Français
English
Español
Deutsch
Italiano
Русский
How to manage the SIDHistory attribute?
I wish transfer the old user and group SID during the migration with your IDEAL Migration tool. Like this, the migrated users will access to the old domain resources.
To do this, I want use the "SIDHistory" attribute.
How can this work? and is there some limitations?
When a group or user is created, a SID (Security Identifier) is automatically assigned to it. This SID is then used to grant or deny access to all network resources: shared folders, NTFS permissions, printers, etc.
When you migrate groups and users to Windows 2000/2003/2008/2012/2016 or 2019, new SIDs are created. As a result, the migrated accounts can no longer access the resources of their old domain.
The SIDHistory attribute solves this problem: it associates the old SIDs with the new groups and users, so they keep access to the resources.
The use of SIDHistory is optional and depends on the migration strategy chosen by the network administrator. In any case, it must always remain temporary.
Prerequisites for using SIDHistory
Before using SIDHistory, check and configure the following points.
In IDEAL MIGRATION (only if the source domain is Windows 2000 or later):
- Right-click "IDEAL Migration on …", then choose "Configuration".
- Select the "SID History" tab.
- Fill in the requested information for the source and target domains.
Administration computer and user account
- IDEAL MIGRATION must be installed on a Windows 2000, Windows 2003, Windows 2008 or Windows 2012 server.
- The user must be a member of the Domain Admins group in all managed domains (source and destination).
Source domain
- It can be a Windows NT, Windows 2000, Windows 2003, Windows 2008 or Windows 2012 domain.
- In the registry, under the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsakey, check that theTcpipClientSupportvalue of typeREG_DWORDexists and set it to1. The computer must be restarted for the change to take effect. - Enable auditing of User and Group Management for Success and Failure.
- Create a local group named after the source domain's NetBIOS name followed by three dollar signs (e.g.
POINTDEV$$$).
Destination domain
- It must be a Windows 2000, Windows 2003, Windows 2008 or Windows 2012 domain in native mode.
- Enable auditing of User and Group Management for Success and Failure.
Relationship between the two domains
- A trust relationship must be established between the source domain and the destination domain.
- The two domains must not belong to the same forest.
Read also: How to enable/disable filtering for SIDHistory management?