#27303 - 2002-08-18 02:58 AM
Migrating Profiles
|
Anonymous
Anonymous
Unregistered
|
Any help on the following would be greatly appreciated.
We're migrating from a legacy NT4 domain to a new W2K domain and as part of the migration we want the users to login to their NT4 workstations in the new domain, but get their profile from the old domain.
After finding that the profiles are listed in HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList I wrote a script to create a new key in Profilelist which is the users SID in the new domain. I've reset the SID value under the SID number subkey and everything looks good. When I then login as the new user I still find that they get a new profile directory (as per NT standards userid.000).
I've checked that the script is writing the correct values, I've reset permissions on the new key. All to no avail.
If anyone has any ideas on how NT does profile detection outside of the ProfileList subkey I'd love to know.
I'll post my code in a following post.
cheers
Nathan
|
|
Top
|
|
|
|
|
#27304 - 2002-08-18 03:00 AM
Re: Migrating Profiles
|
Anonymous
Anonymous
Unregistered
|
; ProfileMigrator
;
; Used during migration to re-profile machines after we've done a migration
;
; Version 1.00 - Nathan Reeves - 15 August 2002
;
; -- Start Variable Definition --
$NewDomainDC = "DCNAME"
$NewDomainName = "W2KDomain"
; -- End Variable Definition --
; -- Function Definition Start --
;FUNCTION StrSidToHexSid($StringSid)
;AUTHOR Howard A. Bullock (habullock@comcast.net)
;ACTION Converts a Sid in string (S-1-5-21-...) format to Hex format.
;SYNTAX StrSidToHexSid($StringSid)
;PARAMETERS $StringSid (Required) - String value
;REMARKS Do not prefix the computer name with "\\"'s.
;RETURNS String
;DEPENDENCIES KiXtart 4.02
;EXAMPLES StrSidToHexSid("S-1-5-21-24129212-1035812195-1543859470-1401")
; returns "010500000000000515000000BC2E7001633DBD3D0E6D055C79050000"
;
Function StrSidToHexSid($StringSid)
dim $i, $j, $Parts, $Sac, $Sid, $x
$Sid = ""
If Left($StringSid,4) = "S-1-"
$Parts = split($StringSid, "-")
For $i=1 to 2
$Sid = $Sid + PadStr(DecToHex($Parts[$i]),0,2)
Next
$Sac = Ubound($Parts) - 2
$Sid = $Sid + PadStr($Sac,0,12)
For $i=1 to $Sac
$x = PadStr(DecToHex($Parts[$i+2]),0,8)
For $j=7 to 1 Step -2
$Sid = $Sid + Substr($x,$j,2)
Next
Next
Else
? "StrSidToHexSid - Invalid input"
Exit 1
Endif
$StrSidToHexSid = $Sid
Exit 0
Endfunction
;FUNCTION PadStr($Input,$Pad,$Length)
;AUTHOR Howard A. Bullock (habullock@comcast.net)
;ACTION Left or Right pad a string.
;SYNTAX PadStr($Input,$Pad,$Length)
;PARAMETERS $Input (Required) - String value
; $Pad (Required) - String value
; $Length (Required) - Integer (Max length of padded string)
; $PadSide (Optional) - String [L|R] Default is "L"
;REMARKS The $Pad can be one or more characters. If the Padding exceeds
; the specified maximum length then the resulting string is trimmed
; preserving the original data.
;RETURNS String
;DEPENDENCIES KiXtart 4.02 or higher
;EXAMPLES PadStr("401","0",8) result "00000401"
; PadStr("401","0",8,"R") result "40100000"
;
Function PadStr($Input, $Pad, $Length, optional $PadSide)
Dim $i, $x
$PadStr = ""
$Input = "" + $Input
$Pad = "" + $Pad
$Length = 0 + $Length
If $PadSide="" or Len($PadSide)>1 or Instr("LR",$PadSide)= 0
$PadSide = "L"
Endif
$x = Len($Input)
For $i=$x to $Length - 1 Step Len("$Pad")
If $PadSide = "L"
$Input = $Pad + $Input
Else
$Input = $Input + $Pad
Endif
Next
If $PadSide = "L"
$Input = Right($Input, $Length)
Else
$Input = Left($Input, $Length)
Endif
$PadStr = $Input
Exit 0
Endfunction
; -- Function Definition End --
; -- Start Profile Migrator --
; List all keys in the Profilelist directory
$Index=0
:ProfileLoop
? "Index = $Index"
$ProfileName = EnumKey("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList", $Index)
If @Error = 0
; Get the path of the profile
$ProfileDirString = ReadValue("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\$ProfileName", "ProfileImagePath")
; Now work out the actual directory name. Minus the length of the known path to do this
$ProfileDirLength = Len($ProfileDirString) - 22
;? $ProfileDirLength
;
$ProfileDirName = Substr($ProfileDirString, 23, 24 - ProfileDirLength)
? "'"$ProfileDirName"'"
; Work out if we have the administrator profile dir as we don't want to alter this
If $ProfileDirName <> "Administrator"
; See if the profile dir has a period. If so we don't want to touch it as it probably
; means that we have two profiles. The later one with a period should be left as is.
$AdditionalProfileP = Instr($ProfileDirName, ".")
