Exporting and importing Active Directory users

Question

We need to export all the users (~20000) to newly installed Active Directory 2016 server from our existing Active Directory 2012 server, the problem is that we have not user passwords, and I wonder if we can somehow transfer the encrypted passwords to the new server?

Answer 1

You shouldn't need to manually import or export anything, as Active Directory natively supports replication – you can add a new DC to the existing domain, and later shut down the old DC.

1. Join the new server to the old domain. Do not "create" the domain on it.
2. Install Active Directory Domain Services, and promote the new server to a domain controller. This will automatically copy the entire AD database to it.
3. Transfer the operations master roles to the new DC (see blog posts below).
4. Demote the old DC to a regular server – or perhaps keep it as a secondary DC.

See the TechNet posts on migrating from Server 2003 to 2008 and Server 2008 to 2012.