New-ADXMigrationUser

Examples

Example 1: Add a user to a complete migration plan, then validate, preview, and apply the plan.

$plan = New-ADXMigrationPlan -SourceDomain old.contoso.com -DestinationDomain new.contoso.com -SourceDomainController old-pdc.old.contoso.com -DestinationDomainController new-dc01.new.contoso.com -DestinationOrganizationalUnit 'OU=Migrated,DC=new,DC=contoso,DC=com' -SourceAuditReady -SourceTcpipClientSupportReady -ResourceAclScanCompleted -BusinessJustification CAB-1234 {
                New-ADXMigrationUser -SourceSamAccountName alice -DestinationSamAccountName alice -CopyAttribute mail,displayName,department,title -CredentialStrategy ResetRandom -MigrateMembership
                New-ADXMigrationResource -Path '\\FS1\Finance' -ReAclMode AddDestinationBeforeRemoveSource
            }
            if ($plan | Test-ADXMigrationPlan) {
                $preview = $plan | Invoke-ADXMigrationPlan
                $preview.Phases | Format-Table Kind, Item, Status, Changed, Message -AutoSize
                $plan | Invoke-ADXMigrationPlan -Intent read_write -AllowWrite -Apply -WriteExecutionId mig-2026-001 -WriteActorId pklys -WriteChangeReason CAB-1234 -WriteRollbackPlanId rollback-CAB-1234
            }
        

Example 2: Plan a user with a temporary password reference and inspect credential and SIDHistory phases before apply.

$plan = New-ADXMigrationPlan -SourceDomain old.contoso.com -DestinationDomain new.contoso.com -DestinationOrganizationalUnit 'OU=Migrated,DC=new,DC=contoso,DC=com' -SourceAuditReady -SourceTcpipClientSupportReady -ResourceAclScanCompleted -BusinessJustification CAB-1234 {
                New-ADXMigrationUser -SourceSamAccountName bob -CredentialStrategy SetTemporary -CredentialSecretReference 'vault://migration/CAB-1234/bob-temp' -ForceCredentialChangeAtNextLogon
            }
            $checked = $plan | Test-ADXMigrationPlan -PassThru
            $checked.Issues | Format-Table Severity, Code, Target, Message -AutoSize
            $checked.Phases | Where-Object { $_.Kind -in 'PrepareDestination','CredentialStrategy','SidHistory','Validate' } | Format-Table Kind, Item, Description -AutoSize
        

Example 3: Use an external password filter or sync provider instead of PES/hash-copy style password migration.

$plan = New-ADXMigrationPlan -SourceDomain old.contoso.com -DestinationDomain new.contoso.com -DestinationOrganizationalUnit 'OU=Migrated,DC=new,DC=contoso,DC=com' -SourceAuditReady -SourceTcpipClientSupportReady -ResourceAclScanCompleted -BusinessJustification CAB-1234 {
                New-ADXMigrationUser -SourceSamAccountName carol -CredentialStrategy ExternalSyncProvider -CredentialProviderName 'Evotec.PasswordSync' -MigrateMembership
            }
            $plan | Test-ADXMigrationPlan -PassThru | Select-Object -ExpandProperty Phases | Format-Table Kind, Item, IsMutating, Description -AutoSize
            $plan | Invoke-ADXMigrationPlan
        

Example 4: Skip SIDHistory only after replacement access and resource re-ACL work are represented in the plan.

$plan = New-ADXMigrationPlan -SourceDomain old.contoso.com -DestinationDomain new.contoso.com -DestinationOrganizationalUnit 'OU=Migrated,DC=new,DC=contoso,DC=com' -ResourceAclScanCompleted -BusinessJustification CAB-1234 {
                New-ADXMigrationUser -SourceSamAccountName dave -NoSidHistory -CredentialStrategy Manual
                New-ADXMigrationResource -Path '\\FS1\Archive' -ReAclMode ReportOnly
            }
            $plan | Test-ADXMigrationPlan -PassThru | Select-Object -ExpandProperty Phases | Format-Table Kind, Item, Description -AutoSize