Migrating users and groups

Begin by migrating users and groups from the Windows NT domains in which they were created to new Active Directory domains.

1. Use the procedures defined by Microsoft to migrate users and groups from the Windows NT domains to the Active Directory domains.
   Include the HCL VersionVault users group and, if they exist, the HCL VersionVault administrators group and versionvault_albd account in the migration.
2. Ensure uninterrupted VOB access.
   In many migration scenarios, there is a period when users logged on to the Active Directory domain access the same VOBs as users logged on to a Windows NT domain. To ensure access to VOBs by users in either type of domain, do one of the following:
   • Add the domain-qualified name of the HCL VersionVault users group that has been migrated to the Active Directory domain to the VOB's supplemental group list. For example, you can use the cleartool protectvob command as shown here to add the clearusers group in the Active Directory domain AD-DOMAIN to the group list of the VOB with storage on the VOB server host at C:\vobstg\srcs.vbs:

     cleartool protectvob –add_group AD-DOMAIN\clearusers C:\vobstg\srcs.vbs

   • Ask users who are logged on to an Active Directory domain to set their CLEARCASE_PRIMARY_GROUP environment variable to the string representation of the SID of the HCL VersionVault users group in the Windows NT domain. To find the SID string, run the creds command on a computer that is a member of the Windows NT domain or a domain that trusts the Windows NT domain. For example:

     versionvault-home-dir\etc\utils\creds –g NT-DOMAIN\clearusers. . .
     
     VersionVault group info:    
     Name: NT-DOMAIN\clearusers    
     GID:  0x100423 SID credentials S-1-5-21-103034363-981818062-1465874335-1064

     In this case, the user must set CLEARCASE_PRIMARY_GROUP to the value S-1-5-21-103034363-981818062-1465874335-1064
3. Adjust CLEARCASE_GROUPS environment variables as needed.
   Because migrated accounts include SID history, user accounts in the Active Directory domain include twice as many group memberships as they had in the Windows NT domain. (Each user's group list includes groups from both domains.) Users who are members of multiple groups in a Windows NT domain and find that their group list includes more than 32 groups after migration should set the CLEARCASE_GROUPS environment variable to include the SID string that represents the HCL VersionVault users group in the Windows NT domain, and the name of the HCL VersionVault users group in the Active Directory domain. For example:

   CLEARCASE_GROUPS=AD-DOMAIN\clearusers;S-1-5-21-103034363-981818062-1465874335-1064

   Step 2 explains how to use creds to obtain the SID string. For more information about the CLEARCASE_GROUPS environment variable, see Limitations when a user belongs to more than 32 groups.