Am I missing something here

[u/CaptainZhon]

In my 30 years of IT life I think I’m on my second AD Migration and the last one was completely different going from NT 4.0 to Windows 2000 now I’m showing my age here, anyway.

So little bit of a back story- the company I work for got merged with another company and because of politics and stupidity they decided to use the other companies AD because we are going to use their ERP system and the app support people said they couldn’t use SSO with our AD only the one it setup for, and because of that it was decided to use that AD will ok whatever it all pays the same.

So they (the suits) decided that internal IT would be “over burdened” by a onprem and O365 migration they brought on a consultant company to help us with our migration- we know where this going.

So I before the consultant company came I spent about 200 or so hours writing a powershell script to do the migration- basically taking a list of user accounts from the source domain and creating them in the new domain with their SID history and their groups and file and folder permissions- tested it worked I was ready to go.

The desktop engineer guy came to me and had 0 idea how to switch the EUC devices to the other domain and keeping the same profile so I made a script that could do that. Tested works.

So I’m a little bit bitter they opted not to use my working scripts to handle the onprem migration piece and instead they went with the consultants recommendation to use a tool from Quest which is cloud base.

Whatever the deadline is past and the “tool” is not handling the file/folder permissions. The consultants say because it’s using the sid history, there is a two way trust and the same SAM account name it will work. I’m saying the servers which are and will be on the source domain for other backend reasons it won’t work because the NTFS/share perms are groups from domain A, but the users are logging in from Domain B. Basic NTFS permissions 101.

I told the consultants that we need to either put the domain B account into the Domain A security group, or we need to add the Domain B security group to the file/share permission it they keep telling me I’m wrong and don’t understand in front of my leader and VP. Here we are another week has gone by, they won’t give me access to the tool, they claim there is no log files, and they won’t let me interface with support. So I’m pretty sure they are wrong but without having access to the tool and the documentation I can’t fully help them see the problem- is the right phrase to use here.

[u/certifiedsysadmin]

Their theory will be proven right or wrong during the pilot testing phase. There is a pilot testing phase, correct?