AD domain account data migration method and system, medium and product

Abstract

The invention discloses an AD domain account data migration method and system, a medium and a product, and relates to the field of access control, in the method, firstly, identity data of a source domain account is obtained and synchronized to a target domain controller, and a mapping relation is established through safety identifier priority matching and homonymous account alternative matching; reading migration strategy group information including configuration items such as a target domain name and an exception account number; detecting a terminal login state and a migration condition, and executing full migration of the file data, the configuration file, the application data and the registry information when the condition is met; and finally, by monitoring a migration execution state, automatic rollback is performed when failure is detected, or manual rollback is performed according to an instruction and an account mark is updated. By establishing an account mapping mechanism, a flexible strategy control system and a perfect exception handling process, the problems of inaccurate account matching, uncontrollable migration process, difficulty in exception recovery and the like in the prior art are solved.

Description

Technical Field

[0001] This application belongs to the field of access control, and in particular relates to an Active Directory domain account data migration method, system, medium and product. Background Technology

[0002] With the deepening development of the domestic IT innovation industry, enterprises are increasingly demanding data security and self-control, leading to a large number of enterprises migrating from Microsoft Active Directory (AD) domain controller platforms to domestic domain controller platforms. During the migration process, the complete migration of domain account data is a critical step in ensuring business continuity. However, existing migration technologies suffer from limitations in data synchronization scope and a lack of effective monitoring during the migration process, making it difficult to guarantee the complete migration of all data, including file data, application configurations, and registry information.

[0003] Related technologies typically employ a subdomain to replace the parent domain for migration, or use data synchronization tools to copy accounts. Some solutions also achieve account information conversion and synchronization by establishing an intermediate database.

[0004] However, while these solutions can complete basic account information migration, they cannot guarantee data consistency when dealing with complex scenarios such as security identifier mapping and permission inheritance. Secondly, they lack effective exception handling and rollback mechanisms, which may affect business continuity if the migration fails. In addition, the data integrity verification and status monitoring capabilities during the migration process are insufficient, making it difficult to meet the reliability requirements of enterprise-level deployments. Summary of the Invention

[0005] This application provides a method, system, medium, and product for migrating Active Directory (AD) domain account data, addressing issues of data integrity, migration efficiency, and business continuity when enterprises migrate from a Microsoft Active Directory (AD) domain controller platform to a domestically developed domain controller platform. This method achieves efficient and reliable migration of domain account data by establishing a dual mapping mechanism between security identifiers and account names, combined with policy group configuration and full data migration, and provides both automatic and manual rollback safeguards during the migration process.

[0006] Firstly, this application provides a method for migrating Active Directory domain account data, including: Obtain the identity data of the source domain account and synchronize it to the target domain controller. Establish a mapping relationship based on the security identifier and the account name. The identity data includes the security identifier, account name and permission configuration. The establishment of the mapping relationship prioritizes security identifier matching. When the security identifiers are inconsistent, the same account name matching is used. Read migration policy group configuration information, wherein the migration policy group includes at least one of the following: target domain name, exception account, migration prompt information, forced migration switch, and exit source domain configuration; The terminal login status and migration conditions are detected. If the migration conditions are met, the full data migration of the source domain account is performed. The full data includes file data, configuration files, application data and registry information. Monitor the migration execution status. If a failure is detected, perform an automatic rollback operation to restore the state before the migration. If a rollback instruction is received, perform a manual rollback operation and mark the corresponding account as no longer triggering automatic migration.

[0007] By adopting the above technical solution, this application first obtains the identity data of the source domain account and synchronizes it to the target domain controller. A mapping relationship is established through priority matching of security identifiers and alternative matching of accounts with the same name. The migration policy group information, including the target domain name and exception accounts, is read. Then, the terminal login status and migration conditions are detected. When the conditions are met, a full migration of file data, configuration files, application data, and registry information is performed. Finally, by monitoring the migration execution status, automatic rollback is implemented when a failure is detected, or manual rollback is performed according to instructions, and account tags are updated. By establishing a reliable account mapping mechanism, a flexible policy control system, and a comprehensive exception handling process, the problems of inaccurate account matching, uncontrollable migration process, and difficulty in exception recovery existing in the prior art are solved. In conjunction with some implementations of the first aspect, in some implementations, before obtaining the identity data of the source domain account and synchronizing it to the target domain controller, the method further includes: Verify the accessibility status of the source and target domain controllers on the management platform, detect account data changes, and perform real-time incremental updates.

