Recipe 4.18 Moving an Object to a Different Domain

4.18.1 Problem

You want to move an object to a different domain.

4.18.2 Solution Using a command-line interface
> movetree /start /s SourceDC /d TargetDC /sdn SourceDN /ddn TargetDN

In the following example, the cn=jsmith object in the domain will be moved to the domain.

> movetree /start /s dc-amer1 /d dc-emea1[RETURN]
  /ddn cn=jsmith,cn=users,dc=amer,dc=rallencorp,dc=com[RETURN]
  /sdn cn=jsmith,cn=users,dc=emea,dc=rallencorp,dc=com[RETURN] Using VBScript
set objObject = GetObject("LDAP://TargetDC/TargetParentDN")
objObject.MoveHere "LDAP://SourceDC/SourceDN", vbNullString

In the following example, the cn=jsmith object in the domain will be moved to the domain.

set objObject = GetObject( _
objObject.MoveHere _
   "LDAP://dc-emea1/cn=jsmith,cn=users,dc=emea,dc=rallencorp,dc=com", _

4.18.3 Discussion

You can move objects between domains assuming you follow a few guidelines:

  • The user requesting the move must have permission to modify objects in the parent container of both domains.

  • You need to explicitly specify the target DC (serverless binds usually do not work). This is necessary because the "Cross Domain Move" LDAP control is being used behind the scenes. For more information on controls, see Recipe 4.3.

  • The move operation must be performed against the RID master for both domains.

  • Both domains must be in native mode.

  • When you move a user object to a different domain, its objectSID is replaced with a new SID (based on the new domain), and the old SID is added to the sIDHistory attribute.

  • For group objects, you can only move universal groups. To move global or domain local groups, you must first convert them to universal.

4.18.4 See Also

Recipe 4.3 for more on LDAP controls, MS KB 238394 (How to Use the MoveTree Utility to Move Objects Between Domains in a Single Forest), and MSDN: IADsContainer::MoveHere

    Chapter 3. Domain Controllers, Global Catalogs, and FSMOs
    Chapter 6. Users
    Appendix A. Tool List