Skip to content

Commit a430c69

Browse files
WFord26WFord26
committed
Add Check-ADMTPrerequisites script and documentation for ADMT migration readiness validation
1 parent e5de3f7 commit a430c69

6 files changed

Lines changed: 560 additions & 4 deletions

File tree

‎docs/wiki/Assessments/OnPremise/Check-ADMTPrerequisites.md‎

Lines changed: 302 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,302 @@
1+
# Check-ADMTPrerequisites
2+
3+
## Overview
4+
PowerShell script that validates environment readiness for Active Directory Migration Tool (ADMT) migrations. Performs comprehensive prerequisite checks including domain functional levels, trust relationships, network connectivity, permissions, and optional SID History and Password Export Server (PES) requirements.
5+
6+
This script helps identify and resolve issues **before** starting an ADMT migration project, reducing migration failures and downtime.
7+
8+
## Features
9+
- **DNS Resolution Validation** - Verifies both source and target domains are resolvable
10+
- **Domain Functional Level Checks** - Ensures domains meet minimum requirements
11+
- **Trust Relationship Analysis** - Validates trust type, direction, and configuration
12+
- **Permission Verification** - Confirms current user has necessary administrative rights
13+
- **Network Connectivity Testing** - Tests critical AD ports (LDAP, Kerberos, SMB, RPC, etc.)
14+
- **SID History Prerequisites** - Optional validation for SID History migration requirements
15+
- **Password Export Server (PES) Checks** - Optional PES installation and configuration validation
16+
- **SQL Server Detection** - Identifies SQL Server instances for ADMT database
17+
- **ADMT Installation Status** - Checks if ADMT is already installed
18+
- **Detailed Reporting** - Color-coded console output and CSV export with remediation steps
19+
20+
## Prerequisites
21+
- **PowerShell**: 5.1 or later
22+
- **Required Modules**:
23+
- ActiveDirectory (RSAT Tools)
24+
- **Permissions**:
25+
- Domain Admin in target domain (recommended)
26+
- Read access to source domain
27+
- Ability to query both source and target domains
28+
- **Network**:
29+
- Connectivity to domain controllers in both domains
30+
- DNS resolution for both domains
31+
32+
## Parameters
33+
34+
### Required Parameters
35+
36+
- **SourceDomain**: FQDN of the source domain (domain you're migrating FROM)
37+
- Example: `"old.contoso.com"`, `"legacy.fabrikam.com"`
38+
39+
### Optional Parameters
40+
41+
- **TargetDomain**: FQDN of the target domain (domain you're migrating TO)
42+
- Default: Current domain (Get-ADDomain).DNSRoot
43+
- Example: `"new.contoso.com"`
44+
45+
- **CheckSIDHistory**: Switch parameter to include SID History prerequisite checks
46+
- Validates auditing, connectivity to source PDC, and special group creation
47+
- Example: `-CheckSIDHistory`
48+
49+
- **CheckPES**: Switch parameter to check Password Export Server requirements
50+
- Validates PES installation prerequisites
51+
- Example: `-CheckPES`
52+
53+
- **SourcePDC**: FQDN of source domain PDC Emulator
54+
- Required when using `-CheckSIDHistory`
55+
- Example: `"dc01.old.contoso.com"`
56+
57+
## Usage Examples
58+
59+
### Example 1: Basic Prerequisites Check
60+
```powershell
61+
.\Check-ADMTPrerequisites.ps1 -SourceDomain "old.contoso.com" -TargetDomain "new.contoso.com"
62+
```
63+
Performs core prerequisite checks for ADMT migration between two domains.
64+
65+
### Example 2: Full Check with SID History
66+
```powershell
67+
.\Check-ADMTPrerequisites.ps1 -SourceDomain "old.contoso.com" -TargetDomain "new.contoso.com" -CheckSIDHistory -SourcePDC "dc01.old.contoso.com"
68+
```
69+
Includes SID History prerequisites with connectivity tests to source PDC.
70+
71+
### Example 3: Check with Password Migration
72+
```powershell
73+
.\Check-ADMTPrerequisites.ps1 -SourceDomain "legacy.fabrikam.com" -CheckPES -CheckSIDHistory -SourcePDC "pdc.legacy.fabrikam.com"
74+
```
75+
Complete prerequisite check including Password Export Server requirements.
76+
77+
### Example 4: Target Current Domain
78+
```powershell
79+
.\Check-ADMTPrerequisites.ps1 -SourceDomain "old.domain.com"
80+
```
81+
Checks migration to current domain (useful when running from target domain controller).
82+
83+
## Check Categories
84+
85+
### 1. DNS Resolution
86+
- **Source Domain DNS**: Verifies source domain FQDN resolves to IP addresses
87+
- **Target Domain DNS**: Verifies target domain FQDN resolves to IP addresses
88+
- **Purpose**: Ensures basic network connectivity and name resolution
89+
90+
### 2. Domain Functional Levels
91+
- **Target Domain Level**: Reports target domain functional level
92+
- **Target Forest Level**: Reports target forest functional level
