaryTelexNumber any any proxyAddresses ProxyAddresses any any roomNumber sAMAccountName
RoomNumber
SAMAccountName roomNumber sAMAccountName any any showInAdvancedViewOn ly
ShowInAdvancedViewO nly showInAdvancedViewOn ly any any any any
The following restricted chars will be replaced with underscores:
, + " < > ; = / [ ]
: | * ? \ sn LastName sn st OfficeState st any any Sometimes used as surname. any any
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 111
Source Field Internal Field Target Field So urc e
Ty pe
Targ et
Typ e 1
Tar get
Typ e 2
Comments
any any street streetAddress thumbnailLogo thumbnailPhoto *
Street
OfficeStreetAddress
ThumbnailLogo
ThumbnailPhoto * street streetAddress thumbnailLogo thumbnailPhoto * any any telephoneAssistant telephoneNumber
TelephoneAssistant
OfficePhoneNumber telephoneAssistant telephoneNumber any any any any terminalServer TerminalServer terminalServer any any textEncodedORAddress TextEncodedORAddress textEncodedORAddress any any any any any any title unauthOrig
JobTitle
UnauthOrig title unauthOrig any any any any url userCert userCertificate userPrincipalName
WebSite
UserCert
UserCertificate
UserPrincipalName url userCert userCertificate userPrincipalName any any any any any any any any userSMIMECertificate UserSMIMECertificate userSMIMECertificate any any wWWHomePage WWWHomePage wWWHomePage any any
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 112
Source Field
managedBy groupType
Internal Field
ManagedBy
GroupType
Target Field
groupType
So urc e
Ty pe
Targ et
Typ e 1
Tar get
Typ e 2
Comments
gro up grou p con tact gro up grou p
* thumbnailPhoto values are synced directly from the Source to the Target.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 113
Appendix B. Customizing Overrides
To add a View Override:
1. From the Mapping tab, click Overrides. The View Overrides window appears.
2. Click Add. The Override dialog appears.
3. Select a Person or Groups from the View drop-down list.
4. Enter a Field Name for the new override. This must be a valid internal field name in SQL.
5. Enter a Field Value for the new override. This must be a correctly formatted SQL statement.
6. Enter Comments for the new override.
7. Click Save.
8. Click Yes for the confirmation message.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 114
When you save an override, SMART Directory Sync re-generates the Person or Groups view. It does this by dynamically generating a single SQL statement using the snippet of SQL code that is part of all overrides. The max size for this SQL statement is 8000 total characters. If many new overrides are added, this limit could be exceeded and an error when adding the overrides will occur. In addition to the default overrides, approximately 15-20 more Person and 20-25 Group overrides can be added before hitting the size limit.
To edit a mapping override:
1. From the Mapping tab, click Overrides. The View Overrides window appears.
2. Select an Override and click Edit. The Override dialog appears.
3. Edit the Field Value for the override. The View and Field Name cannot be edited.
4. Edit Comments for the override.
5. Click Save.
6. Click Yes for the confirmation message.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 115
To delete a mapping override:
1. From the Mapping tab, click Overrides. The View Overrides window appears.
2. Select an Override and click Delete.
3. Click Yes for the confirmation message.
Controlling actions with Overrides
SMART Directory Sync uses the TypeOfTransaction column from the BT_Person table, or the Operation column from the BT_Groups table to determine what action to perform on the target object. These may have overrides applied to them, to control what actions Directory Sync will take for an object. The below image shows an example of this kind of override.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 116
Matching user accounts with Overrides
The values used for matching can have overrides applied to them. This is accomplished by setting up a new override using the field names MatchValue1, MatchValue2, MatchValue3 and MatchValue4. Each MatchValue1-4 corresponds the respective Source and Target pair on the matching tab.
These values are used for matching only. Values that get written to the target are based on the mappings, not the matching.