[0008] By adopting the above technical solution, this application first verifies the system status of the source domain controller, the target domain controller, and the management platform to ensure that the data of the three parties can be read and written normally; then, it detects data changes in real time, and once changes are detected in the source domain data, it immediately performs incremental update operations to maintain real-time data synchronization; it realizes the verification of system status before migration and ensures the accuracy of data synchronization, reducing migration interruptions and data inconsistency problems caused by system anomalies. In conjunction with some implementations of the first aspect, in some implementations, reading the migration strategy group configuration information specifically includes: Check the configuration status of the target domain name. If the target domain name is not configured, set the migration scope to all source domain accounts. Read the list of exception accounts and mark the corresponding accounts as excluded from migration. Verify the character length of the prompt message. If the character length exceeds the range, truncate the prompt message to a preset character length while maintaining the integrity of the Chinese characters. Get the status of the forced migration switch. If the switch is on, set migration completion as a prerequisite for login. The system checks the source domain exit configuration. If configured for a single account, it performs the source domain exit operation on the account that has completed the migration. If configured for all accounts, it waits until all accounts have been migrated before performing the source domain exit operation.

[0009] To adapt to the migration needs and business scenarios of different enterprises, a flexible and controllable migration strategy configuration mechanism needs to be established. By adopting the above technical solution, this application first detects the target domain name configuration status and intelligently determines the migration scope based on the configuration. Then, it uses an exception account list to exclude specific accounts from migration. Next, it performs character length verification and Chinese character integrity protection on the prompt information. At the same time, it sets login control policies based on the forced migration switch status. Finally, it handles the source domain exit sequence for single accounts and all accounts respectively based on the exit source domain configuration. This achieves precise control of the migration scope and standardized management of the migration process, improving the flexibility and controllability of the migration. In conjunction with some implementations of the first aspect, in some implementations, the detection of terminal login status and migration conditions specifically includes: Obtain the source domain account list and the target domain controller account list from the local computer, compare the account login names, and mark the source domain account as pending migration if there is no duplicate name between the source domain account and the target domain controller account. Check the account activity status. If the account is in a normal state and there is a valid mapping relationship, trigger the data migration operation. Monitor the data migration progress and update the displayed information when the progress changes; Check the migration completion status. If the migration is complete, perform a terminal restart operation.

[0010] By adopting the above technical solution, this application first identifies source domain accounts without duplicate name conflicts by comparing local account lists and marks them as pending migration; then, it ensures that the triggering conditions for the migration operation are complete by checking account activity status and verifying mapping relationships; next, it monitors the migration progress in real time and dynamically updates the displayed information to maintain the visibility of the migration process; finally, after confirming that the migration is complete, it automatically restarts the terminal to activate the new configuration; thus, it achieves accurate judgment of migration conditions and monitoring of the migration process, effectively avoids duplicate account name conflicts, and ensures the accuracy and reliability of the migration operation. In conjunction with some implementations of the first aspect, in some implementations, monitoring the migration execution status specifically includes: Detect the status of system components and trigger an automatic rollback process in case of missing components or abnormal data reading; Receive a rollback request and, if the request contains valid migration records, execute a manual rollback process; Verify the rollback execution result. If the rollback is successful, restore the source domain account data and update the account status. Record rollback process information and generate log records containing error codes in case of abnormalities during the process; Summarize the rollback statistics and upload the results to the management platform once data collection is complete.