93+
- **Source Domain Level**: Validates source meets minimum (Windows 2000 Native)
94+
- **Purpose**: ADMT requires minimum functional levels for proper operation
95+
96+
### 3. Trust Relationships
97+
- **Trust Existence**: Verifies trust relationship exists between domains
98+
- **Trust Direction**: Validates trust direction (BiDirectional optimal, Outbound sufficient)
99+
- **Trust Type**: Reports trust type (External, Forest, etc.)
100+
- **Purpose**: Target must trust Source for ADMT to read source objects
101+
102+
### 4. Permission Checks
103+
- **Target Domain Admin**: Verifies current user is Domain Admin in target
104+
- **Source Domain Read**: Confirms read access to source domain objects
105+
- **Purpose**: ADMT requires admin rights in target and read rights in source
106+
107+
### 5. SID History Prerequisites (Optional with `-CheckSIDHistory`)
108+
- **Auditing Configuration**: Validates account management auditing on source PDC
109+
- **TCP Port 138**: Tests connectivity to source PDC on port 138 (NetBIOS)
110+
- **Special Group**: Documents requirement for `$SourceDomain$$$` group on source PDC
111+
- **Purpose**: SID History migration requires specific source domain configuration
112+
113+
### 6. Password Export Server (Optional with `-CheckPES`)
114+
- **PES Installation Location**: Confirms PES must be on source domain DC
115+
- **Encryption Key**: Documents 128-bit key requirement
116+
- **Purpose**: Password migration requires PES installation on source domain
117+
118+
### 7. Network Connectivity
119+
Tests critical Active Directory ports to target domain controller:
120+
- **Port 389**: LDAP
121+
- **Port 636**: LDAPS (secure LDAP)
122+
- **Port 3268**: Global Catalog
123+
- **Port 88**: Kerberos
124+
- **Port 135**: RPC Endpoint Mapper
125+
- **Port 445**: SMB (file sharing)
126+
- **Purpose**: ADMT requires multiple AD protocols for migration operations
127+
128+
### 8. Database Requirements
129+
- **SQL Server Detection**: Checks for existing SQL Server installations
130+
- **SQL Server Express**: Notes that ADMT can install SQL Express if needed
131+
- **Purpose**: ADMT requires SQL Server for migration database
132+
133+
### 9. ADMT Installation Status
134+
- **Installation Directory**: Checks for C:\Windows\ADMT directory
135+
- **Registry Keys**: Verifies ADMT registration in system
136+
- **Purpose**: Determines if ADMT is already installed
137+
138+
## Output
139+
140+
### Console Output
141+
Color-coded results displayed in terminal:
142+
- **🟢 PASS** (Green): Check passed successfully
143+
- **🔴 FAIL** (Red): Critical issue requiring resolution
144+
- **🟡 WARNING** (Yellow): Non-critical issue or potential problem
145+
- **🔵 INFO** (Cyan): Informational message
146+
147+
Each failed check includes:
148+
- Description of the issue
149+
- **Remediation** steps to resolve the problem
150+
151+
### CSV Export
152+
Automatically exports results to timestamped CSV file:
153+
- **Filename Pattern**: `ADMT_Prerequisites_YYYYMMDD_HHmmss.csv`
154+
- **Columns**: Check, Status, Message, Remediation
155+
- **Location**: Current directory
156+
157+
### Summary Report
158+
Final summary shows:
159+
- Total checks performed
160+
- Count of PASS, FAIL, WARNING, and INFO results
161+
- List of all failed items requiring attention
162+
- Path to exported CSV file
163+
164+
## Common Issues & Troubleshooting
165+
166+
### Issue: Source Domain DNS Resolution Fails
167+
**Symptoms**: Cannot resolve source domain FQDN
168+
169+
**Solution**:
170+
- Verify DNS server configuration on ADMT server
171+
- Add conditional forwarders for source domain
172+
- Test with `nslookup source.domain.com`
173+
- Check firewall allows DNS (UDP/TCP 53)
174+
175+
### Issue: No Trust Relationship Found
176+
**Symptoms**: Trust check fails with "No trust relationship found"
177+
178+
**Solution**:
179+
- Establish trust between domains (minimum: target trusts source)
180+
- For full functionality, create two-way trust
181+
- Verify trust with: `Get-ADTrust -Filter * -Server target.domain.com`
182+
- Use Active Directory Domains and Trusts MMC snap-in
183+
184+
### Issue: Permission Denied on Source Domain
185+
**Symptoms**: Cannot read from source domain
186+
187+
**Solution**:
188+
- Ensure account has at least read permissions in source domain
189+
- Add account to source domain's Domain Users group (minimum)
190+
- For password migration, account needs additional source domain rights
191+
- Consider using dedicated migration account with proper permissions
192+
193+
### Issue: Port Connectivity Failures
194+
**Symptoms**: Multiple port checks fail to target DC
195+
196+
**Solution**:
197+
- Check firewall rules between ADMT server and target DC