Example Overrides
Field Name Field Value Description
TargetAddre ss
CASE EntryType WHEN 'user' THEN 'SMTP:' + P.BTCustom020 +
'@domino.contoso.com' ELSE 'SMTP:' + dbo.ReplaceDomain(InternetAddress,'domino.contoso.com') END
This formula will dynamically set the targetaddress value based on the
EntryType.
TargetAddre ss
'SMTP:' + dbo.UpdateInternetAddress(InternetAddress,'domino.') This formula will set the TargetAddress value based on the
InternetAddress and prefix the domain with the
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 117
Field Name Field Value Description
TargetAddre ss
' 'SMTP:' + dbo.ReplaceDomain(InternetAddress,'domino.contoso.com') value specified, in this case "domino.".
This formula will set the TargetAddress value based on the
InternetAddress and replace the domain with the value specified, in this case
"domino.contoso.co
m".
TargetAddre ss
CASE WHEN InternetAddress LIKE '%@kodak.com' THEN 'smtp:' + dbo.UpdateInternetAddress(P.InternetAddress, 'domino.') WHEN
InternetAddress LIKE '%@knotes.contoso.com' THEN 'smtp:' + dbo.ReplaceDomain(P.InternetAddress, 'domino.contoso.com')
ELSE P.InternetAddress END
This formula will dynamically set the targetaddress value based on the existing
InternetAddress domain name value.
If the first domain is found then the
TargetAddress will be set to one value, if the second domain is found another value will be used and if neither domain is found then the
TargetAddress will be set the same as the current
InternetAddress value.
CommonNa me
CASE EntryType WHEN 'user' THEN 'do$$' + SourceDirectoryID
WHEN 'sharedmail' THEN 'do$$' + SourceDirectoryID ELSE
CommonName END
This formula will dynamically set the
CommonName
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 118
Field Name Field Value Description
CommonNa me
CASE WHEN LEN(CommonName) > 64 THEN
LTRIM(RTRIM(LEFT(CommonName,64))) ELSE CommonName
END value based on the
EntryType.
This formula will limit the
CommonName value to 64 characters if it exceeds that limit.
ProxyAddres ses
CASE ProxyAddresses WHEN '' THEN 'smtp:' + dbo.ReplaceDomain(InternetAddress,'@contoso.mail.onmicrosoft.
com;smtp:') + dbo.UpdateInternetAddress(InternetAddress,'domino.') ELSE
ProxyAddresses + ';smtp:' + dbo.ReplaceDomain(InternetAddress,'@contoso.mail.onmicrosoft.
com;smtp:') + dbo.UpdateInternetAddress(InternetAddress,'domino.') END
This formula will set or append to the list of ProxyAddresses values the coexistence routing addresses. This example specifically is designed for
Office 365.
Company LTRIM(RTRIM(LEFT(company, 50)))
BTCustom0X
X
"this is a string"
This formula will
Trim, then limit the string value by 50 characters.
This formula will set any string value to the any SQL field.
BTCustom0X
X
REPLACE(InternetAddress,'@','.') This formula will replace the '@' symbol with a period '.' to create a string like so. (i.e. first.last.contoso.co
m)
BTCustom0X
X
LEFT(InternetAddress,CHARINDEX('@',InternetAddress)-1) This formula will extract the localpart of InternetAddress.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 119
Appendix C. Cutover Job Result Codes
2048
4096
8192
16384
32768
65536
131072
262144
Cutover Job Result Codes
Result
Code
64
128
256
512
4
8
1
2
16
32
1024
Error
Unidentified Error - PowerShell Command Error
Source Domain could not be contacted
Bad Source Credentials
Target Domain could not be contacted
Bad Target Credentials
Target DNS Server could not be contacted or could not resolve the target
DNS domain
Change Obtain DNS by DHCP
Set DNS Server IPs
Set WINS Servers
Register NIC with DNS
Clear DNS Suffix Search List / Set to use NIC
Set Alternate DNS Suffix List
Enable Dynamic DNS Registration
Set NIC Specific DNS Suffix
Domain Disjoin Failed
Domain Join Failed
Source domain name does not match the system's domain No
Computer Reboot failed
Target Domain Name could not be resolved via existing DNS, and new DNS
Servers were not provided
No
No
No
No
No
No
No
Rollback
Possible
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 120
An odd number result codes represents an error running the Cutover PowerShell script. The most common cause of an odd numbered result code during cutover is that the device either has no network card with default gateway or more than one network card with a default gateway.
