[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Manage permissions required for migrating an on-premises domain\n\n| **Preview\n| --- Existing domain migration**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nThis page explains how to check if the permissions that are required to migrate an\nexisting Active Directory domain from on-premises to Managed Service for Microsoft Active Directory with\nSID history are enabled. This page also explains how to disable these\npermissions after you complete the migration.\n\nBefore you begin\n----------------\n\nMake sure that you have any one of the following Identity and Access Management (\nIAM) user roles:\n\n- Google Cloud Managed Identities Domain Admin (`roles/managedidentities.domainAdmin`)\n- Google Cloud Managed Identities Admin (`roles/managedidentities.admin`)\n\nFor more information, see [Cloud Managed Identities\nroles](/iam/docs/understanding-roles#cloud-managed-identities-roles).\n\nCheck permissions\n-----------------\n\nYou can check if the permissions that are required to migrate domains with SID history\nare available on a Managed Microsoft AD domain.\n\nTo validate the permissions, run the following gcloud CLI command: \n\n```\ngcloud beta active-directory domains migration check-permissions DOMAIN_NAME\n```\n\nReplace \u003cvar translate=\"no\"\u003eDOMAIN_NAME\u003c/var\u003e with the name of your Managed Microsoft AD\ndomain. For example, `my-domain.com`.\n\nThis operation validates if the Managed Microsoft AD has the `Cloud Service\nMigrate SID Administrators` group created and the state of SID filtering on all\nthe trusted domains.\n\nThe response lists the SID filtering state of all the trusted domains and the\nstate of permissions required in your Managed Microsoft AD domain: \n\n```\nonpremDomains:\n- name: domain-one.com\n sidFilteringState: ENABLED\n- name: domain-two.com\n sidFilteringState: DISABLED\nstate: ENABLED\n```\n\nYour Managed Microsoft AD domain can have anyone of the following states:\n\nDisable permissions on the Managed Microsoft AD domain\n------------------------------------------------------\n\nAfter you complete the migration, you must disable the permissions provided for\nmigrating your on-premises domain with SID history.\n\nTo disable the permissions, run the following gcloud CLI command: \n\n```\ngcloud beta active-directory domains migration disable DOMAIN_NAME\n```\n\nReplace \u003cvar translate=\"no\"\u003eDOMAIN_NAME\u003c/var\u003e with the name of your Managed Microsoft AD\ndomain. For example, `my-domain.com`.\n\nThis operation disables the permissions provided to your domain by deleting the\n`Cloud Service Migrate SID Administrators` group from Managed Microsoft AD\nand enables SID filtering on all the trusted domains."]]
