MoveTree: The Active Directory Object Manager

Last week I talked to our network and infrastructure people, who were lamenting how Windows 2000 ships with almost no tools to help with Active Directory (AD) maintenance and administration. We pondered how strange it is to ship such a wonderful technology without the proper tools to maintain and administer it. Since Win2K shipped, we've written tools that help manage AD and other directory services. "What you really need to write," said my head network engineer, Chris George, "is an AD pruning and grafting tool." "You mean a Win32 the user could use to drag an organizational unit (OU) from one domain and drop it into another?" I asked. "Exactly, but Web-based," he replied.

Before diving into such a project, I set off to do a little research. During my research, I stumbled upon the Active Directory Object Manager (Movetree.exe), which ships in the Win2K Support Tools. You might remember from my previous columns that the Win2K Support Tools are installed from the Win2K Server, Advanced Server, or Data Center Server CD-ROMs but aren't installed with the OS. You can find the installation packages in the CD-ROMs' Support folders.

MoveTree is a command-line tool that lets IIS administrators move AD objects, such as OUs and users, between domains in a single forest. IIS administrators use this type of tool to consolidate domains or for organizational restructuring.

MoveTree syntax is fairly straightforward:

movetree {/start | /startnocheck | /continue | /check} /s SrcDSA /d DstDSA /sdn SrcDN /ddn DstDN [/u [Domain\]Username /p Password]  [/verbose] [{/? | /help}]

Here's a brief description of the parameters (for more information, see the Win2K Support Tools help file):

MoveTree returns ErrorLevel 0 for success and ErrorLevels 1 to 5 for different kinds of failure. This is a powerful function because these values can be used as a criterion for branching when the tool is used in a batch file. Below are the error level meanings:

1--command line syntax 2--directory conflict (duplicate names, insufficient privilege, name conflict, immovable object) 3--network error (domain controller (DC) unavailable)4--system resource (low Virtual Machine (VM), disk space) 5--internal processing error

In the following example, the MoveTree command performs a test run, and if no errors are encountered, then moves the Engineers OU from the Engineers domain to the NetWorkGuys domain and renames the Engineers OU to NetOps:

movetree /start /s Server1.Engineers.InterKnowlogy.Com /dServer2.NetworkGuys.InterKnowlogy.com /sdn OU=Engineers,DC=InterKnowlogy,DC=Com /ddn OU=NetOps,DC=Engineers,DC=InterKnowlogy,DC=Com

MoveTree lets you move an OU from one domain to another but leaves all the Group Policy Objects (GPOs) linked to the original domain. After you move the GPO link, it continues to function properly. But clients receive their Group Policy settings from the GPOs located in the moved-from domain. Obviously, this action is inefficient. Instead, before executing the MoveTree command, review all GPOs that apply to a particular OU and note the Group Policy settings they contain. Then, using the desired settings, recreate those GPOs that are linked to the moved OU in the moved-to domain. When you're done, make sure you remove the GPOs that are linked from the old domain.

MoveTree has certain limitations, some obvious and some not so obvious, that are well documented in the Windows Support Tools help file. Nonetheless, MoveTree is a viable and powerful tool for your maintenance arsenal.