04, Oct, 2024

How to: Migrate user domain profile from one domain to another domain

This is quite similar to migrating local to domain. The difference is about setting permissions and joining to domain. As you know to be able to add domain account to permissions TAB, computer needs to be joined to domain. When computer is a member of a different domain already it might be confusing. So what we need to do:

Step 1:

Login to local admin account

Step 2:

Join new domain providing credentials to it, reboot computer

Step 3:

Login again as local administrator making sure the computer is joined to the new domain – computer properties

Step 4:

Now, we need to add user from new domain to permissions of user files and registry. Just repeat step 3

Step 5:

Now, the registry part, it is a bit tricky since we need to load external registry because we won’t be able to log on old domain account.

Step 6:

Open regedit, select HKLM, then select file/load registry hive. Navigate to old domain user account folder, select file NTUSER.DAT (hidden by default), specify a temporary name for that hive, like user-reg.

Step 7:

Now right-click on user-reg, click permissions

Step 8:

In new window click Advanced, then Add, and then type in NEW DOMAIN ACCOUNT NAME. You may need to provide domain admin credentials to query AD.

Step 9:

Select user then check the following options: 
9a) Apply to: This Key and subkeys 
9b) Full Control 
9c) DO NOT SELECT TH LAST CHECKBOX – apply these permissions to objects and/or containerswithin this container only

Step 10:

Click Ok, then ok, then ok.

Step 11:

Now navigate to HKLM\Software\Microsoft\Windows_NT\CurrentVersion\Profile List 
11A) Find the one, with old domain path to profile in key: ProfileImagePath, copy value of this key, eg. C:\Users\test.olddomain 
11B) Find the other one with newly created profile path, eg. C:\Users\test.newdomain 
11C) Replace value of ProfileImagePath from old profile, eg. C:\Users\test.olddomain with C:\Users\test.newdomain

Step 12:

Double check permissions for folders, check value of the keys.

Step 13:

If everything is ok, reboot your computer and try to login using username from new domain.

That would be all. If you login to new domain account and cannot see/open a folder or file it is generally related to permissions. Just reboot computer, login to local admin or domain admin, select user profile and re-add permissions with propagation to child objects.

If you log in and are presented with a temporary profile, you need to reset permissions from the registry for new user. Basically it isn’t a big magic behind this, just simple permissions editing with path to profile swapping. That’s all:)