01-01-2009, 09:23 AM
|
#1 (permalink)
|
Member
Join Date: Nov 2008
Posts: 59
|
Configuring Domains for SID Migration in Windows Server 2008
Configuring Domains for SID Migration in Windows Server 2008
Migration of the source Security Identifiers (SIDs) into the target domain SID History allows the security assigned in Access Control Lists (ACLs) to work transparently after the migration. This gives the administrator time to reset ACLs on a slow basis or even after all objects are migrated.
There are several settings that need to be configured to allow for the SIDs to be transferred. These settings contain creating a local group in the source domain for auditing, enabling TCP/IP client support on the source PDC emulator, and, finally, enabling auditing on both the source and target domains.
To create the local group on the source domain for auditing, follow the below steps:
1. Log on to a domain controller on the source domain.
2. Launch Active Directory Users and Computers.
3. Create a domain local group named SourceDomain$$$, where SourceDomain is the NetBIOS name of the source domain. For example, the local group for the companyabc.com domain would be companyabc$$$.
Do not add any members to the group, or the migration process will fail.
To enable TCP/IP client support, follow the below steps:
1. Log on to the PDC (Primary Domain Controller) emulator domain controller in the source domain.
2. Launch the Registry Editor. (Click on Start and then select Run and then type regedit)
3. Navigate to \HKEY\LocalMachine\System\CurrentControlSet\Contro l\LSA.
4. Create the value TcpipClientSupport REG_DWORD and assign it a value of 1.
5. Exit the Registry Editor.
To enable auditing in Windows Server 2008 domains, do the following steps:
1. Click on Start and then Control Panel and then Administrative Tools and then Default Domain Controller Security Settings.
2. Expand the Local Policies.
3. Select the Audit Policy node.
4. Double-click on the Audit Account Management policy.
5. Check the Define These Policy Settings and select both Success and Failure.
6. Click OK to save the changes.
7. Exit the Group Policy Object Editor.
Now the source and target domains will be prepared to transfer SIDs into the SID History.
|
|
|
Linear Mode