[0011] To ensure the reliability and traceability of the domain account migration process, a comprehensive status monitoring and anomaly handling mechanism is needed. However, existing anomaly handling mechanisms are relatively simple, lacking proactive detection of system component states and comprehensive recording of the migration process. For example, when encountering component anomalies, data read failures, or situations requiring manual intervention, problems are often not detected and quickly resolved. By adopting the aforementioned technical solution, this application first achieves proactive anomaly detection and automatic rollback through system component status detection; then, it handles manual rollback requests to ensure the controllability of the rollback operation; next, it verifies the rollback execution results and restores data pointers to ensure account state consistency; simultaneously, it records anomaly information during the rollback process, generating standardized error logs; finally, it summarizes statistical data and uploads it to the management platform. This achieves timely detection and rapid recovery of migration anomalies, ensuring the continuity of business systems and the integrity of data. In conjunction with some implementations of the first aspect, in some implementations, before performing the full data migration of the source domain accounts, the method further includes: Detect the terminal environment status and obtain storage space, system permissions, and running status parameters; If the storage space is insufficient to meet a preset threshold, an insufficient space alarm will be generated and the migration operation will be terminated. If the system permissions are insufficient, automatically request the necessary file read / write and registry access permissions; If the system resource usage exceeds a preset threshold, the priority of the migration task will be adjusted.

[0012] By adopting the above technical solution, this application first ensures that the terminal has sufficient storage space and necessary system permissions through comprehensive environmental testing; then, it avoids migration interruption due to insufficient space through storage space threshold checks and early warning mechanisms; next, it solves the problem of insufficient permissions affecting migration through an automatic permission application mechanism; and finally, it ensures stable system operation through system resource monitoring and task priority adjustment. This achieves automatic environmental testing and intelligent resource allocation before migration, reducing problems such as migration interruption, restricted permissions, and excessive system load that exist in existing technologies. In conjunction with some implementations of the first aspect, in some implementations, after adjusting the migration task priority, the method further includes: Files exceeding the preset size are processed according to the preset block size, and each data block is transmitted and a checksum is generated. If an abnormal system interruption is detected, the current migration progress information is recorded, and execution resumes from the breakpoint after the system recovers. Obtain the list of currently running programs; if a preset protection program is detected to be running, add the preset protection program to the protection list and pause the data migration of the preset protection program. Monitor system resource usage. If CPU usage or disk I / O wait time exceeds a preset threshold, reduce data migration speed to a preset ratio until system resource usage falls back below the threshold.

[0013] By adopting the above technical solution, this application first achieves efficient migration and data integrity verification of large files through a file block processing mechanism; then, in the event of a system abnormal interruption, it records the current migration progress information and resumes execution from the interruption point after the system recovers, ensuring that execution can continue from the interruption point after a system abnormal interruption; next, through a protection mechanism for the running program, it avoids the migration process from affecting the normal operation of critical business programs; finally, through dynamic monitoring of system resources and adaptive adjustment of migration speed, it ensures the overall stability of the system; thus, it achieves reliability protection of the data migration process and rational utilization of system resources, reducing problems such as data migration interruption, business interference, and system load imbalance existing in the prior art. In a second aspect, embodiments of this application provide an Active Directory (AD) domain account data migration system, comprising: one or more processors and a memory; the memory is coupled to one or more processors, the memory is used to store computer program code, the computer program code including computer instructions, and one or more processors call the computer instructions to cause the system to perform the method described in the first aspect and any possible implementation thereof. Thirdly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a system, cause the system to perform the method described in the first aspect and any possible implementation thereof. Fourthly, embodiments of this application provide a computer program product that, when run on a system, causes the system to execute the method described in any possible implementation of the first aspect. One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages: 1. This application provides a method for migrating Active Directory (AD) domain account data. First, it obtains the identity data of the source domain account and synchronizes it to the target domain controller. A mapping relationship is established through priority matching of security identifiers and alternative matching of accounts with the same name. Then, it reads migration policy group information containing configuration items such as the target domain name and exception accounts. Next, it detects the terminal login status and migration conditions. When the conditions are met, it performs a full migration of file data, configuration files, application data, and registry information. Finally, it monitors the migration execution status and automatically rolls back when a failure is detected, or performs a manual rollback and updates the account markers according to instructions. By establishing a reliable account mapping mechanism, a flexible policy control system, and a comprehensive exception handling process, it solves the problems of inaccurate account matching, uncontrollable migration process, and difficulty in exception recovery existing in the prior art.

