migrating the account with SIDhistory won't help you here
=> it's not the User's (and his respective NT4 SID) that is added to the
local admin group on all member servers and clients by default - it's the SID of
the NT4 Domain Admins group itself. When migrating the user with SIDhistory,
you're not adding the SID of this group to the user.
One option (which I certainly don't like - just trying to
explain for you) is to merge the Domain Admins group from the NT4 Domain into
the Domain Admins group of AD incl. SID history. But I'm not a friend of
doing this - I much preferr to add an appropriate AD group to the respective
servers' local admin group (and clients if required). This must not
necessarily be the AD Domain Admins group => it's your chance to get some
structure in the permission model on your servers...! The domain admin
will be added anyways, once you migrate the machines acrross to
AD.
But if everything has to be done quickly (as is often the
case), you can also use ADMT to add the Domain Admins to all your servers for
you: to do so, create an appropriate SID mapping file containing just the NT4
Domain Admins group + SID and AD Domain Admins group + SID and choose
to perform a security translation in ADD mode on all your servers in the source
domain. This will add the AD Domain Admins to the local admin group on the
target machines and give them the same permissions on files/shares/registry
etc. (if there are any specific ones set for the NT4 domain admins
group).
/Guido
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chandra Burra
Sent: Mittwoch, 11. Januar 2006 20:59
To: [email protected]
Subject: Re: [ActiveDir] NT and AD Permissions
Jorge and Glen,
Thanks for the quick update...
I will breif here the steps i have taken...
1. This is a domain admin account which is being used from last 2years in
NT
2. I have migrated this using the Bindview BV Admin with SID
3. I have taken the option to cancell the migration if the SID fails...so,
the SID is in the new domain
4. Added this account to the Domain admin group manually as we wont move
the group from NT
5. The account in the source domain is still active.
Still no luck.,...not sure if this is the only tricky thing.....i have
another account which i can test...do you want me to do something
different??
Regards
Chandra
On 1/11/06, Almeida
Pinto, Jorge de <[EMAIL PROTECTED]>
wrote:
yes... that is a solution (don't forget to clean it when not needed anymore!). however, when using ADMT it will not be possible to migrate domain admins with sid history. ADMT will prevent that
As most of the times the domain admins group of an NT4 domain is populated will al kinds of accounts, do not migrate the membership of the domain admins group in the source to the target
Jorge
________________________________
From: [EMAIL PROTECTED] on behalf of Sitton Glen E
Sent: Wed 2006-01-11 20:33
To: [email protected]
Subject: RE: [ActiveDir] NT and AD Permissions
Hi Chandra,
When you migrated the NT4 domain-admin account to your AD domain, did you keep "sidHistory"? If the new AD domain-admin account has the sidHistory of the old NT4 domain-admin account, it should have no trouble exercising 'domain-admin' rights in the NT4 domain. It will, in effect, be masquerading as the NT4 domain-admin.
Look at the security token of your AD domain-admin account and see if the SID of the old NT4 domain-admin account is in there. If not, that's your problem. You need to migrate with sidHistory.
- G
________________________________
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] ] On Behalf Of Chandra Burra
Sent: Wednesday, January 11, 2006 12:32 PM
To: [email protected]
Subject: Re: [ActiveDir] NT and AD Permissions
yes it is.......and it was also domain admin in old NT domain.
On 1/11/06, Almeida Pinto, Jorge de <[EMAIL PROTECTED]> wrote:
is that account member of the Domain Admins in AD?
jorge
________________________________
From: [EMAIL PROTECTED] on behalf of Chandra Burra
Sent: Wed 2006-01-11 18:41
To: [email protected]
Subject: [ActiveDir] NT and AD Permissions
Hi,
we have a NT domain and a new 2003 AD domain....Migrated a domain admin account, but after migration, that account can not connect to admin shares like C$ or D$...... is there any quick fix..
I have the Domain Admins group on AD as a member of Local Administrators group on the NT Domain...is there something i am missing??
Thanks in advance...
Regards,
Chandra
This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
