Export/Import Active Directory

[drkestrel]

I have a Windows 2000 Server domain controller, and I intend to rebuild it on a new server.

I obviously want to move the users and security group from the old server to the new server.

It appears that with LDIFDE, I can't import group membership. The following attributes appears to cause problems:

    memberOf, primaryGroupID, badPwdCount, lastLogoff, lastLogon, logonCount, pwdLastSet, badPasswordTime, sAMAccountType

When I try to import an LDF file that contain these attributes, the following error is returned:

Logging in as current user using SSPI
Importing directory from file "c:\test.ldf"
Loading entries.
Add error on line 1: Unwilling To Perform
The server side error is "Access to the attribute is not permitted because the attribute is owned by the Security Accoun
ts Manager (SAM)."
0 entries modified successfully.
An error has occurred in the program

badPwdCount, lastLogoff, lastLogon, logonCount, pwdLastSet, badPasswordTime

are probably not too crucial, but it would be quite a pain if group memberships cannot be imported. Note the same error occured even if I import the Security Group first before importing user objects with

memberOf

and

PrimaryGroupID

property set. In addition, the password is also not exported.

Questions:
1) Are there any ways to get LDIFDE to import group membership? If so, how?
2) Are there any ways to get LDIFDE to import passwords? If so, how? If not, if I were to use ADSI after an LDIFDE import:

objADSIUser.ChangePassword

What parameter do I pass to the oldpassword argument?

Note, the source server is windows 2000 server with SP3, and the destination server is windows 2000 server with SP4.

 

[crobin1]

Are you creating a new forest (changing the domain name)? If so, I think you can use the Active Directory Migration Tool to move everything over.

If you are just building a new DC on newer hardware, but keeping the domain the same, then the easiest process is:
[ul][li]Make the new box a DC of the existing domain[/li]
[li]Allow time for replication between the two to occur[/li]
[li]Transfer all of the FSMO roles to the new server[/li]
[li]Test to make sure everything is working correctly (servers, workstation logons, etc)[/li]
[li]Demote the original DC to a member server[/li]
[li]Test again [/li]
[li]Do whatever you want with the old server[/li]
[/ul]
This way all of your user accounts and groups are preserved as is, with nothing to import. This does make a few assumptions, such as that you have DNS on a separate server, but DNS is fairly easy to transfer as well.

Does that make sense?