[0014] 2. This application provides a method for migrating Active Directory (AD) domain account data. First, it detects the target domain's configuration status and intelligently determines the migration scope based on the configuration. Then, it excludes specific accounts from migration through an exception account list. Next, it verifies the character length and protects the integrity of Chinese characters in the prompt message. Simultaneously, it sets login control policies based on the forced migration switch status. Finally, it handles the exit sequence of single accounts and all accounts based on the exit source domain configuration. This achieves precise control of the migration scope and standardized management of the migration process, improving the flexibility and controllability of the migration.

[0015] 3. This application provides an Active Directory (AD) domain account data migration method. First, it ensures that the terminal has sufficient storage space and necessary system permissions through comprehensive environment detection. Then, it avoids migration interruption due to insufficient space through storage space threshold checks and early warning mechanisms. Next, it solves the problem of insufficient permissions affecting migration through an automatic permission request mechanism. Finally, it ensures stable system operation through system resource monitoring and task priority adjustment. It realizes automatic environment detection and intelligent resource allocation before migration, reducing problems such as migration interruption, restricted permissions, and excessive system load existing in the prior art. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating an AD domain account data migration method in an embodiment of this application.

[0017] Figure 2 This is a conceptual diagram of the data migration principle in the embodiments of this application.

[0018] Figure 3 This is a schematic diagram of the physical device structure of an AD domain account data migration system provided in an embodiment of this application. Detailed Implementation

[0019] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to any or all possible combinations including one or more of the listed items.

[0020] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more. In the field of enterprise information systems, domain account management and data migration are key aspects of ensuring business continuity.

[0021] In related technologies, when migrating from the Microsoft Active Directory domain controller platform to a domestic domain controller platform, the main methods used are subdomain replacement or simple data synchronization. These methods have many shortcomings when dealing with complex account mapping relationships and abnormal situations, which can easily lead to problems such as incomplete data, migration interruption, or abnormal access to business systems.

[0022] This application is primarily applied to the localization and transformation of enterprise information systems, particularly in the migration of large enterprises from Microsoft Active Directory (AD) domain controller platforms to domestically developed domain controller platforms. These application scenarios often involve a large number of end users, complex permission systems, and diverse business systems, placing high demands on the integrity, reliability, and business continuity of data migration. To address these technical issues, this application provides an AD domain account data migration method, system, medium, and product. The following example demonstrates this process. Figure 1 The present application describes an AD domain account data migration method according to an embodiment of the present application: Please see Figure 1 This is a flowchart illustrating an AD domain account data migration method in an embodiment of this application.

[0023] S101. Obtain the identity data of the source domain account and synchronize it to the target domain controller, and establish a mapping relationship based on the security identifier and account name.

[0024] The identity data includes security identifiers, account names, and permission configurations. The mapping relationship is established by prioritizing security identifier matching, and when the security identifiers are inconsistent, the same account name is used for matching.

[0025] Specifically, the domestic domain controller management platform (AM) establishes a secure connection with the source Active Directory domain controller through its built-in synchronizer module. The synchronizer employs a specially designed data capture engine capable of accurately acquiring complete identity data of the source domain account. This identity data primarily includes three core elements: Security Identifier (SID), account name, and permission configuration information. The Security Identifier is a string used in Windows to uniquely identify a user or group; the account name is the identifier used for user login; and the permission configuration includes information such as the user's access permissions and group membership. The acquired identity data is temporarily stored in the management platform's data storage area, which utilizes high-performance storage devices (such as SSD arrays) to ensure efficient data processing. The synchronizer preprocesses the stored data, including data format standardization and integrity verification, preparing for subsequent mapping relationship establishment. When establishing the mapping relationship, the system employs a two-dimensional matching mechanism. The preferred matching method is precise matching through the Security Identifier, as each Security Identifier is unique within the domain, maximizing the accuracy of the mapping. For example, when a user's SID in the source domain is "S-1-5-21-xxxxxxxx", the system will first search for an account with the same SID in the target domain controller. If found, a mapping relationship will be established directly. When a security identifier mismatch occurs (a common occurrence in cross-domain migrations), the system will automatically switch to a matching method based on account name. In this case, the system will search for an account with the same name as the source domain account in the target domain controller and establish a mapping relationship. For example, if an account "user1" exists in the source domain, but its SID does not match in the target domain controller, the system will search for an account named "user1" in the target domain controller. If found, a mapping relationship will be established. To ensure the reliability of the mapping process, the system also implements a verification mechanism for the mapping results. Each time a mapping relationship is established, the system verifies its validity, including checking the compatibility of permission configurations and the consistency of account states. These verification results are recorded in the management platform's logs for administrator auditing and troubleshooting.