Result codes are additive. There are likely multiple errors if the result code is not represented in the table.
Upload Logs Result Codes
This table includes result codes for BT-UploadLogs PowerShell jobs.
Error
32
Result
Code
(zip folder) could not be created.
64
128
Failed to Zip log files on device.
Upload failed to contact the server. Please verify the URL (url) is correct and BITS is enabled.
No
Rollback
Possible
No
No
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 121
Appendix D. SMART Active Directory Reporter
Overview
SMART Active Directory Reporter (AD Reporter) provides a query-based interface that allows network administrators and IT personnel to easily build custom queries for issues specific to their network.
AD Reporter queries Windows 2003/2003 R2/2008/2008 R2/2012 Active Directories across forests from a central console, allowing you to perform customized searches by domain, object, object property and by using wildcards. AD
Reporter search results can be set to any or all object properties.
Installing AD Reporter
To install AD Reporter:
1. Open the zip file and then launch the Setup.exe.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 122
2. Select the Install SMART Active Directory Reporter Software checkbox and click Install.
3. Select the Installation Drive and Path and click on Select.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 123
4. Wait for installation to complete.
Uninstalling AD Migrator
To uninstall AD Reporter:
1. Select Uninstall from the Start menu.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 124
2. Click on OK to continue with the uninstall.
3. Select ADReporter and click on OK
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 125
4. Click on Exit when the uninstall is complete.
Opening AD Reporter
To open AD Reporter:
1. Click Start, click Binary Tree, click the AD Migrator Suite folder and then right-click on the AD Reporter icon and select to Run as administrator.
Setting the screen size
You can change the size of the AD Reporter application to better fit your screen.
To set the screen size:
1. On the Configuration menu, click Set Screen Size.
2. In the Screen Size Options, select a screen size resolution.
3. Click OK.
4. Close and reopen the application to view the application in the selected size.
Configuring AD Reporter
Configuring AD Reporter requires you to define one or more active directory domains and select the current active directory domain to search.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 126
To configure AD Reporter:
1. On the Configuration menu, click Add Active Directory Domain.
2. In the Domain Configuration Wizard, enter the domain NetBIOS name in the Active Directory Domain
NetBIOS in Upper Case field, and then click Verify.
3. Click Add.
4. On the Configuration menu, click Set Current Active Directory Domain.
5. Select the current active domain to search, and then click OK.
Searching
To search:
1. Click the type of object to search for from the Object Type list. The list includes: o Domain o User o Group o Organizational Unit (OU) o Computer o Print Queue o Volume (Shared Folders) o Contact o Exchange (user properties)
2. Select the property to search for from the Search For list.
3. Select one or more properties to return in the results from the Return results list. Use Ctrl-Click or Shift-Click to select more than one property to return.
4. Click Begin Search. You can also click Search Active Directory on the Active Directory Search and Report menu.
5. In the Narrow Search Option window, enter known property information to narrow the search criteria.
Wildcards can be used in the search criteria. The default "All" will search for all of the instances of the selected property.
6. Click OK. The results are displayed.
If results appear to take a long time to retrieve, DNS server may not be properly configured, there may be broken trust relationships – the domain AD Reporter is querying is not reachable, or the account or proxy account may not have adequate rights to the domain being queried (check user rights).
Results
Viewing results
To view results:
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 127
o In the results list, click a column header to sort by the column. o Click and drag the column headers to increase the width of each column. o Use the scroll bars to view information that is not displayed in the window.
