What is Active Directory Migration?
During an organisation's merger or acquisition, its IT teams are posed with just as many challenges as the legal and the other teams that are involved in the process. Active Directory (AD), a critical component in an IT infrastructure, is responsible for managing user identities, access rights, and security policies across the organisation.
The Active Directory Migration Tool (ADMT) is Microsoft's native utility for migrating users, groups, computers, and GPOs between domains and forests. ADMT 3.2, available as a free download, handles the core migration wizards but relies on a Command Prompt interface and requires the Password Export Server to be separately configured on the source domain controller for password synchronisation.
ADManager Plus wraps this process in a web-based GUI, extends migration to contacts and GPO ACLs, and adds a backup-and-recovery capability that ADMT lacks natively.
Why ADManager Plus for Active Directory Migration?
Migration can be quite risky and its challenges increase with the complexity of an organisation's AD infrastructure.
Interforest migrations, common in post-merger integrations where the acquired company maintains a separate AD forest, are particularly high-risk: trust relationships must be established, SID history must be preserved to maintain cross-domain resource access, and any naming conflict left unresolved can break authentication for migrated accounts.
Interforest migrations, common in post-merger integrations where the acquired company maintains a separate AD forest, are particularly high-risk: trust relationships must be established, SID history must be preserved to maintain cross-domain resource access, and any naming conflict left unresolved can break authentication for migrated accounts.
ADManager Plus, an identity governance and administration (IGA) solution, doubles as an Active Directory migration tool and aids in securely migrating objects across domains and forests with a GUI-based approach that eliminates the need for CLI expertise.
ADManager Plus Migration Capabilities
As a comprehensive AD migration tool, ADManager Plus simplifies every stage of the migration process. It enables IT teams to securely move users, groups, contacts, GPOs, and computers without losing critical configurations or access rights.
Unlike ADMT, which requires a separate Password Export Server configuration and Command Prompt expertise, ADManager Plus handles conflict resolution, SID history migration, and password pre-configuration through a single web console. This reduces migration risk during the coexistence period when users need valid credentials in both source and target domains.
Here are the key capabilities of ADManager Plus, a powerful Active Directory migration tool:
User migration
Migrate users along with their access rights, group memberships, and SID history, ensuring migrated accounts retain access to resources in the source domain during the coexistence period without requiring manual permission re-grants.
Group migration
Migrate groups along with their members and memberships, including nested group structures and group scope conversions required when migrating between domains with differing functional levels.
Contact migration
Migrate AD Contacts and their OU details, preserving proxy addresses and mail attributes, a common requirement when Exchange or Exchange Online is in use alongside the migrated AD environment.
GPO migration
Migrate GPOs with or without ACL or a migration table. GPO migration with ACL preservation is critical in post-merger scenarios where the acquired domain's security baselines, including Cyber Essentials or ISO 27001-mapped policy configurations, must be carried forward intact to the target domain.
Computer migration
Migrate computers and their properties across AD domains and forests. Computer migration includes workstation profile translation, remapping local user profiles to target domain accounts, and requires WinRM to be enabled on target machines before ADManager Plus can execute the migration remotely.
How to Perform an AD Migration with ADMT: Step by Step
Devise a migration plan
Brainstorm and develop a migration plan with information on restructuring, objects that have to be migrated, and migration schedule. The plan should include an OU structure audit of both source and target domains, a complete object inventory covering users, groups, computers, GPOs, and contacts, a rollback strategy in case of migration failure, and a change management communication plan for affected end users.
ADManager Plus's pre-built OU and object reports can accelerate this audit phase, generating a complete inventory of source domain objects with their OU locations, group memberships, and account status in a single export.
Back up resources
Back up all objects before migration using ADManager Plus' backup and recovery module. This is especially important for GPO backups: if a GPO migration fails partway through, restoring the source domain's Group Policy configuration from ADManager Plus's backup prevents security policy gaps from persisting during the recovery window.
Test your migration plan
Deploy a test environment and migrate the objects from your source environment to your target environment using ADManager Plus to understand the repercussions the migration process may have on your AD. A test run also validates that domain trust relationships are functioning correctly and that SID history is being preserved before committing to the production migration window.
Migrate objects smoothly
Based on the inference from your testing, migrate objects seamlessly at the desired time using ADManager Plus. Schedule migrations during off-peak hours to minimise authentication disruption, particularly in environments where Active Directory serves as the identity provider for line-of-business applications, NHS clinical systems, or financial trading platforms where downtime has direct operational impact.