[0026] Furthermore, before acquiring the identity data of the source domain account and synchronizing it to the target domain controller, the accessibility status of the source and target domain controllers on the management platform is verified, account data changes are detected, and real-time incremental updates are performed.

[0027] Specifically, the system establishes connections with the source and target domain controllers through the management platform (AM). The system performs status verification: first, it tests the accessibility of the source domain controller to verify service responsiveness; then, it checks the system status of the target domain controller to ensure data synchronization requirements are met; finally, it verifies that the management platform can access both domain controllers normally. To maintain real-time data consistency, the system implements a data change detection mechanism. The management platform periodically (every 5 minutes by default) sends query requests to the source domain controller to check for updates to account information. These updates may include creating accounts, deleting accounts, and modifying permissions. When a change is detected, the system immediately triggers an incremental update process. Incremental updates employ a differentiated synchronization strategy: the system compares the data versions of the source and target domain controllers and only synchronizes the changed portions, rather than resynchronizing all data. This approach improves synchronization efficiency and reduces system resource consumption. For example, when the permission configuration of an account in the source domain controller changes, the system only synchronizes the latest permission information for that account, without affecting other unchanged data.

[0028] S102. Read the migration policy group configuration information; wherein, the migration policy group includes at least one of the following: target domain name, exception account, migration prompt information, forced migration switch, and exit source domain configuration.

[0029] Specifically, policy group configuration is implemented through the policy configuration module of the Management Platform (AM), employing a hierarchical storage structure to ensure the integrity and reliability of configuration information. First, the system processes the target domain configuration. Target domain configuration supports multi-domain scenarios; administrators can specify one or more AD domains to be migrated within the policy group. When a target domain is not configured, the system invokes the default policy, setting the migration scope to all source domain accounts. For example, in a government department's migration project involving domain controllers of multiple subordinate units, multi-domain synchronous migration was successfully achieved through target domain configuration. For handling exceptional accounts, the system implements a flexible account exclusion mechanism. Administrators can import a list of exceptional accounts through the policy group configuration interface, supporting both batch import and manual addition. The system marks these accounts as excluded from migration and establishes a special identifier in the database. For example, domain administrator accounts and critical business system accounts are typically set as exceptional accounts to ensure that these accounts are not automatically migrated and affect business operations. When processing migration prompts, the system employs an intelligent text processing mechanism. First, it verifies the character length of the prompt message, with a default limit of 200 characters. When excessively long text is detected, the system activates an intelligent truncation algorithm to ensure the integrity of Chinese characters is not compromised during the truncation process. Simultaneously, the system supports rich text formatting, allowing users to set text color, size, and style using HTML tags to improve the readability of prompts. The configuration of the forced migration switch directly affects the enforcement strength of the migration strategy. When the switch is enabled, the system writes the migration completion status into the login control policy, implementing forced migration by modifying the login script. Users who have not completed the migration will receive a forced migration prompt when attempting to log in, and must complete the migration to continue using the system. The source domain exit configuration supports two modes: single-account mode and full-account mode. In single-account mode, the system triggers a source domain exit operation immediately after each account completes the migration; this mode is suitable for batch migration scenarios. In full-account mode, the system sets exit trigger conditions, executing source domain exit only after all non-exception accounts have completed the migration; this mode is more suitable for one-time migration scenarios. To improve configuration management efficiency, the system also implements a policy group template function. Administrators can save frequently used configuration combinations as templates for direct use in subsequent projects, significantly reducing the workload of repetitive configuration. For example, different policy group templates can be created for enterprises of different sizes, containing corresponding combinations of configuration parameters. Meanwhile, to ensure configuration security, the system implements a version control mechanism. Each modification to the policy group configuration generates a new version record, supporting configuration rollback and historical tracing. All configuration changes are logged in detail, including information such as the person making the change, the time of the change, and the content of the change.