Saving results as a text file
To save results as a text file: o On the File menu, click Save Search Results as Text File. The results file is saved in the ADReporter\Reports folder.
If you have searched for a large amount of information, we recommend you save results as an MS Excel file as the text file does not have columns. Once you save the results as an MS Excel file, you can easily format the columns to a more readable format.
Viewing and managing results saved as a text file
To view and manage results saved as a text file:
1. On the View and Manage Saved Results menu, click View and Manage Text File Reports.
2. In the AD Reporter Manage Reports window, select a report and click View to view the file. You can also click
Delete to remove the file.
Printing results
To print results:
1. On the File menu, click Print Search Results.
2. Select a printer and then click Print.
Exporting results as an Excel file
To export results as Excel file:
1. On the File menu, click Export Results as MS Excel File.
2. Enter a name for the file, and then click OK. The results file is saved in the ADReporter\Reports folder.
Viewing and managing results exported as an Excel file
To view and manage results exported as an Excel file:
Excel must be installed.
1. On the View and Manage Saved Results menu, click View Saved Microsoft Excel File.
2. In the Saved Reports window, select a report and click Open to view the file in Excel.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 128
Advanced Options
Editing Object Properties
To edit object properties:
1. On the Advanced Options menu, click Edit Object Properties.
2. In the AD Reporter Advance Properties window, select an object type to modify and then click Modify.
3. To remove an object property, select the property and click Remove. To add an object property, enter the property name and click Add.
Added properties must exist, are case-sensitive, and must be populated to return information.
4. Select the object property to update the list of object properties.
Backing up and restoring Object Properties
To back up and restore Object Properties:
1. On the Advanced Options menu, click BackUp/Restore Object Properties, and then select one of the following options: o BackUp Current Object Properties – backs up current object properties to a .zip file at the installation location o Restore Default Object Properties – restores the default object properties o Restore Object Properties From BackUp – restores the object properties from the saved back up
2. Click OK.
3. Select the Object Property to update the list of object properties.
AD Report Tools
Convert Raw Active Directory Data to Textual Format
To convert Raw Active Directory Data to textual format:
1. Create a report that includes results in Raw data format (SID, GUID, LogonHours, Date, GroupType).
2. In the results list, double-click the searched for object property.
3. In the Select Item to Send to Clipboard list, select the raw data to convert from the list and then click OK.
4. On the AD Report Tools menu, click Convert Raw Active Directory Data to Textual Format.
5. In the Conversion window, select the conversion type for the raw data on your clipboard and then click OK.
6. Right-click and select Paste. The raw data is inserted.
7. Click OK. The converted data is displayed.
Get all current object properties by Object Type
To get all current object properties by object type:
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 129
1. On the AD Report Tools menu, click Get All Current Object Properties by Object Type.
2. Select an object type and then click OK.
3. Select one or more properties to add to AD Reporter and click OK.
4. The AD Reporter Available Properties window appears with the selected properties added to the list of properties. You can also remove or add properties on this screen.
5. Click Close to close the window.
Active Directory Reports
AD Reporter includes several predefined reports allowing quick searches for frequently used information. o On the Active Directory Reports menu, point to user Reports, group Reports, or computer Reports, and then click a report. The search results appear. o On the Active Directory Reports menu, click Generate User Mapping File to generate a list of unmatched sAMAccountName values on the Source and Target based on the input of a matching attribute.
Active Directory Reports include:
User Reports o Disabled users – all users with the Account Status = “Account Disabled” o User never logged on – all users with the Logon Status = “0” (zero) or blank o All users without an email address – all users with the Email Status = “No email address” o Duplicate Source and Target Users – duplicate same-named user accounts in the source and target. At least two domains must be configured to run this report.
