FAQ: Why Domain-Joined Migration Workstations are Bad
Domain-Joined Migration Workstations are Highly Not-Recommended
However, Universal Migrator may approve domain-joined Migration Workstations on an as-needed, case-by-case basis.
Migrations are complex, highly-technical operations. A key aspect of a good migration specialist is reducing and eliminating risk.
When a Migration Workstation is joined to a domain, it increases the risk to the project for a number of reasons.
Common Issues to Expect
Below is a non-inclusive list of problems consultants often encounter when using domain-joined migration workstations.
Removing a Device from a Domain does not Alleviate these concerns.
Often times when a device is removed from a domain, artifacts remain that can still impact its ability to operate according to expectations.
Group Policy Enforced Update/Reboot Schedules
When a migration starts, it should run until completed.
We often seen migrations experience challenges when a group-policy forces a domain-joined migration workstation to reboot in the middle of a migration.
Group Policy Approved Apps
A migration workstation will be configured with a number of apps that are outside the list of typically used apps within an organization.
We often see migrations experience issues because the migration workstation is not allowed to run all of the necessary applications.
Group Policy Approved App Versions
Similar to the above, we often see that when an exception is made, it is only made for a specific version of the application.
When software (like Universal Migrator) updates, the updated EXE may not be on the approved list. This means that at any point, software that might have worked, might stop working once an update is installed.
Group Policy Enforced Antivirus
Document migrations should be done quickly.
Often times group policy enforces that each file being transferred be re-scanned before being transferred. While this sounds like a good idea, forcing a virus scan on terabytes of data can really slow down the migration.
Group Policy Enforced Permissions
When using a domain-joined computer, often times permissions are quite restrictive on the migration specialist may not have the necessary permissions to fully utilize the migration workstation.
Transfer Restrictions
Some organizations implement data transfer restrictions in order to protect against data exfiltration.
These restrictions directly interfere with data migrations into cloud-based systems.
Suggested Workarounds
Due to the issues above, we highly recommend not using a domain joined computer.
If you must use a domain joined Migration Workstation, you should set it up as follows:
- Create a dedicated OU for the Migration Workstation
- Ensure the user account provided to the Migration Specialist is a full admin of the Migration Workstation
- Ensure no policies exist that could interfere with the migration or the tools on the migration workstation.