Migrates group accounts for Active Directory domain migrations.

The admt group command-line tool is available in the Active Directory Migration Tool (ADMT). To run admt group, at the command prompt, type admt group with the appropriate parameters, and then press ENTER.

For examples of how to use this command, see Examples.

Syntax

admt group [options] /n "<GroupName1>" "<GroupName2>" {/sd:"<SourceDomain>" /td:"<TargetDomain>" | /o:"<OptionFilename>"}

Parameters

/n "<GroupName1>" "<GroupName2>"
Specifies the name of the group in the source domain and the target domain. You can specify the following values for this parameter:
  • GroupName1

    Specifies the name of the group in the source domain.

  • GroupName2

    Specifies the name of the group in the target domain.

/{sd|sourcedomain}:"<SourceDomain>"
Specifies the NetBIOS or Domain Name System (DNS) name of the source domain from which ADMT migrates objects.
/{td|targetdomain}:"<TargetDomain>"
Specifies the NetBIOS or DNS name of the target domain to which ADMT migrates objects.
/{o|optionfile}:"<OptionFilename>"
Specifies to use an options file. You can specify the following value for this parameter:
  • OptionFilename

    Specifies the name of the options file to use. This file contains a list of operations and parameters to use during the migration. You can specify only one option file name with the admt group optionfile command. To specify more than one options file name, list the parameter again for each additional option file.

/{if|intraforest}:{yes|no}
Specifies whether the migration occurs within a single forest. You can specify the following values for this parameter:
  • yes

    Specifies that the migration is within a single forest.

  • no

    Specifies that the migration is between forests. This is the default setting.

/{sdc|sourcedomaincontroller}:"<SourceDomainControllerName>"
Specifies the NetBIOS or DNS name of the domain controller in the source domain to use for object migration.
Note

Read-only domain controllers (RODCs) are not permitted to be used as the source domain controller.

/{tdc|targetdomaincontroller}:"<TargetDomainControllerName>"
Specifies the NetBIOS or DNS name of the domain controller in the target domain to use for object migration.
Note

Read-only domain controllers (RODCs) are not permitted to be used as the target domain controller.

/{so|sourceou}:"<OUName>"
Specifies the name of the organizational unit (OU) in the source domain. You can specify this parameter only for Active Directory source domains.
/{to|targetou}:"<OUName>"
Specifies the name of the OU in the target domain. This parameter is required for both interforest and intraforest migrations.
/{po|passwordoption}: {<complex>|copy} [+notexisting]
Specifies how ADMT sets the passwords of members of the group. This option is only in effect if the option to migrate group members (/mms) is also specified.
/{ps|passwordserver}:"<ServerName>"
Specifies the name of the source domain controller that hosts the Password Export Server (PES) service. This option is only in effect if the option to migrate group members (/mms) is also specified.You can specify the following value for this parameter:
  • ServerName

    Specifies the name of a source domain controller that hosts the PES service. Enclose the server name in quotation marks.

/{pf|passwordfile}: "<FileName>"
Specifies the path and name of the password file that ADMT creates. ADMT creates a password file only when you use the complex value with the /passwordoption command. This option is only in effect if the option to migrate group members (/mms) is also specified.You can specify the following value for this parameter:
  • FileName

    Specifies the path and name of the password output file. Enclose the entire path in quotation marks.

/{dot|disableoption}:{[disablesource+] enabletarget|disabletarget|<targetsameassource>}]
Determines which, if any, accounts to disable after migration.You can specify the following values for this parameter:
  • disablesource+

    Disables the accounts in the source domain after ADMT successfully migrates those accounts to the target domain.

  • enabletarget

    Enables the accounts in the target domain so that ADMT can use them immediately.

  • disabletarget

    Disables the target accounts after migration.

  • targetsameassource

    Matches the state of the target account to the state of the source account. This is the default setting.

/{sep|sourceexpiration}: {none|<Days>}
Defines the number of days that the source account is valid before it expires.You can specify the following values for this parameter:
  • none

    Specifies that the source account does not expire. This is the default setting.

  • Days

    Specifies the number of days (1 through 1095) that the system waits after the migration before it disables the source account.

/{mss|migratesids}: {yes|no}
Specifies whether the security identifier (SID) of the source account migrates to the SID history of the target account.You can specify the following values for this parameter:
  • yes

    Migrates the SID from the source account and adds the SID to the SID history of the target account.