Group Reports o Groups with no members – all groups with the Membership Status= “no group members” o All security groups – all security groups with Group Type value displayed o All distribution groups – all distribution groups with Group Type value displayed o Duplicate Source and Target Groups – duplicate same-named group accounts in the source and target. At least two domains must be configured to run this report.
Computer Reports o All XP computers – All XP computers with Computer Type value displayed o All Vista computers – All Vista computers with Computer Type value displayed o All Windows 7 computers – All Windows 7 computers with Computer Type value displayed o All Windows 8 computers – All Windows 8 computers with Computer Type value displayed o All Windows 2000 Servers-Workstations – All Windows 2000 Servers-Workstations with Computer Type value displayed o All Windows 2003 Servers – All Windows 2003 Servers with Computer Type value displayed o All Windows 2008 Servers – All Windows 2008 Servers with Computer Type value displayed
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 130
o All Windows 2008 R2 Servers – All Windows 2008 R2 Servers with Computer Type value displayed o All Windows 2012 Servers – All Windows 2012 Servers with Computer Type value displayed o All Computers without a description - All Computers with the Computer Description = “No Description”
Generate User Mapping File
The User Mapping File is a list of unmatched sAMAccountName values on the Source and Target based on the input of a matching attribute.
If using an attribute to link the source and target user accounts together, ensure that the values of the attribute on the
Source are unique so there are not multiple matches generated. If the values of the attribute on the Target are not unique, the report will throw an error and will not allow the creation of the UsersMapping.map file at the end of the process.
To generate a User Mapping File:
1. On the Active Directory Reports menu, click Generate User Mapping File.
2. Select a Source Domain and click OK.
3. Select a Target Domain and click OK.
4. Enter the LDAP name of the AD attribute you want the accounts to match on and click OK. The matching results appear.
5. Click Yes to create a mapping file from the results. A mapping file cannot be created if one or more of the results have multiple target matches.
AD Reporter Best Practices
Check Access Rights o You must be logged on to a Windows 2003/2008/2012 Domain. If you are not logged on to a Windows
2003/2008/2012 Domain, you cannot connect to Active Directory to set AD object attributes. o If you are searching a single domain, you must have Domain Admin rights to the domain. o If you are searching domains and child domains, you must have Enterprise Admin rights to the domain tree. o Ensure that non-existent or broken trusts relationships do not exist. If there are non-existent or broken trust relationships, AD Reporter will attempt to query non-existent domains, slowing the search.
To Query Share Information
When Querying Share (Volume) information, Shares must be published to Active Directory. AD Reporter searches Active
Directory information, not computer information; if the Shares are not published to Active Directory, AD Reporter will not retrieve results.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 131
Appendix E. Advanced Network Requirements
SMART Active Directory Migrator Port Requirements
Source
AD Migrator Web Service
AD Migrator Console
Client servers and workstations
Target
SQL Server holding primary database
SQL Server holding primary database
AD Migrator Web Service
1433
1433
Ports
80 or 443
(Configurable)
Protocol
TCP &
UDP
TCP & UDP
TCP
SMART Directory Sync to SQL Server Access
Source
Directory Sync
Directory Sync
Target
SQL Server holding the primary database
SQL Server holding the logging database
Ports Protocol
1433 TCP & UDP
1433 TCP & UDP
SMART Directory Sync Profile Specific Scenario Requirements
Directory Sync Match Only or Update Only Profile (no object creation)
Source
Directory Sync
Target
Source Domain controllers
Ports
389, 445*, 3268
Protocol
TCP (all)
UDP (389)
Directory Sync Target Domain controllers 389, 445, 3268
TCP (all)
UDP (389)
* Port 445 only needs to be open to the Source Domain Controller during Directory Sync Profile creation
Directory Sync Profile with Create Only or Create/Update Matching Option
Source
Directory Sync
Target
Source Domain controllers
Ports
389, 445*, 3268
Protocol
TCP (all)
UDP (389)
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 132
Source
Directory Sync
Target
Target Domain controllers
Ports
139, 389, 445, 3268
Protocol
TCP (all)
UDP (389)
* Port 445 only needs to be open to the Source Domain Controller during Directory Sync Profile creation
Directory Sync Profile with Synchronize Passwords selected
Source
Directory Sync
Target
Source or Target Domain controllers
Ports
139, 389, 445, 3268
Protocol
TCP (all)
UDP (389)
Directory Sync Profile with SID History Synchronization selected
Source
Directory
Sync
Target
Source or Target Domain controllers running
Windows 2008 or newer
Ports
135, 137, 139, 389, 445, 3268 and 49152-65535
Protocol
TCP (all)
UDP
(389)
Directory
Sync
Source or Target Domain controllers running
Windows 2003
135, 137, 139, 389, 445, 3268 and 1024-5000
TCP (all)
UDP
(389)
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 133
Appendix F. SMART AD Migrator SQL Repermission
Use the SMART AD Migrator SQL Re-permission utility to update a SQL Server’s Source AD Windows Authentication
Group Login permissions and their associated database users for the Target domain the user and group objects have been migrated to.