[0030] S103. Detect the terminal login status and migration conditions; if the migration conditions are met, perform a full data migration of the source domain account, including file data, configuration files, application data, and registry information.

[0031] like Figure 2 As shown, the source domain account and the target domain account are connected to the underlying file data, configuration files, application data, etc. The file data, configuration files, application data, etc. are disconnected from their previous pointers and re-pointed to the target domain account.

[0032] Specifically, the system first retrieves the source domain account list and the target domain controller account list from the local computer. By comparing the account login names, it determines whether there are any duplicate names. If the source domain account and the target domain controller account do not have duplicate names, the system marks the source domain account as pending migration, thus clearly defining the range of accounts that need to be migrated. Next, it checks the account activity status. Data migration will only be triggered if the account is in a normal state and has a valid mapping relationship, avoiding invalid migration. During the data migration process, the system monitors the migration progress. Once the progress changes, the displayed information is updated, allowing users to understand the migration status at any time and preventing users from making mistakes due to lack of awareness. When the migration is detected as complete, the system will perform a terminal restart operation to make the migration effective.

[0033] In this embodiment, step S103 also includes pre-migration preparation checks and security controls during the migration process. Before performing the migration operation, the system detects the terminal environment status and obtains storage space, system permissions, and running status parameters: First, it checks the storage space; if the storage space is insufficient to meet a preset threshold, the system generates an insufficient space alarm and terminates the migration operation. Second, it checks permissions; the system verifies whether it has sufficient operating permissions, and if system permissions are insufficient, it automatically requests the necessary file read / write and registry access permissions. Simultaneously, the system monitors the running status, and if system resource usage exceeds a preset threshold, it adjusts the migration task priority.

[0034] During the migration process, files exceeding a preset size are processed according to preset block sizes, and the block data is transmitted and a checksum is generated. In the event of a system interruption, the system records migration progress information and resumes execution from the breakpoint upon system recovery. Simultaneously, the system retrieves a list of currently running programs; if a preset protection program is detected running, it adds the program to the protection list and pauses the relevant data migration. Furthermore, the system continuously monitors system resource usage; if CPU utilization or disk I / O wait time exceeds a preset threshold, the data migration speed is reduced to a preset ratio until system resource usage falls below the preset threshold.

[0035] S104. Monitor the migration execution status; in the event of a failure, perform an automatic rollback operation to restore the state before the migration; upon receiving a rollback instruction, perform a manual rollback operation and mark the corresponding account as no longer triggering automatic migration.

[0036] Specifically, the system tracks the migration process in real time through a status monitoring module, focusing on data migration status, system resource status, network connection status, and application status. For example, regarding data migration status, the system tracks file transfer progress and configuration synchronization; for system resource status, it monitors system metrics such as CPU utilization, memory usage, and disk I / O; for network connection status, it monitors the communication quality with the source and target domain controllers in real time; and for application status, it focuses on the operation of critical business programs. When the system detects a migration failure, it automatically triggers a rollback operation. The rollback process first immediately stops all ongoing migration tasks, then deletes the migrated data at the target location, restores the original configuration of the source domain account, and finally cleans up temporary files generated during the migration process and resets the terminal login status. For example, when a file transfer interruption or configuration synchronization failure is detected, the system immediately starts the rollback procedure to ensure the system returns to its pre-migration state. For manual rollback scenarios, the system employs a more stringent control mechanism. First, the system verifies the legitimacy of the rollback command, confirming its origin from an authorized administrator. Then, before executing the rollback, it automatically backs up the current state for later analysis. After the rollback is complete, the account is marked as "disabled from automatic migration." Finally, a detailed rollback log is recorded, including the rollback reason and operation time. This mechanism ensures the controllability and traceability of manual rollback operations. The system also implements a tiered alarm mechanism, triggering corresponding alarms for different anomalies. For general issues such as single file transfer failures, the system automatically retryes; for critical issues such as failures to synchronize key configurations, it notifies the administrator for confirmation; for emergencies such as data corruption, the rollback procedure is immediately initiated. After each rollback operation, the system generates a detailed rollback report, including analysis of the rollback trigger cause, the affected data range, the execution process of the rollback operation, and confirmation of system state recovery, providing a basis for subsequent problem analysis and system optimization.