Key Highlights of ADManager Plus' AD Migration Tools Feature
Conflict handling
Handle naming conflicts automatically during migration with naming formats. Pre-configuring conflict resolution rules before the migration window means naming collisions, common when two organisations have overlapping user account conventions post-merger, are handled automatically without stalling the migration job.
OU hierarchy
Migrate objects along with their OU details across domains and forests, maintaining the target organisational unit structure and preserving GPO scope so that policy application is consistent from day one in the target domain.
Permission management
Move users and groups along with their access rights, ensuring cross-domain resource access is maintained during the coexistence period without requiring IT teams to manually re-apply permissions in the target domain.
Password migration
Pre-configure what happens to users' passwords and migrate them securely. This includes password synchronisation between source and target domains during the coexistence period, using the same Password Export Server mechanism that ADMT relies on, so users authenticate seamlessly without a forced reset that would otherwise trigger a high volume of helpdesk calls on cutover day.
Benefits of using ADManager Plus as an AD migration tool
ADManager Plus, a powerful Active Directory migration tool, offers a range of benefits designed to make your migrations secure, efficient, and reliable. Here's how ManageEngine's ADManager Plus helps IT departments simplify every step of the AD migration.
Secure migration
Migrate objects securely without affecting their permissions between domains and forests.
Ensure data integrity
Avoid data loss by migrating objects with their attributes intact.
Improve efficiency
Migrate a large volume of objects without affecting your AD efficiency and performance.
Reduce administrative burden
Delegate tasks to other technicians and take the load off administrators.
Hassle-free conflict management
Decide and pre-configure how conflicts are managed during migration.
Mitigate data loss
Backup data and recover then instantly during migration failure and thwart data loss.
Get a Quote for ADManager Plus Today
Streamline your Active Directory migrations with ease using ADManager Plus. As a reliable AD migration tool, it helps IT teams move users, groups, contacts, GPOs, and computers securely and efficiently, without downtime or data loss. Experience a faster, safer migration with ADManager Plus.
Whether you're managing an intraforest OU restructure, an interforest merger integration, or a phased migration to a hybrid Entra ID environment, our team can scope ADManager Plus to your specific migration topology.
Contact us today to get pricing details tailored to your business needs.
Testimonials
[ADManager Plus is] good overall and I think it's competitive price wise. [Hence] I would recommend it.
Daryl Smith, Head of technical management services, East Kent Hospitals
FAQs
An Active Directory migration tool is designed to simplify the process of moving users, groups, computers, and other objects between Active Directory domains and forests. Microsoft's own Active Directory Migration Tool (ADMT 3.2) is the free, native option, but it requires CLI expertise and a separately configured Password Export Server, making it complex for teams without dedicated AD engineering resource. These tools ensure a secure, efficient migration while maintaining data integrity and access permissions.
ADManager Plus provides a GUI-driven alternative that wraps ADMT's capabilities with additional object types (contacts, GPOs with ACLs) and a built-in backup module, reducing migration risk without requiring scripting expertise.
Active Directory migration tools such as ADManager Plus preserve all object attributes, permissions, and group memberships during migration. They also provide conflict management, backup, and recovery features to prevent data loss and ensure a secure migration. SID history preservation is a specific security requirement in interforest migrations, ensuring migrated accounts do not lose access to legacy resources in the source domain during the coexistence period, which is particularly critical in regulated environments where access interruptions must be minimised and documented.
Yes. Modern Active Directory migration tools are designed to migrate large volumes of users, groups, computers, and GPOs efficiently. AD migration tools such as ManageEngine's ADManager Plus optimise performance, delegate administrative tasks, and reduce the risk of service interruptions during migration. For phased migrations, where objects are moved in batches across multiple maintenance windows to minimise disruption, ADManager Plus supports partial migration runs with conflict resolution rules pre-configured so each batch completes cleanly without manual intervention.
Need Features? Get in Touch
If you want to see additional features implemented in ADManager Plus, we would love to hear from you. Click here to continue
Our team can also advise on migration topologies, including ADMT-complementary setups, intraforest restructuring, and hybrid Entra ID configurations, based on your specific AD environment.
Contact Us for AD Migration Pricing
Our team can discuss your Active Directory migration topology, whether you're planning an intraforest restructure, an interforest forest merger, or a hybrid migration to Microsoft Entra ID, and scope ADManager Plus to your timeline and object volume.
Get in touch today for a fast, no-obligation quote.
