Remove Domain & SID History

[patstone]

I have just finished migrating 3000 user’s accounts, mailboxes & data from a Windows 2000 domain to a new Windows 2003 domain.

The permissions on all the shared folders & home folders on the Windows 2003 domain are an exact replica of the permissions on the Windows 2000 domain.

Now I need to break the trust and remove the Windows 200 domain, if I do this as we stand users will not be able to access their files because the SID history will no longer exist.

Does anybody know of a tool that can replace the old windows 2000 SID’s with the new Windows 2003 SID’s on all shared folders & home folders?

 

[wdoellefeld]

Yes. It's called "SubInACL" and it works great...

http://www.microsoft.com/downloads/...56-D8FE-4A91-93CF-ED6985E3927B&displaylang=en

Post back if you get stuck or need help. Your basically running it command line, like this;

Changing domain groups on directories
c:\subinacl /noverbose /subdirectories d:\folder\*.* /changedomain=%OLDdomain%=%NEWdomain%

Changing domain groups on a server share
c:\subinacl /noverbose /share \\server\sharename /changedomain=%OLDdomain%=%NEWdomain%



(yay! shameless advertising. my side business)

http://www.frcp.net

 

[patstone]

Your a hereo, sounds like the tool I am looking for.

 

[patstone]

wdoellefeld,

Do you know if I can add the new SID rather then replace it on the folders ?

 

[wdoellefeld]

You mean so there are matching users for the new/old domains? I don't believe so. Not sure what the aim is with wanting to do that but if it is concern over changing a user who may not be in the new domain you can rest easy. If it cannot find a matching user in the new domain it will leave it there unchanged.

(yay! shameless advertising. my side business)

http://www.frcp.net

 

[patstone]

wdoellefeld,

I am testing this on a test server and it works fine for groups but not for users accounts.

When you used it did you manage to change SID's for your users accounts?

Command I am running :
subinacl /noverbose /subdirectories d:\folder\*.* /changedomain=%olddomain%=%newdomain%

 

[patstone]

Not to worry, used ADMT and it worked.