Hi, I am planning to consoliate 2 Windows 2003 AD forests due to an acquisition. Both the forests are in Windows 2000 Native mode. All DCs in both locations are running Windows 2003. I know that ADMT will not migrate Builtin Groups(DomainAdmins,Domain Users)from source to target domains. I am aware that the source domain shares have been configured with permissions for "Domain Users" group. That being the case, I need to do security translation for this Group "SourceDomain\Domain Users" in the Target Domain. How do I do that? Can I use ADMT or can I use other utilities and achieve the same result? Thanks in advance AD Professional

I don't think the ADMT is smart enough (or flexible enough) to do something like that. You might look at a tool like Quest's Migration suite, but it is not cheap.

Jim, Thanks for your reply. In my previous project for the same requirement - I remembermy team members had done security translation of those Well Known SIDswithout the help of 3rd party tools. I am figuring out what they did now. But meanwhile I understand that Internet community may have a better idea or the same idea with graphical details. Thanks for your time Thanks AD Professional

Hello, you may want to go ahead and perform so called offline translation where you createSID mapping file. In the file you need to include source domain\domain users SID [coma] target domain\domain users SID. Using the SID mapping file to perform security translation in add mode should resolve your issue... Regards, Marcin