Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We are preparing for a companywide domain user migration from Domain A to Domain B (of all corporate apps and services). However, only about half of the users will be migrated because the other half need to remain in the existing domain (as part of a separate company). Additionally, we will only migrate a subset of users at a time, probably per department.

I am trying to determine the best solution to migrate specific users from the old domain to the new domain in SharePoint for all of my farms. I do have different versions of SharePoint running, so that adds some complexity. I reviewed several third-party tools that can assist with this process. However, I am looking for an alternate solution that allows me to manually perform this task.

The current SharePoint environment, which I inherited, is as follows:

Farm A

• MOSS 2007 Enterprise (Version 12.0.0.6510)

• Microsoft SQL Server 2005

APP, WFE and DB Servers actually reside on a separate Domain C and will not be migrating as part of this project. (There is a separate project to build a new SharePoint 2010 farm on new servers in Domain B, scheduled to begin after this project concludes.)

Farm B

• Microsoft SharePoint Server 2010 (Version 14.0.6120.5006)

• Microsoft SQL Server 2008 R2

APP, WFE and DB Servers already reside on Domain B.

Farm C

• Microsoft SharePoint Server 2010 (Version 14.0.6117.5002)

• Microsoft SQL Server 2008 R2

APP, WFE and DB Servers already reside on Domain B.

I reviewed several blog posts and forums for the best solution, but haven’t found one yet. If my research is correct, it looks like I need to use the following operation in Farm A to migrate the users: stsadm -o migrateuser -oldlogin -newlogin [-ignoresidhistory]

However, I will need to use the following operation in Farms B & C to migrate the users: Move-SPUser [-Identity] -NewAlias [-AssignmentCollection ] [-Confirm []] [-IgnoreSID ] [-WhatIf []]

Some questions and concerns I have are:

• Is my understanding outlined above correct?

• Am I missing any critical steps?

• Is there a better solution for migrating a subset of users at a time for MOSS 2007? For SharePoint Server 2010?

• How do I migrate the groups for all three farms?

• Our current permission structure is a huge mess today, using a combination of direct permissions, AD Groups and some SharePoint groups. Additionally, some of the AD groups are nested domain groups. For instance, in Farm A, many of the permissions are setup with direct access for Domain C\SP Group (Domain local Security Group) which then contains a nested group of Domain A\SP Group (Global Security Group). Then that group (of Domain A\SP Group) actually contains individual users from Domain A (Domain A\jdoe). To complicate things further, there is a third group of Domain B\SP Group (Global Security Group) that contains the same individual users as Domain A\SP Group, as well as itself Domain B\SP Group (Global Security Group).

• Finally, the users that remain in Domain A will need continued access to all resources on Farms A, B & C. I am concerned about migrating groups that these users are a part of and I am not sure of the best approach for this.

I would appreciate any guidance or suggestions!

share|improve this question
    
Not really an answer, but a point to remember, are any SharePoint service accounts on Domain A? Is Domain A to be totally extinguished ultimately? If both questions are "Yes" you may need to evaluate your farms and prepare to rebuild farms. I've actually been in situations where we've tried moving the Config Database Service Account and we've never managed it. –  tekiegreg May 6 '13 at 20:43
    
Great point, but I don’t think that will be an issue for me because there are no SharePoint servers or service accounts on Domain A. Farm A & C operate from servers and service accounts on Domain C and that is where they will stay. Farm B already has its servers and service accounts on Domain B and that is where they will stay. –  Lisa Conner May 8 '13 at 14:22
add comment

1 Answer 1

we are also in same situation but yet to implement. please try the below steps and kindly update your comments:

Need to take backups of all Apps and content DB’.

  1. Create the generic id’s/service accounts in the new domain

  2. Migrate servers to new domain

  3. Add new service accounts to Local Administrator, WSS_WPG, WSS_ADMIN & IIS_WPG

  4. Give permissions to service accounts in SQL
  5. Update app pools with new Service account and change all Service Applications with new Account
  6. Migrate the user accounts using stsadm

stsadm -o migrateuser -oldlogin DOMAIN\user -newlogin DOMAIN\user -ignoresidhistory

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.