628 lines
23 KiB
Plaintext
628 lines
23 KiB
Plaintext
|
Option Explicit
|
||
|
|
|
||
|
|
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
' ADMT Scripting Notes
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
' 1 - this template shows all the migration objects and all of the properties
|
||
|
|
' and methods of the various migration objects even though a normal
|
||
|
|
' script would not use all of the objects and properties
|
||
|
|
|
||
|
|
' 2 - optional properties are commented out with the default value shown
|
||
|
|
' being assigned
|
||
|
|
|
||
|
|
' 3 - service account enumeration would normally occur before user account
|
||
|
|
' migration so that services may be updated during user account migration
|
||
|
|
|
||
|
|
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
' ADMT Scripting Constants
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
' RenameOption constants
|
||
|
|
|
||
|
|
Const admtDoNotRename = 0
|
||
|
|
Const admtRenameWithPrefix = 1
|
||
|
|
Const admtRenameWithSuffix = 2
|
||
|
|
|
||
|
|
' PasswordOption constants
|
||
|
|
|
||
|
|
Const admtPasswordFromName = 0
|
||
|
|
Const admtComplexPassword = 1
|
||
|
|
Const admtCopyPassword = 2
|
||
|
|
|
||
|
|
' ConflictOptions constants
|
||
|
|
|
||
|
|
Const admtIgnoreConflicting = &H0000
|
||
|
|
Const admtReplaceConflicting = &H0001
|
||
|
|
Const admtRenameConflictingWithPrefix = &H0002
|
||
|
|
Const admtRenameConflictingWithSuffix = &H0003
|
||
|
|
Const admtRemoveExistingUserRights = &H0010
|
||
|
|
Const admtRemoveExistingMembers = &H0020
|
||
|
|
Const admtMoveReplacedAccounts = &H0040
|
||
|
|
|
||
|
|
' DisableOption constants
|
||
|
|
|
||
|
|
Const admtEnableTarget = 0
|
||
|
|
Const admtDisableSource = 1
|
||
|
|
Const admtDisableTarget = 2
|
||
|
|
Const admtTargetSameAsSource = 4
|
||
|
|
|
||
|
|
' SourceExpiration constant
|
||
|
|
|
||
|
|
Const admtNoExpiration = -1
|
||
|
|
|
||
|
|
' Translation Option
|
||
|
|
|
||
|
|
Const admtTranslateReplace = 0
|
||
|
|
Const admtTranslateAdd = 1
|
||
|
|
Const admtTranslateRemove = 2
|
||
|
|
|
||
|
|
' Report Type
|
||
|
|
|
||
|
|
Const admtReportMigratedAccounts = 0
|
||
|
|
Const admtReportMigratedComputers = 1
|
||
|
|
Const admtReportExpiredComputers = 2
|
||
|
|
Const admtReportAccountReferences = 3
|
||
|
|
Const admtReportNameConflicts = 4
|
||
|
|
|
||
|
|
' Option constants
|
||
|
|
|
||
|
|
Const admtNone = 0
|
||
|
|
Const admtData = 1
|
||
|
|
Const admtFile = 2
|
||
|
|
Const admtDomain = 3
|
||
|
|
Const admtRecurse = &H0100
|
||
|
|
Const admtFlattenHierarchy = &H0000
|
||
|
|
Const admtMaintainHierarchy = &H0200
|
||
|
|
|
||
|
|
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
' Declarations
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
Dim objMigration
|
||
|
|
Dim objUserMigration
|
||
|
|
Dim objGroupMigration
|
||
|
|
Dim objComputerMigration
|
||
|
|
Dim objSecurityTranslation
|
||
|
|
Dim objServiceAccountEnumeration
|
||
|
|
|
||
|
|
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
' ADMT Migration Class
|
||
|
|
'
|
||
|
|
' TestMigration Property
|
||
|
|
' - specifies whether a test migration will be performed
|
||
|
|
' - optional, the default value is false
|
||
|
|
'
|
||
|
|
' IntraForest Property
|
||
|
|
' - specifies whether the migration is intra-forest or inter-forest
|
||
|
|
' - the default is inter-forest migration
|
||
|
|
'
|
||
|
|
' SourceDomain Property
|
||
|
|
' - specifies the source domain name
|
||
|
|
' - the source domain may be specified in either DNS or Flat format
|
||
|
|