[0037] In the above embodiments, a domestically developed domain controller management platform (AM) was used to achieve a full-process data migration of Active Directory (AD) domain accounts. First, the platform obtains the source domain account identity data and establishes a mapping relationship through the synchronizer module, employing a two-dimensional matching mechanism to ensure mapping accuracy. Second, the policy configuration module enables flexible management of migration policies, supporting multi-domain scenarios and handling of exceptional accounts. Then, during data migration, the system performs a comprehensive environment check and employs a chunked transmission mechanism to ensure the stability of the migration process. Finally, the status monitoring module enables real-time monitoring and anomaly handling of the migration process, including both automatic and manual rollback mechanisms. The entire migration process ensures both the integrity and reliability of the data migration and the continuous and stable operation of the business system, effectively solving the technical challenges faced by enterprises in the process of localizing domain controller platforms.

[0038] The system in the embodiments of this invention is described below from the perspective of hardware processing. Please refer to [link / reference needed]. Figure 3 This is a schematic diagram of the physical device structure of an AD domain account data migration system provided in an embodiment of this application.

[0039] It should be noted that, Figure 3 The structure of the system shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0040] like Figure 3 As shown, the system includes a Central Processing Unit (CPU) 301, which can perform various appropriate actions and processes based on a program stored in Read-Only Memory (ROM) 302 or a program loaded from storage portion 308 into Random Access Memory (RAM) 303, such as executing the methods described in the above embodiments. The RAM 303 also stores various programs and data required for system operation. The CPU 301, ROM 302, and RAM 303 are interconnected via a bus 304. An Input / Output (I / O) interface 305 is also connected to the bus 304.

[0041] The following components are connected to I / O interface 305: input section 306 including a camera, infrared sensor, etc.; output section 307 including a liquid crystal display (LCD) and speakers, etc.; storage section 308 including a hard disk, etc.; and communication section 309 including a network interface card such as a LAN (Local Area Network) card and a modem, etc. Communication section 309 performs communication processing via a network such as the Internet. Drive 310 is also connected to I / O interface 305 as needed. Removable media 311, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 310 as needed so that computer programs read from them can be installed into storage section 308 as needed.

[0042] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing computer programs for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 309, and / or installed from removable medium 311. When the computer program is executed by central processing unit (CPU) 301, it performs the various functions defined in the present invention.

[0043] It should be noted that the computer-readable medium shown in the embodiments of the present invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. The transmitted data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof.

[0044] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0045] In another aspect, the present invention also provides a computer-readable storage medium, which may be included in the system described in the above embodiments; or it may exist independently and not assembled into the system. The storage medium carries one or more computer programs that, when executed by a processor of a system, cause the system to implement the methods provided in the above embodiments.

[0046] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0047] As used in the above embodiments, depending on the context, the term "when..." can be interpreted as "if...", "after...", "in response to determining...", or "in response to detecting...". Similarly, depending on the context, the phrase "when determining..." or "if (the stated condition or event) is interpreted as "if determining...", "in response to determining...", "when (the stated condition or event) is detected", or "in response to detecting (the stated condition or event)".

[0048] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.

