Whether it is possible to transfer painlessly client PCs from one AD to another?

Question

Active Directory

For example, there is a network of 30 PCs and AD DS. And AD just died. And we did not have time to untie anyone from him. And now we have a sad picture. Is it possible to just pick up a new one again and connect clients without problems without reinstalling the axes?

Answer 1

Simply not. Each machine will have to be unlinked from the domain and tied to a new one, and user accounts will be transferred. First, you will need to create all users in the domain.
This utility will help you a lot to transfer user accounts from domain to domain without losing settings and profile files. https://www.forensit.com/domain-migration.html

Answer 2

I had experience in transferring a certain number (several dozen) of computers from one domain to another. But the old domain worked for me. Briefly, so:
1. We deduce a computer from the domain (the password of the local administrator on a computer needs to be known BEFORE it!). Reboot.
2. We enter under the Administrator (local).
3. Rename the user profile (you can copy it if you have time, on slow disks / computers and when there are a lot of files - you can lose a lot of time), for example, add a couple of numbers at the end.
4. (At this stage, you must already have a working AD and created users in it) We enter the computer into a new domain. Reboot.
5. We enter under the necessary user in the new domain. We wait for the full load, exit the system (or, even better, reboot).
6. We enter under any account with administrator rights (either local or domain, if the policies have already been registered, and the necessary groups have already been registered in the administrators). We add to the Administrators group the user that was logged in earlier. Delete the newly created user profile (empty). Rename the old one as it was. We exit the system.
7. We enter under the desired user. We register this user in security in the properties of the folder (profile), apply the settings, wait a bit. If inheritance is enabled and nothing has been reconfigured separately, then we no longer configure rights. And it is better to go to the add. settings and click "replace inherited permissions", and wait a bit more.
8. We go in the same user in regedit, we prescribe ourselves the rights to the HKCU branch and nested ones (it will swear at some, but usually this is not critical).
9. We delete this user from administrators. We reboot.
10. We plant the user - we say: Done, check!
profit.
There may be nuances in different OSes, but in general the scenario is this. When we prescribe the security of folders or the registry, do not forget to delete the old user from the old domain so that he does not try to look for him and does not slow down.
!!! ATTENTION !!! If the user had encrypted folders using EFS - do not restart the computer, if it is turned off - disconnect the cable (so that there is no ethernet network), and log in with the old account (win xp - win7 OS definitely allow multiple logins without access to the domain, they cache the password) . Then copy these folders and files to a FS without encryption support, for example, to a fat / exfat flash drive. Otherwise, the data will then be difficult (but possible) to get.