' - eg. DNS "mydomain.mycompany.com" or Flat "MYDOMAIN"
|
||
|
|
' - the source domain must be specified
|
||
|
|
'
|
||
|
|
' SourceOU Property
|
||
|
|
' - specifies the source organizational unit (OU)
|
||
|
|
' - this property is only applicable for up-level domains (Windows 2000 or later)
|
||
|
|
' - the OU must be specified in relative canonical format
|
||
|
|
' - eg. "West/Sales"
|
||
|
|
'
|
||
|
|
' TargetDomain Property
|
||
|
|
' - specifies the target domain name
|
||
|
|
' - the target domain may be specified in either DNS or Flat format
|
||
|
|
' - eg. DNS "mydomain.mycompany.com" or Flat "MYDOMAIN"
|
||
|
|
' - the target domain must be specified
|
||
|
|
'
|
||
|
|
' TargetOU Property
|
||
|
|
' - specifies the target organizational unit (OU)
|
||
|
|
' - the OU must be specified in relative canonical format
|
||
|
|
' - eg. "West/Sales"
|
||
|
|
'
|
||
|
|
' RenameOption Property
|
||
|
|
' - specifies how migrated accounts are to be renamed
|
||
|
|
' - optional, default is admtDoNotRename
|
||
|
|
'
|
||
|
|
' RenamePrefixOrSuffix Property
|
||
|
|
' - specifies the prefix or suffix to be added to account names
|
||
|
|
' - applicable only if RenameOption is admtRenameWithPrefix or
|
||
|
|
' admtRenameWithSuffix
|
||
|
|
'
|
||
|
|
' PasswordOption Property
|
||
|
|
' - specifies how to generate passwords for migrated accounts
|
||
|
|
' - applicable only for inter-forest user migrations and inter-forest group
|
||
|
|
' migrations when migrating member users
|
||
|
|
' - optional, default is admtComplexPassword
|
||
|
|
'
|
||
|
|
' PasswordServer Property
|
||
|
|
' - specifies the server that is to be used for copying passwords
|
||
|
|
' - applicable only for inter-forest user migrations and inter-forest group
|
||
|
|
' migrations when migrating member users
|
||
|
|
' - only applicable if password option specifies copying
|
||
|
|
'
|
||
|
|
' PasswordFile Property
|
||
|
|
' - specifies the path of the password file to be created
|
||
|
|
' - applicable only for inter-forest user migrations and inter-forest group
|
||
|
|
' migrations when migrating member users
|
||
|
|
' - optional, default path is the 'Logs' folder in the ADMT installation
|
||
|
|
' directory
|
||
|
|
'
|
||
|
|
' ConflictOptions Property
|
||
|
|
' - specifies how to handle accounts being migrated that have a naming
|
||
|
|
' conflict with a target domain account
|
||
|
|
' - the following are the allowable values
|
||
|
|
' admtIgnoreConflicting
|
||
|
|
' admtReplaceConflicting
|
||
|
|
' admtReplaceConflicting + admtRemoveExistingUserRights
|
||
|
|
' admtReplaceConflicting + admtRemoveExistingMembers
|
||
|
|
' admtReplaceConflicting + admtRemoveExistingUserRights + admtRemoveExistingMembers
|
||
|
|
' admtRenameConflictingWithPrefix
|
||
|
|
' admtRenameConflictingWithSuffix
|
||
|
|
' - optional, default is admtIgnoreConflicting
|
||
|
|
'
|
||
|
|
' ConflictPrefixOrSuffix Property
|
||
|
|
' - specifies the prefix or suffix to be added to migrated account names
|
||
|
|
' that have a naming conflict with a target domain account
|
||
|
|
' - applicable only if ConflictOptions is admtRenameConflictingWithPrefix or
|
||
|
|
' admtRenameConflictingWithSuffix
|
||
|
|
'
|
||
|
|
' UserPropertiesToExclude
|
||
|
|
' - specifies user properties that are not to be copied from source to target.
|
||
|
|
' - note that the asterisk character '*' may be used to exclude all properties
|
||
|
|
'
|
||
|
|
' InetOrgPersonPropertiesToExclude
|
||
|
|
' - specifies inetOrgPerson properties that are not to be copied from source to target.
