我们正在扩展现有的软件产品，该产品使用 Active Directory 将用户凭据存储到 云解决方案以存储用户凭据。
我想知道如何将这些 AD 密码迁移/移植到新数据库，而不是要求用户重置密码。我知道我们无法检索普通密码，但我想了解我们如何移植这些密码并使用特定的解密库来验证这些密码。
我们可以将这个密码移动到新的 SQL 数据库，但是我们要如何验证密码呢？我们将使用哪种加密算法和盐？
谢谢，
【问题讨论】：
标签： encryption active-directory passwords
本月大部分时间我都在与一位将各种 Active Directory 林整合到一个域中的客户合作。我们没有使用任何第三方工具——只是标准的 Microsoft 实用程序，即 Active Directory 迁移工具 (ADMT) v3 和 Exchange 迁移向导（Exchange Server 2003 部署工具之一）——但它们似乎可以完成这项工作。
由于将数百名用户迁移到新帐户（使用新密码）会导致大量支持电话，因此我想让 ADMT 密码迁移 DLL 正常工作。这花了一些时间，但在我的企业支持同事的帮助下（实际上是一个 PSS 电话），我们找到了解决办法。这是需要的：
（作为参考，源域和目标域都处于 Windows Server 2003 域和林功能模式，运行 Windows Server 2003 和 Service Pack 1 和 2。）
Make sure that there is a trust in place between the source and target domains.
Install ADMT by running admtsetup.exe and follow the installation wizard on the computer that will be used for the migration (I used a domain controller in the source domain but ideally you would have dedicated computers for migration activities and it seems logical that this should be in the target domain).
If not already created by ADMT, create a new domain local group called domainname$$$. This group must be empty, and is required in order to migrate the sIDHistory information between source and target accounts.
On the domain controller that will be used to export the account information (usually the DC holding the PDC Emulator operations master role for the source domain), create/set a value of 1 for a DWORD registry key called TcpipClientSupport in HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\.
In both the source and target domains, ensure that success and failure auditing is enabled for account management.
On a computer with ADMT installed, create a password encryption key for each source domain, by shelling out to a command prompt and entering the following commands:
cd %systemroot%\ADMT
admt key /option:create /sourcedomain:<em>domainname</em> /keyfile:<em>filename</em>.pes
(the domainname can be specified in NetBIOS or DNS format.)
On the domain controller in the source domain that holds the PDC Emulator operations master role, connect to the computer with ADMT installed (e.g. via the c$ administration share) and access the %systemroot%\ADMT\PES folder.
Run pwdmig.exe to install the ADMT Password Migration DLL and follow the installation wizard. During the installation, supply the password encryption (.PES) file that was created earlier.
This is the step that’s not in the instructions – even though the password encyption file was supplied during the installation of the ADMT Password Migration DLL, it still needs to be imported manually on the PDC Emulator, by shelling out to a command prompt and entering the following commands:
cd %systemroot%\ADMT
admt key /option:import /sourcedomain:<em>domainname</em> /keyfile:<em>filename</em>.pes
On the domain controller that will be used to export the account information, create/set a value of 1 for a DWORD registry key called AllowPasswordExport in HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\. Note that this key constitutes a security risk and should only be enabled during the period of migration.
Restart the computer with the ADMT Password Migrator DLL installed.
Start the Password Export Server service.
其中大部分内容与文档完全一致——主要区别在于需要手动导入密码加密文件。没有这个，我收到以下消息：
错误 无法与密码导出服务器建立会话。源密码导出服务器和目标服务器的源域加密密钥不同。
最后，需要什么权限？我将本地系统用于密码导出服务器服务。对于其他一切，我使用了一个在两个林中创建的具有相同密码的帐户，并且该帐户是 Domain Admins 组的成员。这有点过分，最佳做法是使用具有最低要求权限的帐户。基本上，需要一个帐户：
Domain administrator in the source domain.
Local administrator on the computer on which ADMT is installed.
Delegated permissions on OUs that are targets for resource migration in the target domain, including the extended right to Migrate SID History (visible in the Security for an object using the Advanced Features view in Active Directory Users and Computers).
可以在 ADMT v3 迁移指南中找到更多建议。
【讨论】：
一种选择是为 AD 实施密码过滤器。这将允许您在密码更改时捕获密码。我已经使用了几种实现密码过滤器来帮助广告迁移的产品，但是我自己没有实现它，所以我能做的最好的就是建议微软文档。如果没有强制用户更改密码或无法更改此密码，这不是一个很好的选择。
https://docs.microsoft.com/en-us/windows/win32/secmgmt/password-filter-programming-considerations
另一种选择是在产品登录和 AD 之间设置产品以捕获和迁移密码。确实存在为此目的实现 ldap 接口的产品。为此我看到的产品是 Radiant logic，但我相信还有其他产品。
https://www.radiantlogic.com/solutions/overview/how-radiantone-works/
【讨论】：