Best practice - migrate only password

I wasn't able to find this exact scenario in the forum. Please advise.

I intend to migrate my accounts to target with a predetermined password so I can log in as each user and configure and test their profiles.

Right before they log in, I want to migrate their source password and set the account to force a change when they log in.

I have tested setting pwdlastset to 0 on the target, and I'm using a FGPP to temporarily avoid the password policy on target.

That looks OK.

My main concern is there doesn't seem to be an option to ONLY modify the password. Once the attributes have been set on the target, I don't want the source to make any changes.

Do I just need to exclude all the attributes when I create the migration session?

What about the attributes it doesn't allow to exclude, eg mail, mailnickname?

Thanks for your time.

Top Replies

Jeff Shahan over 2 years ago +1 verified

So the greyed out attribute can not be skipped but most of them are not synced anyway. The exchange related attribute for instance are actually handled by a sub process related to the Exchange tab setting…

Parents

+1 Jeff Shahan over 2 years ago

So the greyed out attribute can not be skipped but most of them are not synced anyway. The exchange related attribute for instance are actually handled by a sub process related to the Exchange tab setting. As long as that is not set, they will not be populated

also there is a registry key you can set of the directory sync host that will change the password migration policy. this will allow you not to have to deal with changing the pwdlastset in the source. See the tail end of this KB https://support.quest.com/migration-manager-for-ad/kb/13871/password-copy-sync-process-and-password-setting-behavior-in-quest-migration-manager
Cancel
Up +1 Down

Reply

Verify Answer

Reject Answer

Cancel

Reply

+1 Jeff Shahan over 2 years ago

So the greyed out attribute can not be skipped but most of them are not synced anyway. The exchange related attribute for instance are actually handled by a sub process related to the Exchange tab setting. As long as that is not set, they will not be populated

also there is a registry key you can set of the directory sync host that will change the password migration policy. this will allow you not to have to deal with changing the pwdlastset in the source. See the tail end of this KB https://support.quest.com/migration-manager-for-ad/kb/13871/password-copy-sync-process-and-password-setting-behavior-in-quest-migration-manager
Cancel
Up +1 Down

Reply

Verify Answer

Reject Answer

Cancel

Children

No Data