Home / server / Questions / 69825
Accepted
Neobyte
Asked: 2009-09-30 20:16:42 +0800 CST

Intraforest user account merge with Active Directory

  • 772

I have a scenario where there is a root domain (RD) and two child domains (CD1 and CD2). Users have accounts on both CD1 and CD2, with identical samAccountNames, names etc, and various applications either use the CD1 or CD2 account for authentication to resources.

I need to collapse CD2 into CD1, so I want to merge the accounts together. However ADMT does not allow me this option (merge options are greyed out), I think because it does not support intraforest merge of accounts (although it does not explicitly state this anywhere in the documentation).

My question is - what is the easiest way for me to merge these accounts? Ultimately all I really need (I think) is for the SID of CD2\user1 to be added to the SIDHistory of CD1\user1 - is there a tool that supports this?

Computer accounts and profiles are not a concern for this scenario. Group migration is unlikely to be an issue either - CD2\user1 is usually granted resource access through membership of a group on CD1.

windows

2 Answers

  1. Have a look at the ADMT 3.1 migration guide:

    When you restructure Windows Server 2008 domains in a Windows Server 2008 forest, you can consolidate your domain structure and reduce administrative complexity and overhead. Unlike the process for restructuring Windows Server 2008 domains between forests, when you restructure domains in a forest, the migrated accounts no longer exist in the source domain. Therefore, rollback of the migration can only occur when you carry out the migration process again in reverse order from the previous target domain to the previous source domain.

    Important : All target domains must be operating at either the Windows 2000 native functional level, the Windows Server 2003 functional level, or the Windows Server 2008 functional level. The following table lists the differences between an interforest domain restructure and an intraforest domain restructure.

    Could it be that your child domains are not in native mode?

    • 1
  2. Best Answer

    The simple answer to this question was, you can't do an intra-forest merge. We ultimately resolved the issue by creating a temporary external forest, using ADMT to migrate an account from CD1 to that forest, and then migrated it back into CD2.

    Clunky, but it worked.

    • 0