Microsoft KB Archive/832221

= How to configure the Active Directory Migration Tool to migrate user passwords from a Windows NT 4.0 domain to a Windows Server 2003 domain =

Article ID: 832221

Article Last Modified on 12/3/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows Small Business Server 2003 Standard Edition
 * Microsoft Windows Small Business Server 2003 Premium Edition
 * Microsoft BackOffice Small Business Server 4.5
 * Microsoft Windows NT 4.0

-



Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry

IN THIS TASK

 * SUMMARY
 * Configure the destination domain
 * Configure the source domain
 * REFERENCES



SUMMARY
This article describes how to configure the Active Directory Migration Tool (ADMT) to migrate user passwords from a Microsoft Windows NT 4.0 domain to a Microsoft Windows Server 2003 domain.

Note This article assumes that you have already installed ADMT v2, that the source domain is a Windows NT 4.0 domain, and that the target domain is a Windows Server 2003 domain that is running in Microsoft Windows 2000-or-later native mode.

back to the top

Configure the destination domain
ADMT must be installed on a domain controller to migrate SID history and password information.To do this, follow these steps:  Turn on auditing for the success and the failure of account management auditing in the Default Domain Controllers policy. To do so:  Start Active Directory Users and Computers. Expand your domain, right-click Domain Controllers, and then click Properties. Click the Group Policy tab, click Default Domain Controllers Policy, and then click Edit. Expand Computer Configuration, expand Windows Settings, expand Security Settings, expand Local Policies, and then click Audit Policy. In the right pane, double-click Audit account management. Click to select the Define these policy settings check box if it is not already selected, and then click to select both of the following check boxes:

Success

Failure

</li> Click OK, quit the Group Policy Object Editor, and then click OK.</li> Permit sufficient time for the Group Policy changes to propagate throughout the domain.</li></ol> </li> Log on as an administrator to a domain controller where ADMT v2 is installed.</li> At a command prompt, type the following command to create a password export key file (.pes)

admt key

where  is the NetBIOS name of the Windows NT 4.0 source domain, where   is the path where you want to create the password export key, and where   is an optional password or the asterisk (*) character to help protect the .pes file.

Note You must specify a local path for the .pes file. This path can point to a drive with removable media, such as to a floppy drive, to a ZIP drive, or to a CD-R or a CD-RW drive. Additionally, if you type a password, ADMT helps protect the file with the password. If you type an asterisk (*), ADMT prompts you to enter and confirm a password. The operating system does not echo the password as you type it.</li> Move the .pes file that you created to the server that you designate as the Password Export Server in the source domain. This can be any domain controller in the Windows NT 4.0 domain that has a fast and reliable link to the Windows Server 2003-based computer where ADMT is installed.</li></ol>

back to the top

Configure the source domain
Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

Configure the Windows NT 4.0 source domain for the password migration operation. To do so: <ol> Configure a new local group and name it $$$, where   is the NetBIOS name of the Windows NT 4.0 source domain. This group must not contain any members.</li> On the primary domain controller (PDC), turn on auditing for the success and the failure of user and group management in the domain. To do so: <ol style="list-style-type: lower-alpha;"> Start User Manager for Domains.</li> On the Policies menu, click Audit.</li> Click Audit These Events, and then click to select both of the following check boxes for the User and Group Management item:

Success

Failure

</li> Click OK.</li></ol> </li> Configure the source domain to permit remote procedure call (RPC) access to the security accounts manager (SAM) database by setting the  registry value to 1. To do so, follow these steps. <ol style="list-style-type: lower-alpha;"> On the PDC, click Start, click Run, type regedit in the Open box, and then click OK.</li> Locate and then click the following registry subkey:

</li> On the Edit menu, point to New, and then click DWORD Value.</li> Name the new value TcpipClientSupport .</li> <li>Right-click TcpipClientSupport, and then click Modify.</li> <li>In the Value data box, type 1, and then click OK.</li> <li>Quit Registry Editor.</li></ol>

Note You must restart the computer to apply this registry change. However, you do not have to restart the computer until you install the ADMT Password Migration DLL component.</li> <li>Install the ADMT Password Migration DLL on the PDC. To do this, run Pwdmig.exe from the I386\ADMT\Pwdmig folder on the Windows Server 2003 CD-ROM or from the location where you downloaded ADMT.

When you run the ADMT Password Migration DLL Installation Wizard, you are prompted for the path of the .pes file that you moved to the Windows NT 4.0 domain. You must specify a local path for this file. You are also prompted for the password that you used when you created this file.</li> <li>After the ADMT Password Migration DLL installation is completed successfully, click Yes when you are prompted to restart the server.</li> <li>When you are ready to migrate passwords from the Windows NT 4.0 domain, change the  registry value to 1. To do so, follow these steps: <ol style="list-style-type: lower-alpha;"> <li>On the PDC, click Start, click Run, type regedit in the Open box, and then click OK.</li> <li>Locate and then click the following registry subkey:

</li> <li>In the right pane, right-click AllowPasswordExport, and then click Modify.</li> <li>In the Value data box, type 1, and then click OK.</li> <li>Quit Registry Editor.</li></ol> </li></ol>

back to the top

<div class="references_section">