We decided to include a section on this topic because it is frequently addressed in our contact with customers. Right now, we know of at least three implementations that need to move content from a SharePoint Portal Server 2003 farm that resides in one Active Directory forest to a SharePoint Server 2007 farm that will reside in a different Active Directory forest.

To be honest, SharePoint Products and Technologies doesn’t upgrade well at all when it is moved between forests. While recent patches from Microsoft have given SharePoint Server 2007 the ability to recognize the SID History attribute in a migrated user account, the reality is that there isn’t a clean way to do this.

At the time of this writing, we know that Microsoft is working on a solution with four different customers but has not released any tools or recommended best practices on this topic.

There is an stsadm –o migrateuser command that you can work with to migrate user accounts from one farm in one Active Directory to another farm in another Active Directory, but for many whose farms are heavily populated with users and content, such a manual process doesn’t seem realistic. Look for third-party products to help fill this gap in the coming months.

In the absence of any tools from Microsoft or third-party providers, the user copy method might make the most sense for many who need to perform this type of migration. If that isn’t a possibility for you, the only remaining option is to set up a trust relationship between the two forests and then use one of the migration methods to move over the content. Thereafter, the site administrators will need to manually add the correct accounts into their sites and site collections using the new forest’s accounts. After a window of time, the trust relationship can be broken and the old accounts removed. Before breaking the trust relationship, be sure the old accounts are removed.