We are preparing for a companywide domain user migration from Domain A to Domain B (of all corporate apps and services). However, only about half of the users will be migrated because the other half need to remain in the existing domain (as part of a separate company). Additionally, we will only migrate a subset of users at a time, probably per department.
I am trying to determine the best solution to migrate specific users from the old domain to the new domain in SharePoint for all of my farms. I do have different versions of SharePoint running, so that adds some complexity. I reviewed several third-party tools that can assist with this process. However, I am looking for an alternate solution that allows me to manually perform this task.
The current SharePoint environment, which I inherited, is as follows:
Farm A
• MOSS 2007 Enterprise (Version 12.0.0.6510)
• Microsoft SQL Server 2005
APP, WFE and DB Servers actually reside on a separate Domain C and will not be migrating as part of this project. (There is a separate project to build a new SharePoint 2010 farm on new servers in Domain B, scheduled to begin after this project concludes.)
Farm B
• Microsoft SharePoint Server 2010 (Version 14.0.6120.5006)
• Microsoft SQL Server 2008 R2
APP, WFE and DB Servers already reside on Domain B.
Farm C
• Microsoft SharePoint Server 2010 (Version 14.0.6117.5002)
• Microsoft SQL Server 2008 R2
APP, WFE and DB Servers already reside on Domain B.
I reviewed several blog posts and forums for the best solution, but haven’t found one yet. If my research is correct, it looks like I need to use the following operation in Farm A to migrate the users: stsadm -o migrateuser -oldlogin -newlogin [-ignoresidhistory]
However, I will need to use the following operation in Farms B & C to migrate the users: Move-SPUser [-Identity] -NewAlias [-AssignmentCollection ] [-Confirm []] [-IgnoreSID ] [-WhatIf []]
Some questions and concerns I have are:
• Is my understanding outlined above correct?
• Am I missing any critical steps?
• Is there a better solution for migrating a subset of users at a time for MOSS 2007? For SharePoint Server 2010?
• How do I migrate the groups for all three farms?
• Our current permission structure is a huge mess today, using a combination of direct permissions, AD Groups and some SharePoint groups. Additionally, some of the AD groups are nested domain groups. For instance, in Farm A, many of the permissions are setup with direct access for Domain C\SP Group (Domain local Security Group) which then contains a nested group of Domain A\SP Group (Global Security Group). Then that group (of Domain A\SP Group) actually contains individual users from Domain A (Domain A\jdoe). To complicate things further, there is a third group of Domain B\SP Group (Global Security Group) that contains the same individual users as Domain A\SP Group, as well as itself Domain B\SP Group (Global Security Group).
• Finally, the users that remain in Domain A will need continued access to all resources on Farms A, B & C. I am concerned about migrating groups that these users are a part of and I am not sure of the best approach for this.
I would appreciate any guidance or suggestions!