|
||
|
|
' - note that the asterisk character '*' may be used to exclude all properties
|
||
|
|
'
|
||
|
|
' GroupPropertiesToExclude
|
||
|
|
' - specifies group properties that are not to be copied from source to target.
|
||
|
|
' - note that the asterisk character '*' may be used to exclude all properties
|
||
|
|
'
|
||
|
|
' ComputerPropertiesToExclude
|
||
|
|
' - specifies computer properties that are not to be copied from source to target.
|
||
|
|
' - note that the asterisk character '*' may be used to exclude all properties
|
||
|
|
'
|
||
|
|
' SystemPropertiesToExclude
|
||
|
|
' - specifies system properties that are not to be copied from source to target for any objects
|
||
|
|
' - the default system properties that are excluded are 'mail' and 'proxyAddresses'
|
||
|
|
' - note that the system properties to be excluded are saved in the database and therefore this
|
||
|
|
' property only needs to be set once
|
||
|
|
'
|
||
|
|
' CreateUserMigration Method
|
||
|
|
' - creates an instance of a user migration object
|
||
|
|
'
|
||
|
|
' CreateGroupMigration Method
|
||
|
|
' - creates an instance of a group migration object
|
||
|
|
'
|
||
|
|
' CreateComputerMigration Method
|
||
|
|
' - creates an instance of a computer migration object
|
||
|
|
'
|
||
|
|
' CreateSecurityTranslation Method
|
||
|
|
' - creates an instance of a security translation object
|
||
|
|
'
|
||
|
|
' CreateServiceAccountEnumeration Method
|
||
|
|
' - creates an instance of a service account enumeration object
|
||
|
|
'
|
||
|
|
' CreateReportGeneration Method
|
||
|
|
' - creates an instance of a report generation object
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
' create instance of migration object
|
||
|
|
|
||
|
|
Set objMigration = CreateObject("ADMT.Migration")
|
||
|
|
|
||
|
|
' set options
|
||
|
|
|
||
|
|
'objMigration.TestMigration = False
|
||
|
|
'objMigration.IntraForest = False
|
||
|
|
objMigration.SourceDomain = "MYSOURCEDOMAIN"
|
||
|
|
'objMigration.SourceOU = ""
|
||
|
|
objMigration.TargetDomain = "mytargetdomain.mycompany.com"
|
||
|
|
objMigration.TargetOU = "Users"
|
||
|
|
'objMigration.RenameOption = admtDoNotRename
|
||
|
|
'objMigration.RenamePrefixOrSuffix = ""
|
||
|
|
'objMigration.PasswordOption = admtComplexPassword
|
||
|
|
'objMigration.PasswordServer = ""
|
||
|
|
'objMigration.PasswordFile = "C:\Program Files\Active Directory Migration Tool\Logs\Password.txt"
|
||
|
|
'objMigration.ConflictOptions = admtIgnoreConflicting
|
||
|
|
'objMigration.ConflictPrefixOrSuffix = ""
|
||
|
|
'objMigration.UserPropertiesToExclude = ""
|
||
|
|
'objMigration.InetOrgPersonPropertiesToExclude = ""
|
||
|
|
'objMigration.GroupPropertiesToExclude = ""
|
||
|
|
'objMigration.ComputerPropertiesToExclude = ""
|
||
|
|
'objMigration.SystemPropertiesToExclude = "mail,proxyAddresses"
|
||
|
|
|
||
|
|
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
' UserMigration Class
|
||
|
|
'
|
||
|
|
' DisableOption Property
|
||
|
|
' - specifies whether to disable source or target account
|
||
|
|
' - applicable only for inter-forest migration
|
||
|
|
' - optional, default is admtEnableTarget
|
||
|
|
'
|
||
|
|
' SourceExpiration Property
|
||
|
|
' - specifies the expiration period of the source account in days
|
||
|
|
' - a value of admtNoExpiration specifies no source account expiration
|
||
|
|
' - applicable only for inter-forest migration
|
||
|
|
' - optional, default is admtNoExpiration
|
||
|
|
'
|
||
|
|
' MigrateSIDs Property
|
||
|
|
' - specifies whether to migrate security identifiers to the target domain
|
||
|
|
' - applicable only for inter-forest migration
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' TranslateRoamingProfile Property
|
||
|
|
' - specifies whether to perform security translation on roaming profiles
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' UpdateUserRights Property
|
||
|
|
' - specifies whether to update user rights in the domain
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' MigrateGroups Property
|
||
|
|
' - specifies whether to migrate groups that have as members accounts being
|
||
|
|
' migrated
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' UpdatePreviouslyMigratedObjects Property
|
||
|
|
' - specifies whether previously migrated accounts should be re-migrated
|
||
|
|
' - applicable only for inter-forest migration
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' FixGroupMembership Property
|
||
|
|
' - specifies whether group memberships will be re-established for migrated
|
||
|
|
' accounts
|
||
|
|
' - optional, default is true
|
||
|
|
'
|
||
|
|
' MigrateServiceAccounts Property
