{"id":878,"date":"2012-02-29T10:50:59","date_gmt":"2012-02-29T09:50:59","guid":{"rendered":"http:\/\/blogs.chrisse.se\/?p=878"},"modified":"2012-02-29T10:50:59","modified_gmt":"2012-02-29T09:50:59","slug":"how-to-handle-built-in-domain-groups-with-admt","status":"publish","type":"post","link":"https:\/\/blog.chrisse.se\/?p=878","title":{"rendered":"How to handle built-in domain groups with ADMT"},"content":{"rendered":"

If you ever performed a migration with the Active Directory Migration Tool (ADMT) it probably has come to your attention that you can’t migrate built-in domain groups, the reason for this is simple \u2013 those are groups has well-known SIDs ore more specifically well-known RIDs \u2013 meaning that their RIDs are the same in any domain.<\/p>\n

The ADMT Migration Log will state the following:<\/p>\n

Table\u00a01: Migration Log
\n<\/span><\/p>\n

\n\n\n<\/colgroup>\n\n\n\n
\n

ADMT Migration Log – Sample<\/span><\/p>\n<\/td>\n<\/tr>\n

Active Directory Migration Tool – scripted group migration started.
\n<\/span>WRN1:0135 The object ‘Users’ is a built-in or well-known account. The object will not be migrated.
\n<\/span>WRN1:0135 The object ‘Domain Guests’ is a built-in or well-known account. The object will not be migrated.
\n<\/span>WRN1:0135 The object ‘Group Policy Creator Owners’ is a built-in or well-known account. The object will not be migrated.
\n<\/span>WRN1:0135 The object ‘Pre-Windows 2000 Compatible Access’ is a built-in or well-known account. The object will not be migrated.
\n<\/span><\/p>\n

WRN1:0135 The object ‘Performance Log Users’ is a built-in or well-known account. The object will not be migrated.
\n<\/span><\/p>\n

WRN1:0135 The object ‘Windows Authorization Access Group’ is a built-in or well-known account. The object will not be migrated.
\n<\/span><\/p>\n

WRN1:0135 The object ‘Remote Desktop Users’ is a built-in or well-known account. The object will not be migrated.
\n<\/span><\/p>\n

WRN1:0135 The object ‘Enterprise Admins’ is a built-in or well-known account. The object will not be migrated.
\n<\/span><\/p>\n

WRN1:0135 The object ‘Schema Admins’ is a built-in or well-known account. The object will not be migrated.
\n<\/span><\/p>\n

WRN1:0135 The object ‘Guests’ is a built-in or well-known account. The object will not be migrated.
\n<\/span><\/p>\n

WRN1:0135 The object ‘Domain Users’ is a built-in or well-known account. The object will not be migrated.
\n<\/span><\/p>\n

WRN1:0135 The object ‘Terminal Server License Servers’ is a built-in or well-known account. The object will not be migrated.
\n<\/span><\/p>\n

WRN1:0135 The object ‘Domain Admins’ is a built-in or well-known account. The object will not be migrated.
\n<\/span><\/p>\n

WRN1:0135 The object ‘Administrators’ is a built-in or well-known account. The object will not be migrated<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

 <\/p>\n

The problem<\/strong>
\nThis causes an issue if you want to preserve access to resources in the source domain, once a user account has been migrated to the target domain, this is usually accomplished by using sIDHistory \u2013 (Migrated users and groups inherit their source SID in the sIDHistory attribute \u2013 You can read more here: Using SID History to Preserve Resource Access<\/a>)<\/p>\n

If you have ACLs (Access Control Lists) that contain ACEs (Access Control Entries) either granting or denying rights on a File Share to for example the “Domain Users” group (a group with a well-known SID) in “source.dom” and a user “John” who is member of “Domain Users” are migrated from “source.dom” to “target.dom” with sIDHistory (since built-in groups aren’t migrated \u2013 John would know lose the presence of the “Domain Users” group in “source.dom” in his token and can therefore no longer access resources in “source.dom” that was granted to him by the “Domain Users” group, the example below.<\/p>\n

\"\"<\/p>\n

The solution using Security Translation
\n<\/strong>The Active Directory Migration Tool (ADMT) has a feature called Security Translation \u2013 briefly described; Security Translation can translate security references on objects in Windows NT:<\/p>\n