198+
- Verify Windows Firewall on target DC allows inbound connections
199+
- Test manually: `Test-NetConnection -ComputerName targetdc.domain.com -Port 389`
200+
- Review any network security groups or hardware firewalls
201+
202+
### Issue: SID History Port 138 Fails
203+
**Symptoms**: Cannot connect to TCP port 138 on source PDC
204+
205+
**Solution**:
206+
- Enable NetBIOS on source PDC
207+
- Open TCP port 138 in firewalls
208+
- Verify source PDC hostname/IP is correct
209+
- Consider using `-SourcePDC` parameter with PDC FQDN
210+
211+
### Issue: Source Domain Functional Level Too Low
212+
**Symptoms**: Source domain level below Windows 2000 Native
213+
214+
**Solution**:
215+
- Raise source domain functional level:
216+
```powershell
217+
Set-ADDomainMode -Identity "source.domain.com" -DomainMode Windows2003Domain
218+
```
219+
- Ensure all DCs support higher functional level first
220+
- Cannot be reversed - verify compatibility before raising
221+
222+
## ADMT Migration Checklist
223+
224+
Use this script as part of your ADMT migration preparation:
225+
226+
### Pre-Migration Phase
227+
1. ✅ Run Check-ADMTPrerequisites.ps1 with `-CheckSIDHistory` and `-CheckPES`
228+
2. ✅ Resolve all FAIL status items
229+
3. ✅ Review and address WARNING items
230+
4. ✅ Document current configuration (export CSV for records)
231+
5. ✅ Obtain necessary credentials (Domain Admin in target, read access in source)
232+
233+
### Trust Configuration
234+
1. ✅ Establish minimum trust (target trusts source)
235+
2. ✅ Verify trust with `nltest /trusted_domains`
236+
3. ✅ Test trust authentication: `runas /netonly /user:source\username cmd`
237+
238+
### SID History Setup (if needed)
239+
1. ✅ Enable auditing on source domain PDC
240+
2. ✅ Verify TCP port 138 connectivity
241+
3. ✅ Run first migration to create `$SourceDomain$$$` group
242+
243+
### Password Migration Setup (if needed)
244+
1. ✅ Install Password Export Server on source domain DC
245+
2. ✅ Generate and securely store encryption key
246+
3. ✅ Configure PES service account
247+
248+
### ADMT Installation
249+
1. ✅ Install SQL Server (or allow ADMT to install SQL Express)
250+
2. ✅ Install ADMT on target domain member server
251+
3. ✅ Create ADMT migration database
252+
4. ✅ Configure ADMT service account
253+
254+
### Post-Installation Validation
255+
1. ✅ Re-run Check-ADMTPrerequisites.ps1
256+
2. ✅ Perform test migration with pilot group
257+
3. ✅ Validate migrated objects and permissions
258+
4. ✅ Document migration procedures
259+
260+
## Related Scripts
261+
- [Get-ComprehensiveADReport](Get-ComprehensiveADReport.md) - Assess source and target AD environments before migration
262+
- [Start-FileShareAssessment](Start-FileShareAssessment.md) - Assess file shares that may need permission updates post-migration
263+
264+
## Best Practices
265+
266+
### Run Early and Often
267+
- Run this script **weeks before** planned migration
268+
- Re-run after resolving issues to verify fixes
269+
- Run immediately before migration window as final validation
270+
271+
### Document Everything
272+
- Save all CSV exports for compliance and troubleshooting
273+
- Screenshot any FAIL or WARNING results
274+
- Maintain change log of remediation actions
275+
276+
### Staged Validation
277+
1. **Initial Run**: Identify all issues and plan remediation
278+
2. **Mid-Preparation**: Verify fixes and identify new issues
279+
3. **Pre-Migration**: Final validation before migration window
280+
4. **Post-Migration**: Verify environment remains properly configured
281+
282+
### Security Considerations
283+
- Run script from secure workstation
284+
- Use dedicated migration service account (not personal admin account)
285+
- Store credentials securely (never in scripts or logs)
286+
- Review permissions granted to migration accounts
287+
- Remove migration accounts and trusts after project completion
288+
289+
## Version History
290+
- **v1.0** (2026-01-14): Initial release
291+
- Core prerequisite checks for ADMT migrations
292+
- DNS, functional level, trust, and permission validation
293+
- Network connectivity testing
294+
- Optional SID History and PES checks
295+
- CSV export with remediation guidance
296+
- Summary reporting
297+
298+
## See Also
299+
- [Microsoft ADMT Documentation](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc974332(v=ws.10))
300+
- [ADMT Guide](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc974376(v=ws.10))
301+
- [Active Directory Migration Best Practices](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/planning-domain-controller-placement)
302+
- [SID History Migration](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc974394(v=ws.10))