|
||
|
|
' - specifies whether to migrate service accounts
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' Migrate Method
|
||
|
|
' - migrate specified user accounts
|
||
|
|
' - the first parameter specifies whether the names are directly specified or
|
||
|
|
' the names are contained in the specified file or the names are to be
|
||
|
|
' enumerated from the specified domain or ou
|
||
|
|
' - the second parameter specifies the account names to be included
|
||
|
|
' - the third parameter optionally specifies names which are to be excluded
|
||
|
|
'
|
||
|
|
' - Note: Only the specified source OU will be used whether names are
|
||
|
|
' directly specified or specified in a file or the domain is
|
||
|
|
' searched. If no source OU is specified than the root of the domain
|
||
|
|
' is used.
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
' create instance of user migration object
|
||
|
|
|
||
|
|
Set objUserMigration = objMigration.CreateUserMigration
|
||
|
|
|
||
|
|
' set options
|
||
|
|
|
||
|
|
'objUserMigration.DisableOption = admtEnableTarget
|
||
|
|
'objUserMigration.SourceExpiration = admtNoExpiration
|
||
|
|
'objUserMigration.MigrateSIDs = False
|
||
|
|
'objUserMigration.TranslateRoamingProfile = False
|
||
|
|
'objUserMigration.UpdateUserRights = False
|
||
|
|
'objUserMigration.MigrateGroups = False
|
||
|
|
'objUserMigration.UpdatePreviouslyMigratedObjects = False
|
||
|
|
'objUserMigration.FixGroupMembership = True
|
||
|
|
'objUserMigration.MigrateServiceAccounts = False
|
||
|
|
|
||
|
|
' migrate user accounts
|
||
|
|
' the following are some examples of specifying the names and exclude names
|
||
|
|
|
||
|
|
objUserMigration.Migrate admtData, "CN=User1"
|
||
|
|
objUserMigration.Migrate admtData, Array("/Users/User3","\User4")
|
||
|
|
objUserMigration.Migrate admtFile, "C:\Users.txt", Array("begins_with*","*contains*","*ends_with")
|
||
|
|
objUserMigration.Migrate admtDomain, , "C:\ExcludeNames.txt"
|
||
|
|
|
||
|
|
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
' GroupMigration Class
|
||
|
|
'
|
||
|
|
' UpdateGroupRights Property
|
||
|
|
' - specifies whether to update group domain rights
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' UpdatePreviouslyMigratedObjects Property
|
||
|
|
' - specifies whether previously migrated accounts should be re-migrated
|
||
|
|
' - applicable only for inter-forest migration
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' FixGroupMembership Property
|
||
|
|
' - specifies whether group memberships will be re-established for migrated
|
||
|
|
' accounts
|
||
|
|
' - optional, default is true
|
||
|
|
'
|
||
|
|
' MigrateSIDs Property
|
||
|
|
' - specifies whether to migrate security identifiers to the target domain
|
||
|
|
' - applicable only for inter-forest migration
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' MigrateMembers Property
|
||
|
|
' - specifies whether to migrate members of groups during migration
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' DisableOption Property
|
||
|
|
' - specifies whether to disable source user accounts or target user accounts
|
||
|
|
' when copying members
|
||
|
|
' - applicable only if copying members in an inter-forest migration
|
||
|
|
' - optional, default is admtEnableTarget
|
||
|
|
'
|
||
|
|
' SourceExpiration Property
|
||
|
|
' - specifies the expiration period of source user accounts in days when
|
||
|
|
' copying members
|
||
|
|
' - a value of admtNoExpiration specifies no source user account expiration
|
||
|
|
' - applicable only if copying members in an inter-forest migration
|
||
|
|
' - optional, default is admtNoExpiration
|
||
|
|
'
|
||
|
|
' TranslateRoamingProfile Property
|
||
|
|
' - specifies whether to perform security translation on roaming profiles
|
||
|
|
' - applicable only if copying members in an inter-forest migration
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' Migrate Method
|
||
|
|
' - migrate specified group accounts
|
||
|
|
' - the first parameter specifies whether the names are directly specified or
|
||
|
|
' the names are contained in the specified file or the names are to be
|
||
|
|
' enumerated from the specified domain or ou
|
||
|
|
' - the second parameter specifies the account names to be included
|
||
|
|
' - the third parameter optionally specifies names which are to be excluded
|
||
|
|
'
|
||
|
|
' - Note: Only the specified source OU will be used whether names are
|
||
|
|
' directly specified or specified in a file or the domain is
|
||
|
|
' searched. If no source OU is specified than the root of the domain
|
||
|
|
' is used.
