Removed user from one domain and added to another. Noteboo..

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Hi everybody,
I did a really foolish thing yesterday, and I'm trying to figure out a way
to restore a user's security info.

I have a mobile user that wanted to use Outlook Web Access.
We are in the middle of a conversion from NT domains/ Exchange 5.5 server to
a 2003 AD/Exchange 2003 configuration.
This user was converted several weeks ago to the AD structure.
We haven't set up OWA on the new Exchange 2003 server, so he hasn't had
access to OWA.

The guy has made my life a living hell for the past week, so my boss told me
to migrate him back to the NT 4 domain, so the problem will go away for a
couple of weeks.

I copied his mailbox out to a local PST, and deleted the AD user and the
Exchange mailbox.

I then created an account on the old NT 4 domain along with a Exchange
account on 5.5 and then migrated it over to the 2003 Exchange server, like
the remaining NT 4 users.

I tested his account in-house and everything worked ( logging into a
workstation with the NT 4 Domain User name and password. I also imported his
email and sent and received emails successfully.

I called him and gave him the new domain and login info.

He logs into his notebook ok, and can VPN into our site using the NT 4
user/pad I set up.
However, his outlook is unable to connect to the Exchange 2003 server.
He received an error indicating a user name and password failure.

It turns out that my predecessor had set the notebook up as a member of the
2003 AD structure.
The user is logging into his notebook with the AD domain name and password.
This works because that information is cached locally.
I think what is happening is when he attempts to authenticate to the
Exchange server, that server is checking the credentials, and of course
there is no longer any user account in the AD.

Can I create a user in the AD structure and change the security ID to match
the old deleted user?
Any other ideas?
If I remove the notebook from the domain, this guys profile is going to be
boned.
Is there a way I can grab all of his user profile, etc. off of the AD
account on the notebook, and transfer it over to a new user account local to
his notebook. ( I.a. I want to drop the notebook from the AD and place it in
a dummy workgroup, and create a user with the same name and password for the
notebook. )

Any ideas?

Paul Landry

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

> I think what is happening is when he attempts to authenticate to the
> Exchange server, that server is checking the credentials, and of course
> there is no longer any user account in the AD.

Why is he pointing at the Ex2003 box? Change his profile to point to the
Ex55 box you just moved him to.


> Can I create a user in the AD structure and change the security ID to
> match the old deleted user?

Yes and no. You can achieve this, but in a slightly different manner --you
would create a new user and add the old user's SID to the sIDHistory
attribute.


> Any other ideas?

Yep.


> If I remove the notebook from the domain, this guys profile is going to be
> boned. Is there a way I can grab all of his user profile, etc. off of the
> AD account on the notebook, and transfer it over to a new user account
> local to his notebook. ( I.a. I want to drop the notebook from the AD and
> place it in a dummy workgroup, and create a user with the same name and
> password for the notebook. )

Add him to the other domain. Logon as an administrator and reset the
permissions on the existing profile so that the NT-domain user has full
control.

If that doesn't work, copy the old profile to the new one using the profile
tool in Windows.

--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net