If $AdditionalProfileP = 0
; Lets add the user to the local Admin group now
$AdminCmdLine = "net localgroup Administrators $NewDomainName\$ProfileDirName /ADD"
Shell "cmd /q /c $AdminCmdLine"
; Find the new Sid
? "Working on Profile: $ProfileDirName"
$CmdLine = "UserSid.bat \\$NewDomainDC $ProfileDirName"
SHELL "cmd /q /c $CmdLine"
If Open(3, "sid.txt") = 0
$NewSid = ReadLine(3)
If @Error = 0
Sleep 1
; Lets save the old key and restore it as the new key
$SaveResult = Savekey("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\$ProfileName", "%TEMP%\$ProfileName.reg")
If $SaveResult = 0
? "Loading Key [$ProfileName] to [$NewSid]"
$AddResult = AddKey("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\$NewSid")
$LoadPath = "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\$NewSid"
$LoadResult = LoadKey("$LoadPath", "%TEMP%\$ProfileName.reg")
; Now edit the Sid Key to enter the correct SID
$NewHexSid = StrSidToHexSid($NewSid)
$WriteResult = WriteValue("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\$NewSid", "SID", "$NewHexSid", "REG_BINARY")
EndIf
EndIf
$CloseCode = Close(3)
Sleep 1
EndIf
EndIf
EndIf
$Index = $Index + 1
Goto ProfileLoop
EndIf
|
|
Top
|
|
|
|
|
#27306 - 2002-08-18 03:02 AM
Re: Migrating Profiles
|
Anonymous
Anonymous
Unregistered
|
And the UserSID.bat looks like this:
@echo off
set sid=
If {%2}=={} goto syntax
REM if not exist %1\c$ goto syntax
for /f "Skip=2 Tokens=7" %%i in ('getsid %1 %2 %1 %2') do echo %%i > sid.txt
goto :EOF
:syntax
@echo Syntax call UserSID \\DC_or_Local UserName
|
|
Top
|
|
|
|
|
#27307 - 2002-08-18 03:21 AM
Re: Migrating Profiles
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
I have this all coded in Perl. It works great. The piece you missed is that you need to migrate security on the workstation and add the SID of the new account to all location that the old SID is listed. This includes inside NTuser.dat (the profile registry hive).
Also, the code has to be executed while the new user account is not logged on.
I elected to have the code execute in the context of an Admin level account and migrate ALL security and profiles at one time.
[ 18. August 2002, 03:22: Message edited by: Howard Bullock ]
|
|
Top
|
|
|
|
|
#27309 - 2002-08-18 03:33 AM
Re: Migrating Profiles
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
The security migratgion is indeed an EXE, but it is only one part of a multi-stage solution. You would have to supply an off-line SAM with all the accounts old and new including sids.
I would like to share the process, but it is my crown jewel and I doubt if my employer would like it if the code was made public. We use it extensively when acquiring other companies and moving them into our domain and security architecture.
I am sure that if someone needed to migrate a large number of accounts which were referenced in many domain or server local groups, NTFS or share ACLs, and desktop computers groups, NTFS, and profiles, we could come to some consulting arrangment.
[ 18. August 2002, 03:36: Message edited by: Howard Bullock ]
|
|
Top
|
|
|
|
|
#27310 - 2002-08-18 04:59 AM
Re: Migrating Profiles
|
Anonymous
Anonymous
Unregistered
|
You mentioned that the security is listed in the users NTUSER.DAT. This I assume is the Internal Security settings available in the REGEDT32 Program?
I added the user the local admin group, so wouldn't that give them access to all parts of the registry in HKCU?
|
|
Top
|
|
|
|
|
#27311 - 2002-08-18 05:19 AM
Re: Migrating Profiles
|
Anonymous
Anonymous
Unregistered
|
I'm still working through it now. Howard, thanks for the guidance here. Realising that you can't exactly give away employer IP.
If I've migrated the user over to the new domain with SID history, then effectively for permissions things shouldn't have to change.
Any hints on other SID locations?
TIA
|
|
Top
|
|
|
|
|
#27312 - 2002-08-18 05:56 AM
Re: Migrating Profiles
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
I think that Sid History is something that should be avoided. I can't point to any one thing at the moment, but I know we have come more than one issue where we were very glad that we did not go down that path.
Can you explain this logic a bit further?
quote:
; See if the profile dir has a period. If so we don't want to touch it as it probably
; means that we have two profiles. The later one with a period should be left as is.
If you are using the Profile list key, you need to process the ProfileImagePath for each Sid. Each sid has a single profile. The name of the imagepath does not matter in my opinion.
|
|
Top
|
|
|
|
|
#27313 - 2002-08-19 03:52 AM
Re: Migrating Profiles
|
Anonymous
Anonymous
Unregistered
|
The decision to leave out profiles with a period was based on an internal (company) likelihood that a user may have already logged into the new domain and hence created a new profile which I didn't really want to touch. I would probably leave this check out for future migrations where we intend to run the profile migrator ahead of the user actually logging into the new domain.
SID History for us is brilliant. I haven't seen issues with many things, and it eases us from having to re-ACL entire directories when we migrate the users to the new domain.
|
|
Top
|
|
|
|
|
#27314 - 2002-08-19 08:48 AM
Re: Migrating Profiles
|
Anonymous
Anonymous
Unregistered
|
Quick update. I'm finding that if I export a reg file of the system created profilekey for the new sid, rebuild the PC and then use the reg file to recreate the reg entries then things work. When I do them using Kixtart it still creates a new user profile.
|
|
Top
|
|
|
|
|
#27316 - 2002-08-19 03:27 PM
Re: Migrating Profiles
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
I believe that if you use Sid History and later remove the old account domain you will be left with a bunch of "Account Unknown"'s in your DACLs. If this is the case how will you ever know who has permissions where?
My process re-Acls the computer one time for all accounts allowing us to avoid that extra baggage.
|
|
Top
|
|
|
|
Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart
|
0 registered
and 1046 anonymous users online.
|
|
|
