All right, so it looks like two users were examined.
One group was examined.
It looks like there were two user‑related errors, one group‑related error.
Well, that's not good.
What does the log say here?
Let's take a look.
Okay, well if we see down at the bottom here, Access is denied.
I just realized something I forgot to do, and that is to make sure
that administrators in the source domain have privilege as
administrators in the destination domain,
whoops. Rookie little mistake there.
So through the magic of video editing, now you see that two
users were copied successfully with no errors, and we can
verify that here in the log file.
What did I do specifically in case you were curious?
I just wanted to make sure, and I did this on both
domains, company.com and timw.info.
I've gone into the Administrators group, Members, and I added in
the domain admins for the other forest domain.
And we can just do that by going to Add, Locations.
And because I have that forest trust,
I'm able to reach across the trust, and I'm able to enumerate those groups.
So that made all the difference in the world.
Let's do a couple more migrations before we go over to timw.info and verify.
So we've looked basically at users and groups.
Now let's take a look at computer migration.
So we'll go here. Again, we verify it kept our previous choices,
which is convenient for domain selections.
They're analogous to the user wizard, as you can see. Here,
we're browsing for computers.
It's called CLIENT1. I'll bring that in here.
Let's click Next.
Which Target OU do we want here?
Well, do we want to do Staff?
And I'm going to actually put it in the Computers container.
So let's click Next.
Please specify what you want to translate.
Okay, well you want the Local groups on that machine, Files and folders.
What is it that you want to translate? And what the
translation here is it says up at the top is the process
of reapplying access control lists.
I'll actually deselect that. We'll handle redoing the ACLs when we get
to the other side when we get to the target domain.
So let me click Next here.
Minutes before computers are restarting.
Yeah, of course, when you join a new domain,
you have to restart the machine. Here, we have our property
exclusion, Next, conflict, Finish, and we're off and running.
I'll click the View Log again.
Okay,
this one bombed out it looks like because there's already a
computer in that target domain with the same name.
So what I'm going to need to do is rename or remove the conflicting name
in the timw domain and then retry the process again here. And through the
magic, blah, blah, blah, I've made that change in the target, and it
looks like the operation completed.
So you see the rinse and repeat aspect here.
Now there is a command‑line interface for ADMT, so it's
possible to script this stuff out.
For instance,
if I open up an elevated PowerShell console here, and if I do an admt /?,
it gives you some gradual disclosure here,
USER, GROUP, COMPUTER, and so on.
So it's not like you have to click through the wizard interface multiple times.
It's possible to do some larger scale operations with it.
So let's see, what else do we have here?
Security translation, service accounts, managed service accounts.
As far as the Group Policy migration goes, that's just going to
be a question of doing export and imports,
which you can do from the Group Policy Management Console MMC, or you
could do export GPO import GPO commands using PowerShell. So we don't
do Group Policy migration with the ADMT,
but it's mentioned on the AZ‑801 objective, so I wanted
to make sure to cover it in passing.
Let's now cut over to my timw.info environment.
Let me open up dsa.msc.
That's the Active Directory Users and Computers MMC console.
And we can already see that the migration has taken form
here because we have Felipe, Camila,
we have company staff that came from the other
domain. And if we go to Computers, we have CLIENT1. So there you have it, ADMT in a nutshell.