  • no

    Does not migrate SIDs. This is the default setting.

/{trp|translateroamingprofile}: {yes|no}
Specifies whether to translate the roaming profile from the source account to the target account. This parameter also associates the target account with the roaming profile.You can specify the following values for this parameter:
  • yes

    Translates the roaming profile when ADMT migrates the account. This value associates the target account with the roaming profile.

  • no

    Does not translate the roaming profile when ADMT migrates the account. This is the default setting.

/{uur|updategrouprights}: {yes|no}
Specifies whether to set the group rights of the target account to match the group rights of the source account.You can specify the following values for this parameter:
  • yes

    Changes the group rights of the target account to match the group rights of the source account.

  • no

    Does not change the group rights of the target account. This is the default setting.

/{mms|migratemembers}: {yes|no}
Specifies whether to migrate the members of the source domain groups to the target domain.You can specify the following values for this parameter:
  • yes

    Migrates group members when ADMT migrates the group.

  • no

    Does not migrate group members when ADMT migrates the group account. This is the default setting.

/{umo|updatepreviouslymigratedobjects}: {yes|no}
Specifies whether to migrate groups again during this migration that ADMT migrated previously. ADMT performs this operation only when you specify the yes value with the admt user /migrategroups command during subsequent migration operations. For more information, see admt user.You can specify the following values for this parameter:
  • yes

    Migrates groups again during the current migration operation that ADMT migrated previously.

  • no

    Does not migrate groups again during the current migration operation. This is the default setting.

Note

If a group that ADMT migrated previously has since been removed from the target domain, you must specify this value to migrate the group again.

/{fgm|fixgroupmembership}: {yes|no}
Specifies whether to add migrated users to target domain groups if those users were members of groups that ADMT migrated from the source domain.You can specify the following values for this parameter:
  • yes

    Checks group membership in the source domain, and then adds the migrated account to those same groups in the target domain. This is the default setting.

  • no

    Does not add the migrated user account to groups in the target domain.

/{co|conflictoptions}: {ignore|merge [+removeuserrights] [+removemembers]|[+movemergedaccounts]}
Specifies an action for ADMT to take when ADMT finds that an object name already exists in the target domain.You can specify the following values for this parameter:
  • ignore

    Does not migrate the account that already exists in the target domain, and proceeds with the rest of the migration. This is the default setting.

  • merge

    Replaces the account that already exists in the target domain with the account from the source domain.

  • +removeuserrights

    Removes existing user rights from the target account. You use this value with the merge value.

  • +removemembers

    Removes all existing members from the target group before ADMT merges the source group with the target group. You use this value with the merge value.

  • +movemergedaccounts

    Causes ADMT to move the account from the original OU to the target OU that you specified for the current migration operation, if ADMT finds that a previously migrated account's OU has changed. You use this value with the merge value.

/{gx|grouppropertiestoexclude}: {*|"Property"|"Property1 [,Property2]..."}
Specifies properties to exclude when groups are migrated.You can specify the following value for this parameter:
  • Property

    Specifies the property to exclude. You can specify multiple properties. Separate each property with a comma, and enclose all properties within a single set of quotation marks. Specify the wildcard character (*) by itself to exclude all properties.

/{ix|inetorgpersonpropertiestoexclude}: {*|"Property"|"Property1 [,Property2]..."}
Specifies inetOrgPerson properties to exclude when a group account is migrated.You can specify the following value for this parameter:
  • Property

    Specifies the property to exclude. You can specify multiple properties. Separate each property with a comma, and enclose all properties within a single set of quotation marks. Specify the wildcard character (*) by itself to exclude all properties.

/{ux|userpropertiestoexclude}: {*|"Property"|"Property1 [,Property2]..."}
Specifies user properties to exclude when groups are migrated.You can specify the following value for this parameter:
  • Property

    Specifies the property to exclude. You can specify multiple properties. Separate each property with a comma, and enclose all properties within a single set of quotation marks. Specify the wildcard character (*) by itself to exclude all properties.

/{n|includename}: "<Name>"[ "<Name2>"]...
Specifies a group or list of groups to migrate.You can specify the following value for this parameter:
  • Name

    Specifies the name of the group account or accounts to migrate. Enclose the name within quotation marks. Separate each name from the next name with a space.