[0049] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A method for migrating Active Directory domain account data, characterized in that, include: Obtain the identity data of the source domain account and synchronize it to the target domain controller. Establish a mapping relationship based on the security identifier and the account name. The identity data includes the security identifier, account name and permission configuration. The establishment of the mapping relationship prioritizes security identifier matching. When the security identifiers are inconsistent, the same account name matching is used. Read migration policy group configuration information, wherein the migration policy group includes at least one of the following: target domain name, exception account, migration prompt information, forced migration switch, and exit source domain configuration; The terminal login status and migration conditions are detected. If the migration conditions are met, the full data migration of the source domain account is performed. The full data includes file data, configuration files, application data and registry information. Monitor the migration execution status. If a failure is detected, perform an automatic rollback operation to restore the state before the migration. If a rollback instruction is received, perform a manual rollback operation and mark the corresponding account as no longer triggering automatic migration.

2. The method according to claim 1, characterized in that, Before obtaining the identity data of the source domain account and synchronizing it to the target domain controller, the method further includes: Verify the accessibility status of the source and target domain controllers on the management platform, detect account data changes, and perform real-time incremental updates.

3. The method according to claim 1, characterized in that, The reading of migration strategy group configuration information specifically includes: Check the configuration status of the target domain name. If the target domain name is not configured, set the migration scope to all source domain accounts. Read the list of exception accounts and mark the corresponding accounts as excluded from migration. Verify the character length of the prompt message. If the character length exceeds the range, truncate the prompt message to a preset character length while maintaining the integrity of the Chinese characters. Get the status of the forced migration switch. If the switch is on, set migration completion as a prerequisite for login. The system checks the source domain exit configuration. If configured for a single account, it performs the source domain exit operation on the account that has completed the migration. If configured for all accounts, it waits until all accounts have been migrated before performing the source domain exit operation.

4. The method according to claim 1, characterized in that, The detection terminal login status and migration conditions specifically include: Obtain the source domain account list and the target domain controller account list from the local computer, compare the account login names, and mark the source domain account as pending migration if there is no duplicate name between the source domain account and the target domain controller account. Check the account activity status. If the account is in a normal state and there is a valid mapping relationship, trigger the data migration operation. Monitor the data migration progress and update the displayed information when the progress changes; Check the migration completion status. If the migration is complete, perform a terminal restart operation.

5. The method according to claim 1, characterized in that, The monitoring migration execution status specifically includes: Detect the status of system components and trigger an automatic rollback process in case of missing components or abnormal data reading; Receive a rollback request and, if the request contains valid migration records, execute a manual rollback process; Verify the rollback execution result. If the rollback is successful, restore the source domain account data and update the account status. Record rollback process information and generate log records containing error codes in case of abnormalities during the process; Summarize the rollback statistics and upload the results to the management platform once data collection is complete.

6. The method according to claim 1, characterized in that, Before performing the full data migration of the source domain accounts, the method further includes: Detect the terminal environment status and obtain storage space, system permissions, and running status parameters; If the storage space is insufficient to meet a preset threshold, an insufficient space alarm will be generated and the migration operation will be terminated. If the system permissions are insufficient, automatically request the necessary file read / write and registry access permissions; If the system resource usage exceeds a preset threshold, the priority of the migration task will be adjusted.

7. The method according to claim 6, characterized in that, After adjusting the migration task priority, the method further includes: Files exceeding the preset size are processed according to the preset block size, and each data block is transmitted and a checksum is generated. If an abnormal system interruption is detected, the current migration progress information is recorded, and execution resumes from the breakpoint after the system recovers. Obtain the list of currently running programs; if a preset protection program is detected to be running, add the preset protection program to the protection list and pause the data migration of the preset protection program. Monitor system resource usage. If CPU usage or disk I / O wait time exceeds a preset threshold, reduce data migration speed to a preset ratio until system resource usage falls back below the threshold.

8. An Active Directory (AD) domain account data migration system, characterized in that, The system includes: One or more processors and a memory; the memory is coupled to the one or more processors, the memory being used to store computer program code, the computer program code including computer instructions, the one or more processors invoking the computer instructions to cause the system to perform the method as described in any one of claims 1-7.

9. A computer-readable storage medium comprising instructions, characterized in that, When the instructions are executed on the system, the system performs the method as described in any one of claims 1-7.

10. A computer program product, characterized in that, When the computer program product is run on the system, the system performs the method as described in any one of claims 1-7.

Images