Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteTo move users from a child domain into its parent domain, treat the parent as the target and the child as the source, then use ADMT 3.2’s User Account Migration Wizard after validating name resolution, permissions, and the required security configuration. The move changes each user’s SID. If existing resources still grant access to the old SID, plan for sIDHistory rather than assuming access will follow automatically. ADMT 3.2 is limited-support software, so pilot the process on the exact Windows versions and applications in your environment before migrating production accounts.
What changes when a child-domain user moves to the parent?
This is an intra-forest domain restructuring when both domains belong to the same Active Directory forest. Microsoft describes ADMT 3.2 as supporting migration of users, groups, and computers both within one forest and between forests. In this scenario, the child domain is the source and the parent domain is the target.
As an Amazon Associate I earn from qualifying purchases.
A migrated account in the parent domain has a target-domain SID. Resources whose access control lists (ACLs) name the old child-domain SID may therefore stop recognizing the user unless you deliberately preserve that SID in sIDHistory or update the resource permissions. Decide which approach applies to each important resource before migration.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallADMT moves directory objects; it does not by itself prove that every dependent service, profile, application, scheduled task, certificate, or synchronization process will work with the target identity. Inventory these dependencies and record the relevant resource ACLs before choosing a migration batch.
#1 Best Overall
- 64 bit | 1 Server with 16 or less processor cores | provides 2 VMs
- For physical or minimally virtualized environments
- Requires Windows Server 2025 User and/or Device Client Access Licenses (CALs) | No CALs are included
- Core-based licensing | Additional license packs required for servers with more than 16 processor cores or to add VMs | 2 VMs whenever all processor cores are licensed.
- Product ships in plain envelope | Activation key is located under scratch-off area on label |Beware of counterfeits | Genuine Windows Server software is branded by Microsoft only.
Prepare the domains and migration accounts
Complete these checks before launching the wizard. Resolve failures during preparation rather than using a production migration to discover DNS, permission, or trust problems.
- Record the topology: source and target DNS domain names, DNS zones, NetBIOS names, domain controllers, functional levels, and the exact Windows versions planned for the ADMT host and Password Export Server (PES), if used.
- Verify name resolution: confirm that hostnames and NetBIOS names resolve between the domains from the planned ADMT host. Microsoft identifies this as a requirement.
- Delegate access: provide source-domain credentials with the rights needed to read and migrate the users. Provide target-domain credentials delegated to create objects in the destination container.
- Plan trust and security dependencies: determine which trust configuration the topology and selected migration options require. An existing forest relationship does not, by itself, establish that every wizard dependency is satisfied.
- Baseline the objects: export the in-scope users’ group memberships, enabled state, UPN, proxy addresses, manager, department, and other attributes required by your organization. Inventory service dependencies, profile locations, delegated rights, scheduled tasks, certificates, applications, and ACLs that contain child-domain SIDs.
- Protect recovery: back up the ADMT server and write a rollback plan before making changes. Keep migration logs and reports with the change record.
Decide whether to migrate passwords and preserve old SIDs
sIDHistory for access to existing resources
Use sIDHistory only when the approved design requires the target account to retain access associated with the old SID. It is a security-sensitive mechanism, not a substitute for identifying resource permissions or validating access. Microsoft’s documented prerequisites for this setup include all of the following:
Rank #2
- Offers quick and easy installation on PC
- The software is licensed for 5 User CAL
- Enable success and failure auditing in both domains.
- Create an empty source-domain group named
{SourceNetBIOSDom}$$$. - On the source domain’s primary domain controller, set
HKLMSystemCurrentControlSetControlLSATcpipClientSupportto1, then restart that controller. - Use target-domain credentials with the
MigratesIDHistoryextended right or equivalent administrator rights.
Confirm that these prerequisites, trust configuration, and audit requirements meet your organization’s security policy before enabling sIDHistory in a migration. Record which accounts need it and which resource owners will validate access.
Password migration with PES
If users need their existing passwords copied, plan a PES deployment and the handling and secure transfer of its encryption key. Test the key and one pilot account first. Microsoft documents that when ADMT and PES migrate account passwords, the migrated account has “User must change password at next logon” enabled by default. Tell pilot users and help-desk staff to expect that first-logon password change; it is by design, not evidence on its own that the migration failed.
