Configures database administration roles and preferred domain controllers for Active Directory domain migrations.
The admt config command-line tool is available in the Active Directory Migration Tool (ADMT). To run admt config, at an elevated command prompt, type admt config with the appropriate parameters, and then press ENTER. For help, type admt config <task> /?.
For examples of how to use this command, see Examples.
Syntax
admt config setdatabase /{s|server}:<server_name> admt config getdatabase admt config getrolemembers admt config addrolemembers [/{r|role}:<RoleName>] [/a|account:<AccountName>] admt config removerolemembers [/{r|role}:<RoleName>] [/a|account:<AccountName>] admt config getdomaincontrollers admt config cleardomaincontrollers /Domain:<DomainName> admt config setdomaincontroller /Domain:<DomainName> /{sdc|tdc}:<DomainController> admt config logging [/{la|logattributes}: {yes|no}]
Parameters
- /r:"<RoleName>"
- Specifies the name of the security group that performs a database administration role.
- /a:"<AccountName>"
- Specifies the name of a domain user account. The form of the name should be domain\user.
- /Domain:"<DomainName>"
- Specifies the name of an Active Directory domain.
- /{sdc|tdc}:"<DomainController>"
- Specifies the computer name for a domain controller that has
one of the following options:
- /sdc
Specifies that the domain controller is in the source domain.
- /tdc
Specifies that the domain controller is in the target domain.
Note Read-only domain controllers (RODCs) are not permitted to be used as either the source or target domain controller in migration operations.
- /sdc
Remarks
Configuring database administration roles
You can use database administration roles to assign a subset of permissions to users who perform specific migration tasks. ADMT has the following database administration roles:
- Account migrators:
Perform tasks that are associated with account migrations, such as user and group migrations.
- Resource migrators:
Perform tasks that are associated with resource migrations, such as computer migrations and security translations. Account migrators also hold the role of resource migrators.
- Data readers:
Perform queries against the database. Account migrators and resource migrators also hold the role of data readers.
Users who hold the role of Microsoft SQL Server administrator hold all ADMT database administration roles. They have permissions to display database roles and the users who hold those roles, add groups or users to those roles, and remove groups or users from those roles. By default, ADMT assigns the role of administrator to the local Administrators group, which can perform all ADMT database functions.
Configuring preferred domain controllers
ADMT provides the option for an administrator to select the source and target domain controller to use for a migration instead of having domain controller Locator (DC Locator) select those controllers.
To use a preferred domain controller, you use the admt config command to configure it. You must configure source and target domain controllers independently. After you configure a preferred domain controller, ADMT determines its validity and availability and then uses it automatically every time that you run ADMT.
Examples
The following example lists all database roles and the members that ADMT assigned to each role.
admt config getrolemembers
The following example adds a role member (JohnSmith from the CONTOSO domain) to the account migrators role.
admt config addrolemember /r:"Account Migrators"
/a:CONTOSO\JohnSmith
The following example removes a role member (JohnSmith from the CONTOSO domain) from the account migrators role.
admt config removerolemember /r:"Account
Migrators" /a:CONTOSO\JohnSmith
The following example configures a preferred domain controller (DC1) for the source domain that you specify (CONTOSO).
admt config setdomaincontroller /Domain:CONTOSO /sdc:DC1
The following example configures a preferred domain controller (DC2) for the target domain that you specify (TREYRESEARCH).
admt config setdomaincontroller /Domain:TREYRESEARCH /sdc:DC2
The following example clears the preferred domain controllers that you configured previously for the CONTOSO domain.
admt config cleardomaincontrollers
/Domain:CONTOSO
The following example displays the preferred domain controllers that you configured.
admt config getdomaincontrollers
The following example displays the logging level that you configured.
admt config logging
The following example configures verbose logging for all user, computer, and group objects that you want to migrate in an interforest migration. (An example of verbose logging is logging all attributes.)
admt config logging /la:yes