Prior to re-permissioning SQL servers, accounts must be migrated and Mapping Files created using SMART Active
Directory Migrator.
1. Download the Binary Tree SQL Repermission.msi file from the FTP location provided.
2. Run the installer on the SMART Active Directory Migrator server or any machine that will have access to the SQL
Server instance and databases to be re-permissioned.
3. The Welcome screen appears. Click Next to continue.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 134
4. The Ready to Install screen appears. Click Install to begin the installation.
5. When the installation completes, the InstallShield Wizard Complete message appears. Click Finish to close the wizard.
6. Copy the map.usr and map.gg files created using SMART Active Directory Migrator to a folder on the same machine.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 135
7. Launch the SQL Repermission utility from the Start menu.
8. Select the SQL Logon Method. If SQL Server Authentication is selected, enter the Username and Password. If
Windows Authentication will be used, you must be logged onto the machine with an account that has access to the SQL Server instance and databases to be re-permissioned.
9. Click on Browse to select the SQL Server instance to be re-permissioned.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 136
10. Select the SQL server instance from the list and click on OK.
11. Click on the Connect button. If connection is successful, the Logging message should read “SQL Server
Connected” and there should be databases available to pick from in the drop-down list.
Note: If the login information is incorrect, the following error will be received. The credentials to connect to the
SQL server instance should be corrected, and then the Connect should be retried.
12. Once successfully connected to the SQL server instance, in the drop down select either <ALL> or a specific database that needs to be re-permissioned.
13. Click on the Generate SQL button. If the Open script in Notepad option is left checked, the results will be displayed when completed.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 137
14. The Logging information will display the name of the SQL file created in the directory that the application is located.
15. If the option to open the file in Notepad was not checked, navigate to where the file was saved and right-click and choose Open with Notepad.
16. The results of the process can be reviewed prior to actually executing it on the SQL Server instance.
17. When the SQL file has been reviewed, either open the file in SQL Server Management Studio or create a new
Query in SQL Server Management Studio and copy/paste the contents of the file into the Query.
18. Execute the Query and the new target credentials will be created.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 138
Appendix G. Creating Linked Exchange Account
This process supports customers that require completing their AD migration before their Exchange migration by creating a linked Exchange account. This allows users to log into their mailbox that still resides in the source Domain, using their target credentials.
After an account has been migrated, the device reACL’d and cutover to the target, follow the next steps in order to link the target account to the Exchange mailbox still residing in the source.
In AD Migrator Console:
1. Run the action on the migrated accounts “Enable on Target/Disable on Source”.
2. Execute Sync in AD Migrator for that Dirsync Profile.
3. Run the “Mark as Migrated” action on the above user accounts.
4. Filter on the “Migrated” column as “True” and verify only the accounts to be actioned are in the grid.
5. Export the AD Migrator Grid to a CSV.
In SMART Directory Sync, on the Exchange Target Options tab, make sure the “Allow Enable/Disable of Mailbox
Enabled Source Object” option is set to “Yes”.