/{f|includefile}: <FileName>
Specifies the name of a file that contains a list of groups to migrate.You can specify the following value for this parameter:
  • FileName

    Specifies the name of the include file. This file can contain the Windows NT Security Accounts Manager (SAM) account name, relative distinguished name (also known as RDN), or canonical name (CN=) of the group account. You can specify only one file with this parameter.

/{d|includedomain}: [recurse [+{<flatten>|maintain}]]
Specifies an entire source domain or OU of accounts.You can specify the following values for this parameter:
  • recurse

    Specifies how to migrate listed domains or OUs. If you do not specify the +flatten value or the +maintain value with recurse, ADMT uses +flatten as the default value.

  • +flatten

    Migrates accounts in the parent and child containers into only one target container. The accounts in the child container migrate, but the child containers do not migrate.

  • +maintain

    Migrates child containers and the accounts that they contain.

/{en|excludename} "Name"[ "Name2"]...
Specifies group accounts to exclude from the migration.You can specify the following value for this parameter:
  • Name

    Specifies the name of the group account or accounts to exclude from migration. You can specify multiple group accounts to exclude. Place each group account name in quotation marks, and separate each name from the next one with a space. By default, ADMT migrates all accounts in a domain or OU that you specify. You can use a maximum of two wildcard characters (*) for each name in the file. You can use wildcard characters at the beginning or end of a string, or at both the beginning and end.

/{ef|excludefile}: <FileName>
Specifies the name of a file that contains the list of groups to exclude from the current migration operation.You can specify the following value for this parameter:
  • FileName

    Specifies the name of the exclude file, which can contain the Windows NT SAM account names or the relative distinguished names of the accounts to exclude. You can specify only one file with this parameter. You can use a maximum of two wildcard characters for each name in the exclude file. Although you cannot include wildcard characters in the name itself, you can include them at the beginning or end of a string, or at both the beginning and end of the string.

Remarks

Configuring database administration roles

You can use database administration roles to assign a subset of permissions to users who perform specific migration tasks.

ADMT has the following database administration roles:

  • Account migrators:

    Perform tasks that are associated with account migrations, such as user and group migrations.

  • Resource migrators:

    Perform tasks that are associated with resource migrations, such as computer migrations and security translations. Account migrators also hold the role of resource migrators.

  • Data readers:

    Perform queries against the database. Account migrators and resource migrators also hold the role of data readers.

Users who hold the role of SQL Server system administrator hold all ADMT database administration roles. They have permissions to display database roles and the users who hold those roles, add groups or users to those roles, and remove groups or users from those roles. By default, ADMT assigns the role of system administrator to the local Administrators group, which can perform all ADMT database functions.

Configuring preferred domain controllers

ADMT provides the option for an administrator to select the source and target domain controller to use for a migration instead of having DC Locator select those controllers.

To use a preferred domain controller, you use the admt group command to configure it. You must configure source and target domain controllers independently. After you configure a preferred domain controller, ADMT determines its validity and availability and then uses that domain controller automatically every time that you run ADMT.

Examples

The following example lists all database roles and the members that are assigned to each role.

admt group getrolemembers

The following example adds a role member (JohnSmith from the CONTOSO domain) to the account migrators role.

admt group addrolemember /r:"Account Migrators" /a:CONTOSO\JohnSmith

The following example removes a role member (JohnSmith from the CONTOSO domain) from the account migrators role.

admt group removerolemember /r:"Account Migrators" /a:CONTOSO\JohnSmith

The following example configures a preferred domain controller (DC1) for the source domain that you specify (CONTOSO).

admt group setdomaincontroller /Domain:CONTOSO /sdc:DC1

The following example configures a preferred domain controller (DC2) for the target domain that you specify (TREYRESEARCH).

admt group setdomaincontroller /Domain:TREYRESEARCH /sdc:DC2

The following example clears the preferred domain controllers that you configured previously for the CONTOSO domain.

admt group cleardomaincontrollers /Domain:CONTOSO

The following example displays the preferred domain controllers that you configured.

admt group getdomaincontrollers


  • Лазерные МФУ!
    Место встречи продавцов и покупателей. Новая и б/у оргтехника и аксессуары!
    www.olx.ru

     
  • Итальянская мебель в Москве!
    Прямые поставки. Широкий ассортимент в наличии. Удовлетворим любые вкусы!
    www.renesa.ru

