Need help migrating from Univention Corporate Server (UCS) to a new Active Directory environment

[RafaPiveta]

Hello everyone,

I’m looking for some guidance on migrating our current Active Directory environment from Univention Corporate Server (UCS) to a new directory service.

We currently use UCS as our primary AD domain controller. We initially attempted to migrate everything to Windows Server 2022, but we ran into several roadblocks and technical issues.

We are completely flexible on the destination platform (Windows Server, Entra ID / Azure AD, Google Workspace, etc.). The main goal is to find a straightforward migration path where we do not lose any existing data—this includes users, computers, security groups, and Group Policy Objects (GPOs).

My research so far has mostly turned up guides for migrating to UCS from Windows Server, but rarely the other way around.

Has anyone here successfully completed a migration out of UCS? Any advice, recommended tools, or best practices would be greatly appreciated.

Thanks in advance!

 

[WindowsForum AI]

Hi RafaPiveta — preserving an existing domain and migrating into a new domain are different projects. Before choosing a tool, the key question is whether “no loss” also means retaining passwords, existing computer joins, user profiles, and file permissions.
I don’t have a personally completed UCS migration to report, and I wouldn’t promise a one-click, lossless migration without checking your environment.

Which destination fits?​

Windows Server AD DS is the closest fit if retaining traditional domain functionality and GPOs is essential. Microsoft Entra ID is not a drop-in replacement: it uses a different device identity and management model, typically with Intune rather than traditional Group Policy. Microsoft Entra Domain Services is a separate managed-domain product—not a way to take over your existing UCS domain. (learn.microsoft.com)
There is also an important UCS-specific restriction: current UCS 5.2 documentation explicitly says that joining Windows servers as domain controllers in the UCS domain is unsupported. Consequently, “add a Windows DC, transfer FSMO roles, remove UCS” should not be presented as a straightforward, supported UCS migration recipe. That does not establish the cause of your Server 2022 failures; we need the errors to determine that. (docs.software-univention.de)

Recommended planning approach​

1. Identify what failed in your previous attempt. Was Server 2022 being promoted into the existing UCS domain, or were you creating a separate Windows forest and migrating accounts? Please share the exact error and the stage at which it occurred.
2. Define the preservation requirements. Inventory users, group memberships, computers, OUs, GPOs, file/share permissions, service accounts, DNS, and applications using LDAP or Kerberos. Treat passwords, existing workstation joins, and user profiles as explicit acceptance criteria—not assumed consequences of copying account names.
3. Establish a recoverable baseline. Before any changes, obtain tested UCS/directory backups, SYSVOL backups, and backups of business data. Rehearse in an isolated lab and document rollback before changing production authentication.
4. Choose between continuity and a new-domain migration. If preserving existing domain identity is mandatory, ask Univention to confirm a supported exit strategy for your exact UCS/Samba versions. Otherwise, my planning recommendation is a separate Windows AD forest with a staged migration. Do not select an account/password migration tool until its support for your UCS/Samba source is confirmed.
5. Handle GPOs separately. Microsoft documents GPMC backup and cross-domain import/copy, including migration tables for domain-specific security principals and UNC paths. Copying SYSVOL folders alone is not a complete GPO migration. Import transfers settings, but does not transfer the source links or security filtering; inventory and validate those separately, along with WMI filters and external scripts. (learn.microsoft.com)
6. Require a pilot before approving cutover. Your acceptance checklist should include a representative user and workstation, group memberships, sign-in, existing profile/data access, file-share permissions, policy application, and application authentication. Keep production UCS available until the agreed validation and rollback criteria are met.

Details needed to narrow this down​

• What UCS version and Samba version are you running?
• How many domain controllers, users, and Windows computers are involved?
• What exactly failed during the Windows Server 2022 attempt?
• Must existing passwords and computer domain joins remain unchanged?
• Does UCS also host file shares or applications that need migrating?
• Are you retaining the current domain name, or willing to create a new domain?

My recommendation is to separate the UCS exit from any cloud-management redesign. First determine whether you need to preserve the existing domain or can migrate to a new Windows domain; then evaluate cloud identity separately. That keeps the immediate migration scope much clearer.