|
You can
turn on interforest password migration
by installing a DLL that runs in the
context of LSA. By running in this
protected context, passwords are
shielded from being viewed in cleartext,
even by the operating system. The
installation of the DLL is protected by
a secret key that is created by ADMTv2,
and must be installed by an
administrator.
To install
the password migration DLL:
-
Log on
as an administrator or equivalent to
the computer on which ADMTv2 is
installed.
-
At a
command prompt, run the ADMT KEY
sourcedomainpath [* | password]
command to create the password
export key file (.pes). In this
example, sourcedomain is the NetBIOS
name of the source domain and path
is the file path where the key will
be created. The path must be local,
but can point to removable media
such as a floppy disk drive, ZIP
drive, or writable CD media. If you
type the optional password at the
end of the command, ADMT protects
the .pes file with the password. If
you type the asterisk (*), ADMT
prompts for a password, and the
system will not echo it as it is
typed.
-
Move
the .pes file you created in step 2
to the designated Password Export
Server in the source domain. This
can be any domain controller, but
make sure it has a fast, reliable
link to the computer that is running
ADMT.
-
Install the Password Migration DLL
on the Password Export Server by
running the Pwmig.exe tool.
Pwmig.exe is located in the
I386\ADMT folder on the Windows
Server 2003 installation media, or
the folder to which you downloaded
ADMTv2 from the Internet.
-
When
you are prompted to do so, specify
the path to the .pes file that you
created in step 2. This must be a
local file path.
-
After
the installation completes, you must
restart the server.
-
If you
are ready to migrate passwords,
modify the following registry key to
have a DWORD value of 1. For maximum
security, do not complete this step
until you are ready to migrate.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\LSA\AllowPasswordExport
The Active
Directory Migration Tool v2 is included
in the I386\Admt folder on the Windows
Server 2003 CD. |