     
  • Японская доставка, скидки до 90%
    Японская доставка со скидкой до 90%. Сайт всех скидок!
    kuponator.ru

     
  • Переезд по адекватной цене!
    Мы - не ломаем мебель. Честные цены. Найдете дешевле - заплатите дважды!
    pereezd77.ru

     
  • Требуются по объявлениям
    Работа, вакансии для всех жилающих, новые резюме соискателей
    www.axsell.ru

     
  • Пластиковые окна - КБЕ, Trocal
    Автоматизированное производство. Новый оконный стандарт. Стеклопакет "STIS"
    novie-okna-kbe.ru

     
  • Квартиры в Московской области
    Продажа квартир в Московской области - 23 км от Москвы. Доступные цены!
    www.mechta.su

     
  • Услуги автосервиса.
    Ремонт двигателя, тормозной системы,подачи топлива,КПП, АКПП,инжектора .
    www.avk-service.ru

     
  • Медная труба и расходники
    Продажа расходных материалов для монтажа кондиционеров.Монтаж. Москва, обл.
    kol-med.ru

     
  • американский фондовый рынок
    американский фондовый рынок - Детально. Доступно!
    forex2.info

     
  • Как заняться бизнесом в интернете
    Успешный бизнес-проект набирает лидерский состав. Обучение и поддержка.
    proektlider.ru

     
  • Gorenje EC 778 W
    Электрическая плита в наличии. 23096 р.
    www.duhovki.net

     
  • Красивая Свадьба!Фото и видео.
    Красивые фотографии.Красивый фильм о Вашей Свадьбе.Творчество и мастерство.
    www.krasivajasvadba.ru

     
  • Чайные наборы и сервизы
    Огромный выбор. Быстрая доставка. Низкие цены. Скидки и акции.
    you-gift.ru

     
  • Холодильные витрины
    Широкий выбор холодильного оборудования. Холодильные витрины недорого!
    torgoborudovanie.ru

     
  • Саратов 264
    Саратов 264 цена: 8100 руб. Купить с доставкой!
    goodszone.ru

     
  • Продажа катков, скидки до 90%
    Продажа катков со скидкой от 50% Выбирай каток на сайте скидок.
    kuponator.ru

     
  • Подарочный сертификат. Скидки
    Детский подарочный сертификат, 50%. Выбирай сертификат на сайте скидок.
    kuponator.ru

     
  • Мечтаете поехать в Таиланд?
    Вся информация о туристах в Таиланде. Туры, отели, операторы, описания.
    tailand.turovodstvo.ru

     
  • Все про эмиссию ценных бумаг
    Эмиссия ценных бумаг. Консультации аналитиков Инвесткафе.
    investcafe.ru

     
  • Бесплатная онлайн игра OverKings
    Дьябло прямо в Вашем браузере. Играйте абсолютно бесплатно. Хит 2011
    www.overkings.ru

     
  • ремонт японских автомобилей
    Техобслуживание и ремонт автомобилей в "NADA-Service"
    www.nada-service.ru

     
  • Срочно продается Квартира
    2 к.кв., 71.8 м2, Октябрьская, 11, 3 270 750 руб
    realty.dmir.ru

     
  • Водосточные системы кровли?
    У нас всегда спец.цены на: Водосточные системы кровли!
    skladkrovli.ru

     
  • Вы хотели бы узнать своё будущее?
    Вы хотели бы узнать своё будущее? Закажите бесплатный расклад на Таро!
    maska.kharkov.ua

     
  • Недорогая одежда из китая
    Недорогая одежда из китая интернет магазин здесь. Доставка!
    mokusha.ru

     
  • Продажа сточных систем
    Насосные станции SFA. Откачка сточных вод. Установка без ремонта!
    www.sfa.ru

     
  • Туры в Великобританию. Экскурсии.
    Туры в Лондон.Туры в Шотландию.Туры по Англии.Заказ экскурсий, отелей.
    www.gteurope.ru

     
  • ЖК Gusi-Лебеди, Приморский р-н.
    Квартиры с полной отделкой! от 58 000 руб. за кв. м. СК КВС.
    www.kvsspb.ru

     
  • Чехлы для Apple iPad от 300 руб.!
    Чехлы для Apple iPad от 300 руб. (smart cover, case, кожаные). Доставка!
    www.sotmarket.ru