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
' create instance of group migration object
|
||
|
|
|
||
|
|
Set objGroupMigration = objMigration.CreateGroupMigration
|
||
|
|
|
||
|
|
' set options
|
||
|
|
|
||
|
|
'objGroupMigration.MigrateSIDs = False
|
||
|
|
'objGroupMigration.UpdateGroupRights = False
|
||
|
|
'objGroupMigration.UpdatePreviouslyMigratedObjects = False
|
||
|
|
'objGroupMigration.FixGroupMembership = True
|
||
|
|
'objGroupMigration.MigrateMembers = False
|
||
|
|
'objGroupMigration.DisableOption = admtDisableNeither
|
||
|
|
'objGroupMigration.SourceExpiration = admtNoExpiration
|
||
|
|
'objGroupMigration.TranslateRoamingProfile = False
|
||
|
|
|
||
|
|
' migrate group accounts
|
||
|
|
' the following are some examples of specifying the names and exclude names
|
||
|
|
|
||
|
|
objGroupMigration.Migrate admtData, "CN=Group1"
|
||
|
|
objGroupMigration.Migrate admtData, Array("/Users/Group3","\Group4")
|
||
|
|
objGroupMigration.Migrate admtFile, "C:\Groups.txt", Array("begins_with*","*contains*","*ends_with")
|
||
|
|
objGroupMigration.Migrate admtDomain, , "C:\ExcludeNames.txt"
|
||
|
|
|
||
|
|
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
' ComputerMigration Class
|
||
|
|
'
|
||
|
|
' - the following translate options specify whether to perform security
|
||
|
|
' translation on that type of objects during the computer migration
|
||
|
|
'
|
||
|
|
' TranslateFilesAndFolders Property
|
||
|
|
' - specifies whether to perform security translation on files and folders
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' TranslateLocalGroups Property
|
||
|
|
' - specifies whether to perform security translation on local groups
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' TranslatePrinters Property
|
||
|
|
' - specifies whether to perform security translation on printers
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' TranslateRegistry Property
|
||
|
|
' - specifies whether to perform security translation on registry
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' TranslateShares Property
|
||
|
|
' - specifies whether to perform security translation on shares
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' TranslateUserProfiles Property
|
||
|
|
' - specifies whether to perform security translation on user profiles
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' TranslateUserRights Property
|
||
|
|
' - specifies whether to perform security translation on user rights
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' RestartTime Property
|
||
|
|
' - specifies the time in minutes to wait before re-booting the computers
|
||
|
|
' after migrating
|
||
|
|
' - the valid range is 1 to 10 minutes
|
||
|
|
' - optional, default is 5 minutes
|
||
|
|
'
|
||
|
|
' Migrate Method
|
||
|
|
' - migrate specified computer accounts
|
||
|
|
' - the first parameter specifies whether the names are directly specified or
|
||
|
|
' the names are contained in the specified file or the names are to be
|
||
|
|
' enumerated from the specified domain or ou
|
||
|
|
' - the second parameter specifies the account names to be included
|
||
|
|
' - the third parameter optionally specifies names which are to be excluded
|
||
|
|
'
|
||
|
|
' - Note: Only the specified source OU will be used whether names are
|
||
|
|
' directly specified or specified in a file or the domain is
|
||
|
|
' searched. If no source OU is specified than the root of the domain
|
||
|
|
' is used.
