Processing of permissions on Organizational Units

You can use Migration Sessions to migrate the OU's and their permissions.  This requires a license with Migration Sessions enabled, not just a DIrectory Synchronization License.

Luke

Hey Luke,

Thanks for your answer.

Can you maybe explain how this is done?

We already created the structure in the target which is a bit different from the source. So i first need to create a link between source and target for the concerning OU's.

The permissions are afterwards processed via active directory processing or is this done directly via the migration session?

With kind regards,

Sebastian

I would have to test this, perhaps someone else reading may have more insight, but I don't believe we can merge OU's.  The problem is that they would not match the 3 matching rules required to merge with MMAD.  Email Address, Samaccountname, Sid History.  Perhaps I'm wrong.  

Usually, you would use MMAD to migrate the OU's with their permissions in a Migration Session.

https://support.quest.com/migration-manager-for-ad/kb/20404/how-to-properly-migrate-the-ou-structure-from-source-to-the-target-ad-active-directory-using-qmm

The NOTE: QMM cannot migrate OU permissions which have been inherited. If IsInherited = True on the ACE then the ACE will not copy to the target domain. QMM logically cannot migrate inherited permissions from the domain root or from other domains. 

https://support.quest.com/migration-manager-for-ad/kb/20404/how-to-properly-migrate-the-ou-structure-from-source-to-the-target-ad-active-directory-using-qmm

The NOTE: QMM cannot migrate OU permissions which have been inherited. If IsInherited = True on the ACE then the ACE will not copy to the target domain. QMM logically cannot migrate inherited permissions from the domain root or from other domains.