ADMT Migrating Computers from 2003 to 2008

In order to migrate computers from a 2000 or 2003 Active Directory Domain to a 2008 Active Directory Domain you need to set a group policy in your 2008 domain that allows cryptography algorithms compatible with Windows NT 4.0. Otherwise, the migration will bring the computer account over but will not change the domain the computer is in.

You can find this Group Policy setting here:
In the Group Policy Management Editor console, expand Computer Configuration, expand Policies, expand Administrative Templates, expand System, click Net Logon, and then double-click Allow cryptography algorithms compatible with Windows NT 4.0. Based on (http://support.microsoft.com/kb/942564)

Another thing I found was that that Target Domain Account you are using to transfer the computers over need to have local admin privileges on the systems you are migrating from the source domain and the ADMT System needs to have access to the computer. (IE: Firewall opened for at least that machine).

Roaming Profiles... just not in the computer labs.

We recently needed to find a way to allow for roaming profiles with our Active Directory Domain for a certain group of users. This caused a problem for our Computer labs because we didn't want the profiles to roam in the labs as we were wanting every user to get the same experience in the labs and be given the pre-configured profile.

There are 2 options depending on the type of computers you have on your domain in the lab enviorment. Put all the computers in an OU and add a group policy to them. Is under this tree:
(Computer Configuration \ Policies \ Administrative Templates \ System \ User Profiles)

For Windows XP enable the following:
- Only allow local user profiles

For Windows Vista you can change the profile value:
- Set roaming profile path for all users ( you could carfully set it to a local folder)


This works great and allows both the use of roaming profiles in the office environment while still letting the Lab machines be configured for maximum performance. Also, if you use DeepFreeze or a similar product I'd recommend disabling machine password changes through Group Policy so your systems don't suddenly drop off the Domain.