Resolution
Will the Domain Admins group in the target domain have the same permissions that the Domain Admins group in the source domain had?
fact
Domain Migration Administrator 7.1
fix
If you do not migrate the Domain Admins group, the Domain Admins group in the target domain will not automatically have the same permissions that the Domain Admins group in the source domain had.
If you want the Domain Admins global group in the target domain to have the same permissions as the Domain Admins global group in the source domain has, then you need to take the following steps:
- Migrate the source 'Domain Admins' group to the target domain. This will create a mapping between the two groups in the Domain Migration Administrator database. This will also update the group membership of the target Domain Admins group (for accounts that have been migrated by Domain Migration Administrator) without overwriting the current membership of the target group. Make sure that the target container you specify in the wizard is the container of the existing Domain Admins global group ('Users' by default), and select the option to 'Replace and update conflicting accounts'. Do not select the option to 'Remove existing members of groups being replaced'.
If you want to limit the permissions of the target Domain Admins global group in the source domain, you may wish to migrate this source group without the SID history option.
- Translate security on resource servers with the Translate Security Settings wizard, selecting the source 'Domain Admins' group and the file server(s) in the wizard. If you use Add mode, then upon checking the ACL you will find both the source Domain Admins group and the target Domain Admins group having the same permissions.
To control the permissions that the target Domain Admins group receives, you can selectively choose the security translation options that you want to process (for example, selecting only the checkboxes for 'Files and folders' and 'Shares').