Rank #3
- Server 2022 Standard 16 Core
Run a pilot, then migrate in controlled batches
- Freeze the scope. Choose a small pilot OU and save the baseline export. Include representative standard users and, where applicable, users with large group memberships, privileged accounts, service dependencies, and access controlled by old SIDs. Handle privileged users and service accounts according to your organization’s separate controls.
- Validate from the ADMT host. Check source and target name resolution, credentials, permissions, and the approved trust and sIDHistory configuration. Do not proceed while a prerequisite error remains unresolved.
- Install and configure ADMT 3.2. Use Microsoft’s ADMT 3.2 download and migration guide as the procedural references. Confirm the Windows versions involved and account for the support limitations described below.
- Configure PES if required. Secure the encryption key, test the setup, and communicate the first-logon password change before the pilot begins.
- Run the User Account Migration Wizard. Select the source users and target container, then choose attribute, password, and sIDHistory options to match the approved design. Preserve the ADMT logs and migration reports.
- Validate the pilot. Test parent-domain sign-in, UPN and profile behavior, group membership, approved sIDHistory, and access to representative files, applications, mapped drives, scripts, certificates, scheduled tasks, endpoint management, and synchronization services.
- Expand gradually. Migrate controlled batches only after the pilot meets its acceptance checks. Keep source accounts available but controlled under the change plan, document exceptions, and rerun only failed objects after correcting the underlying condition.
- Close out after acceptance. Once business owners confirm the target identities work, disable source accounts according to the change plan. Treat any removal of sIDHistory as a separate, tested security project.
Compatibility limits and known failure modes
Microsoft’s support article, updated February 12, 2026, says ADMT was released for Windows 2000 and Windows Server 2003-era systems and has not been updated for Windows 10, Windows 11, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, or Windows Server 2022. Microsoft characterizes its support as limited and warns that experience depends on the Windows versions being migrated. The article does not establish compatibility with every later Windows release. Test the exact source, target, and ADMT-host versions; do not infer support from a successful test on a different configuration.
| Issue | What to plan for |
|---|---|
| Delegation | Domain controllers cannot use unconstrained delegation as a recommended design. In Microsoft’s documented scenario, running ADMT applications on the target domain controller removes the need for delegation. Evaluate the security and operational implications for your environment rather than enabling unconstrained delegation as a shortcut. |
| LSA protection and password migration | Password migration fails when LSA protection is enabled. Any proposed temporary security change requires security-team review, a backup, and a tested rollback; do not disable a protection control without approval. |
| Security Translation and modern applications | Security Translation can leave modern applications unable to start. Microsoft says uninstalling and reinstalling Store applications can be required. |
| Local profiles | ADMT 3.2 Security Translation does not migrate local profiles; Microsoft describes this as by design. Plan profile handling separately. |
| Error 7422 on objects with child objects | An object that has child objects can fail to migrate with error 7422. Microsoft says the blocking child object must be deleted before migrating the parent object. Assess the impact before deleting anything. |
| TLS 1.0 | Some ADMT paths may require TLS 1.0 to be temporarily enabled. Consult the security team before making this change and define a rollback plan. |
Validate the outcome and preserve a rollback path
Use the same acceptance checklist for each batch and compare its results with the baseline export. Retain ADMT logs and reports, record target-object identifiers and source-account state, and track any exceptions to closure.
Rank #4
- 64 bit | 1 Server with 24 or less processor cores | provides 2 VMs
- For physical or minimally virtualized environments
- Requires Windows Server 2025 User and/or Device Client Access Licenses (CALs) | No CALs are included
- Core-based licensing | Additional license packs required for servers with more than 16 processor cores or to add VMs | 2 VMs whenever all processor cores are licensed.
- Product ships in plain envelope | Activation key is located under scratch-off area on label |Beware of counterfeits | Genuine Windows Server software is branded by Microsoft only.
- Can the user sign in to the parent domain, and did the password behave as expected?
- Are the UPN, required attributes, group memberships, and approved sIDHistory correct?
- Can the user reach representative file shares, printers, applications, mapped drives, and other resources?
- Do profiles, scheduled tasks, certificates, scripts, endpoint management, and synchronization dependencies behave as expected?
- Have the relevant application and resource owners accepted the results before source-account disablement?
Do not delete source accounts or remove sIDHistory before the business owner confirms that required resources and applications work with the target identity. If an acceptance check fails, keep the exception and source-account state governed by the rollback plan while you correct and retest the underlying issue.
Quick Recap
Best Value
- Unlock all the features by installing this product on PC
- The software is licensed for 1 User CAL
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