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
' create instance of computer migration object
|
||
|
|
|
||
|
|
Set objComputerMigration = objMigration.CreateComputerMigration
|
||
|
|
|
||
|
|
' set options
|
||
|
|
|
||
|
|
'objComputerMigration.TranslationOption = admtTranslateAdd
|
||
|
|
'objComputerMigration.TranslateFilesAndFolders = False
|
||
|
|
'objComputerMigration.TranslateLocalGroups = False
|
||
|
|
'objComputerMigration.TranslatePrinters = False
|
||
|
|
'objComputerMigration.TranslateRegistry = False
|
||
|
|
'objComputerMigration.TranslateShares = False
|
||
|
|
'objComputerMigration.TranslateUserProfiles = False
|
||
|
|
'objComputerMigration.TranslateUserRights = False
|
||
|
|
'objComputerMigration.RestartDelay = 1
|
||
|
|
|
||
|
|
' migrate computer accounts
|
||
|
|
' the following are some examples of specifying the names and exclude names
|
||
|
|
|
||
|
|
objComputerMigration.Migrate admtData, "CN=Computer1"
|
||
|
|
objComputerMigration.Migrate admtData, Array("/Computers/Computer3","\Computer4")
|
||
|
|
objComputerMigration.Migrate admtFile, "C:\Computers.txt", Array("begins_with*","*contains*","*ends_with")
|
||
|
|
objComputerMigration.Migrate admtDomain, , "C:\ExcludeNames.txt"
|
||
|
|
|
||
|
|
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
' SecurityTranslation Class
|
||
|
|
'
|
||
|
|
' TranslationOption
|
||
|
|
' - specifies whether to add, replace or remove entries from access control lists
|
||
|
|
'
|
||
|
|
' TranslateFilesAndFolders Property
|
||
|
|
' - specifies whether to perform security translation on files and folders
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' TranslateLocalGroups Property
|
||
|
|
' - specifies whether to perform security translation on local groups
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' TranslatePrinters Property
|
||
|
|
' - specifies whether to perform security translation on printers
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' TranslateRegistry Property
|
||
|
|
' - specifies whether to perform security translation on registry
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' TranslateShares Property
|
||
|
|
' - specifies whether to perform security translation on shares
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' TranslateUserProfiles Property
|
||
|
|
' - specifies whether to perform security translation on user profiles
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' TranslateUserRights Property
|
||
|
|
' - specifies whether to perform security translation on user rights
|
||
|
|
' - optional, default is false
|
||
|
|
'
|
||
|
|
' SidMappingFile Property
|
||
|
|
' - specifies whether to use a mapping of SIDs from specified file
|
||
|
|
' - if a SID mapping file is not specified, then security translation
|
||
|
|
' maps SIDs from previously migration objects
|
||
|
|
' - optional, default is none
|
||
|
|
'
|
||
|
|
' Translate Method
|
||
|
|
' - perform security translation on specified computers
|
||
|
|
' - the first parameter specifies whether the names are directly specified or
|
||
|
|
' the names are contained in the specified file or the names are to be
|
||
|
|
' enumerated from the specified domain or ou
|
||
|
|
' - the second parameter specifies the account names to be included
|
||
|
|
' - the third parameter optionally specifies names which are to be excluded
|
||
|
|
' - if specifying NT4 style names for Windows 2000, or greater, domains the name must be
|
||
|
|
' preceded with a backslash
|
||
|
|
' eg. \NT4Name
|
||
|
|
'
|
||
|
|
' - Note: The source domain and OU will be used if not explicitly specified
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
' create instance of security translation object
|
||
|
|
|
||
|
|
Set objSecurityTranslation = objMigration.CreateSecurityTranslation
|
||
|
|
|
||
|
|
' set options
|
||
|
|
|
||
|
|
'objSecurityTranslation.TranslationOption = admtTranslateAdd
|
||
|
|
'objSecurityTranslation.TranslateFilesAndFolders = False
|
||
