Recipe 4.18 Moving an Object to a Different Domain

4.18.1 Problem

You want to move an object to a different domain.

4.18.2 Solution

4.18.2.1 Using a command-line interface

> movetree /start /s SourceDC /d TargetDC /sdn SourceDN /ddn TargetDN

In the following example, the cn=jsmith object in the amer.rallencorp.com domain will be moved to the emea.rallencorp.com domain.

> movetree /start /s dc-amer1 /d dc-emea1[RETURN]
  /ddn cn=jsmith,cn=users,dc=amer,dc=rallencorp,dc=com[RETURN]
  /sdn cn=jsmith,cn=users,dc=emea,dc=rallencorp,dc=com[RETURN]

4.18.2.2 Using VBScript

set objObject = GetObject("LDAP://TargetDC/TargetParentDN")
objObject.MoveHere "LDAP://SourceDC/SourceDN", vbNullString

In the following example, the cn=jsmith object in the amer.rallencorp.com domain will be moved to the emea.rallencorp.com domain.

set objObject = GetObject( _
   "LDAP://dc-amer1/cn=users,dc=amer,dc=rallencorp,dc=com")
objObject.MoveHere _
   "LDAP://dc-emea1/cn=jsmith,cn=users,dc=emea,dc=rallencorp,dc=com", _
   vbNullString

4.18.3 Discussion

You can move objects between domains assuming you follow a few guidelines:

• The user requesting the move must have permission to modify objects in the parent container of both domains.

• You need to explicitly specify the target DC (serverless binds usually do not work). This is necessary because the "Cross Domain Move" LDAP control is being used behind the scenes. For more information on controls, see Recipe 4.3.

• The move operation must be performed against the RID master for both domains.

• Both domains must be in native mode.

• When you move a user object to a different domain, its objectSID is replaced with a new SID (based on the new domain), and the old SID is added to the sIDHistory attribute.

• For group objects, you can only move universal groups. To move global or domain local groups, you must first convert them to universal.

4.18.4 See Also

Recipe 4.3 for more on LDAP controls, MS KB 238394 (How to Use the MoveTree Utility to Move Objects Between Domains in a Single Forest), and MSDN: IADsContainer::MoveHere