On the Source Exchange server:
1. Download the script file to a local directory and rename BT-ConvertMBX-to-Linked.ps1. The script can be obtained by contacting [email protected]
.
2. Copy the updated CSV created from export of the AD Migrator grid to the same local directory.
3. Run the following Exchange PowerShell command – replace red date with actual data .
.\BT-ConvertMBX-to-Linked.ps1 –InputCsvPath c:\temp\Export.csv
–OutputFolder c:\temp\outputlog –
SourceDomainDC E2E-DC1.DOM1.E2E.dom
–SourceDomainGC E2E-DC1.DOM1.E2E.dom
–TargetDomainController
QA-E2E-DC1.QA-Dom1.QA-E2E.dom
Results:
Log output will also be created in the directory specified in the PowerShell command.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 139
Verification:
Check the following AD attributes:
1. msExchMasterAccountSid of the source account should contain the target account objectSID value.
2. Check that the legacyExchangeDN on the both the source and target account has not changed.
Check mailbox using Outlook
1. Log in to device using target account.
2. Launch Outlook.
3. Outlook should launch without prompting for credentials (should us pass-through authentication).
4. Check that any additional proxyaddress’ are still present on the source user mailbox.
5. Spot check in Outlook for the retention of signatures, tool bar edits, etc.
Additional:
Once all of the above has been completed and verified, migrate the mailbox to the target Exchange and verify that it is still accessible.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 140
About Binary Tree
Binary Tree provides organizations with the most direct and predictable path to a successful technology transformation.
We offer software and services to integrate and migrate corporate email, directory and server environments. Our technology, methodology and expertise is uniquely suited to provide fast and manageable migrations, with low risk, little to no user downtime, and adapted to each customer’s environment and requirements. Since 1993, Binary Tree has enabled thousands of enterprise customers to migrate more than 35 million email users and facilitated some of the most complex technology transformations on the planet. Binary Tree is a Microsoft Gold Partner and a globally preferred vendor for Microsoft Office 365 migrations and solutions. The Company is headquartered outside of New York City with offices in Hong Kong, London, Paris, Stockholm and Sydney. For more information, visit us at www.binarytree.com
.
Binary Tree Social Media Resources
© Copyright 2016, Binary Tree, Inc. All rights reserved.
The Binary Tree logo and The SMART Migration Company tagline are registered trademarks, plus any references of Binary Tree, SMART Migration, or
Binary Tree’s software or services, are trademarks, of Binary Tree, Inc. All other trademarks are the trademarks or registered trademarks of their respective rights holders.
SMART ACTIVE DIRECTORY MIGRATOR 9.2 USER GUIDE 141
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
Complete migration
Minimal downtime
Provides coexistence
Synchronization of AD objects
Safe with ability to recover original state
Flexible migration
Highly customizable
Synchronizes SID history
Ability to copy passwords
Highly conducive for migration of workstations in a distributed workforce
Frequently asked questions
SMART Active Directory Migrator is a software solution that seamlessly migrates Active Directory objects, settings and properties to a new or existing Active Directory environment.
The key features include: complete migration, minimal downtime, provides coexistence, synchronization of AD objects, safe with ability to recover original state, flexible migration, highly customizable, synchronizes SID history, ability to copy passwords, and highly conducive for migration of workstations in a distributed workforce.
The system requirements can be found in the documentation.
The installation instructions can be found in the documentation.
The user guide provides detailed instructions on how to use the software.
SMART Active Directory Migrator can be used for a variety of migration scenarios, such as acquisitions, mergers, divestitures, or simply as part of rebuilding an existing Active Directory.
SMART Directory Sync is the back-end engine that powers SMART Active Directory Migrator. It synchronizes objects between source and target Active Directory domains.