|
|
'objSecurityTranslation.TranslateLocalGroups = False
|
||
|
|
'objSecurityTranslation.TranslatePrinters = False
|
||
|
|
'objSecurityTranslation.TranslateRegistry = False
|
||
|
|
'objSecurityTranslation.TranslateShares = False
|
||
|
|
'objSecurityTranslation.TranslateUserProfiles = False
|
||
|
|
'objSecurityTranslation.TranslateUserRights = False
|
||
|
|
'objSecurityTranslation.SidMappingFile = "C:\SidMappingFile.txt"
|
||
|
|
|
||
|
|
' translate security on specified computers
|
||
|
|
' the following are some examples of specifying the names and exclude names
|
||
|
|
|
||
|
|
objSecurityTranslation.Translate admtData, "CN=Computer2"
|
||
|
|
objSecurityTranslation.Translate admtData, Array("/Computers/Computer3","\Computer4")
|
||
|
|
objSecurityTranslation.Translate admtFile, "C:\Computers.txt", Array("begins_with*","*contains*","*ends_with")
|
||
|
|
objSecurityTranslation.Translate admtDomain, , "C:\ExcludeNames.txt"
|
||
|
|
|
||
|
|
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
' ServiceAccountEnumeration Class
|
||
|
|
'
|
||
|
|
' Enumerate Method
|
||
|
|
' - enumerate service accounts on specified computers
|
||
|
|
' - the first parameter specifies whether the names are directly specified or
|
||
|
|
' the names are contained in the specified file or the names are to be
|
||
|
|
' enumerated from the specified domain or ou
|
||
|
|
' - the second parameter specifies the account names to be included
|
||
|
|
' - the third parameter optionally specifies names which are to be excluded
|
||
|
|
' - if specifying NT4 style names for Windows 2000, or greater, domains the name must be
|
||
|
|
' preceded with a backslash
|
||
|
|
' eg. \NT4Name
|
||
|
|
'
|
||
|
|
' - Note: The source domain and OU will be used if not explicitly specified
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
' create instance of service account enumeration object
|
||
|
|
|
||
|
|
Set objServiceAccountEnumeration = objMigration.CreateServiceAccountEnumeration
|
||
|
|
|
||
|
|
' enumerate service accounts on specified computers
|
||
|
|
' the following are some examples of specifying the names and exclude names
|
||
|
|
|
||
|
|
objServiceAccountEnumeration.Enumerate admtData, "CN=Computer1"
|
||
|
|
objServiceAccountEnumeration.Enumerate admtData, Array("/Computers/Computer3","\Computer4")
|
||
|
|
objServiceAccountEnumeration.Enumerate admtFile, "C:\Computers.txt", Array("begins_with*","*contains*","*ends_with")
|
||
|
|
objServiceAccountEnumeration.Enumerate admtDomain, , "C:\ExcludeNames.txt"
|
||
|
|
|
||
|
|
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
' ReportGeneration Class
|
||
|
|
'
|
||
|
|
' Type Property
|
||
|
|
' - specifies the type of report to generate
|
||
|
|
'
|
||
|
|
' Folder Property
|
||
|
|
' - specifies the folder where reports will be generated
|
||
|
|
' - optional, defaults to Reports folder in the ADMT installation folder
|
||
|
|
'
|
||
|
|
' Generate Method
|
||
|
|
' - generate specified report
|
||
|
|
' - the option should be admtNone for the admtReportMigratedAccounts,
|
||
|
|
' admtReportMigratedComputers, admtReportExpiredComputers, and
|
||
|
|
' admtReportNameConflicts reports
|
||
|
|
' - the option must be admtData, admtFile or admtDomain for the
|
||
|
|
' admtReportAccountReferences report
|
||
|
|
' - the include parameter must specify the computers upon which to collect
|
||
|
|
' account reference information if the admtReportAccountReferences report
|
||
|
|
' is specified
|
||
|
|
'----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
' create instance of report generation object
|
||
|
|
|
||
|
|
Set objReportGeneration = objMigration.CreateReportGeneration
|
||
|
|
|
||
|
|
' generate report
|
||
|
|
|
||
|
|
objReportGeneration.Type = admtReportMigratedAccounts
|
||
|
|
'objReportGeneration.Folder = "C:\Program Files\Active Directory Migration Tool\Reports"
|
||
|
|
objReportGeneration.Generate admtNone
|
||
|
|
'objReportGeneration.Generate admtDomain + admtRecurse
|