‎docs/wiki/_Sidebar.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626

2727
### On-Premise Infrastructure
2828
- [Get-ComprehensiveADReport](Get-ComprehensiveADReport)
29+
- [Check-ADMTPrerequisites](Check-ADMTPrerequisites)
2930
- [Start-FileShareAssessment](Start-FileShareAssessment)
3031

3132
### PKI

‎docs/wiki/home.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,13 @@ Active Directory and Windows Server assessment tools:
3434
- Cross-domain and cross-forest query support
3535
- Migration recommendations and data quality analysis
3636
- Executive summary with matching strategies
37+
- **[Check-ADMTPrerequisites](Check-ADMTPrerequisites)** - ADMT migration readiness validation
38+
- Domain functional level and trust relationship checks
39+
- Permission and network connectivity validation
40+
- SID History and Password Export Server prerequisites
41+
- Port connectivity testing for all AD protocols
42+
- Automated remediation guidance
43+
- CSV export with pass/fail/warning status
3744
- **[Start-FileShareAssessment](Start-FileShareAssessment)** - Comprehensive file share assessment with Excel reporting
3845
- Automatic SMB share discovery
3946
- Storage analysis and NTFS permission mapping

‎scripts/Assessment/On Premise/Check-ADMTPrerequisites.ps1‎

Whitespace-only changes.

‎scripts/Assessment/On Premise/README.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,43 @@ This folder contains scripts for assessing on-premise Windows Server infrastruct
4747

4848
---
4949

50+
#### [Check-ADMTPrerequisites.ps1](Check-ADMTPrerequisites.ps1)
51+
**Purpose**: Validate environment readiness for Active Directory Migration Tool (ADMT) migrations
52+
53+
**Features**:
54+
- DNS resolution validation for source and target domains
55+
- Domain functional level checks
56+
- Trust relationship analysis (type, direction, configuration)
57+
- Permission verification (Domain Admin, read access)
58+
- Network connectivity testing (LDAP, Kerberos, SMB, RPC, etc.)
59+
- Optional SID History prerequisite checks
60+
- Optional Password Export Server (PES) validation
61+
- SQL Server detection for ADMT database
62+
- Color-coded console output with remediation guidance
63+
- Automated CSV export with pass/fail/warning status
64+
65+
**Quick Start**:
66+
```powershell
67+
# Basic ADMT prerequisites check
68+
.\Check-ADMTPrerequisites.ps1 -SourceDomain "old.contoso.com" -TargetDomain "new.contoso.com"
69+
70+
# Include SID History checks
71+
.\Check-ADMTPrerequisites.ps1 -SourceDomain "old.contoso.com" -TargetDomain "new.contoso.com" -CheckSIDHistory -SourcePDC "dc01.old.contoso.com"
72+
73+
# Full check with password migration
74+
.\Check-ADMTPrerequisites.ps1 -SourceDomain "legacy.fabrikam.com" -CheckPES -CheckSIDHistory -SourcePDC "pdc.legacy.fabrikam.com"
75+
```
76+
77+
**Documentation**: [Full Documentation](../../../docs/wiki/Assessments/OnPremise/Check-ADMTPrerequisites.md)
78+
79+
**Typical Use Cases**:
80+
- Pre-migration validation for ADMT projects
81+
- Troubleshooting ADMT connectivity issues
82+
- Documenting migration prerequisites for compliance
83+
- Validating trust relationships and permissions
84+
- Network connectivity verification between domains
85+
- SID History migration preparation
86+
5087
### File Share Assessment
5188

5289
#### [Start-FileShareAssessment.ps1](Start-FileShareAssessment.ps1)

0 commit comments

Comments
 (0)