Skip any one of these and the rollback plan becomes the migration plan. That is not rhetoric: every multi-forest cutover that has gone sideways in twenty-five years of doing this work traces back to one of these items being assumed rather than verified. The list is reproduced in the order we run it. Copy-paste it, work through it, sign off on each item.

Environment

  1. Source forest functional level documented and confirmed. You would be surprised how many "Server 2016" forests are still 2008R2 functional level — the schema version got upgraded; the FFL never did. ADMT and Quest tooling behave differently across functional levels.
  2. DC patch parity. Every DC in source and target on the same Windows Update level. KB skews break NETLOGON behavior in subtle ways during cross-forest queries — most often when a security-rollup-introduced setting is missing on one side.
  3. Replication health verified end-to-end on both forests. repadmin /replsum clean for at least 24 hours; no orphaned objects, no lingering objects. If lingering objects exist, fix them before migration — they will replicate forward and become a permanent forensic artifact.
  4. Free disk space on every DC at least 30%. NTDS.dit will grow during migration; tombstones add to AD database size before they are collected. The migration tool's logging adds another factor of 2-3 to disk usage during peak hours.
  5. Backup of source forest System State on at least 2 DCs in different sites, verified restorable. Not "we have backups" — verified restorable, with a documented recovery exercise within the last 30 days.

Identity

  1. Source UPN suffixes inventoried. If users have multiple UPN suffixes you need a target-side mapping decided before the move. Federation services do not tolerate ambiguous UPN-to-suffix routing.
  2. SIDHistory enablement verified on target forest. Required if migrating with Quest ARS or ADMT. Target forest needs SIDHistory writes allowed via the schema and the explicit DRSADD permissions on the target.
  3. Service accounts inventoried. Not just UserAccountControl: 0x40000 — search for non-expiring passwords, accounts with SPNs, gMSA accounts (which need recreation, not migration), and accounts owning SQL Server services that will need reconnection.
  4. Privileged group membership snapshotted. Domain Admins, Enterprise Admins, Schema Admins on both forests captured to CSV. The capture is your evidence-of-state document for the audit. Delta this against the post-cutover state.
  5. Disabled accounts triaged. Which to migrate (compliance hold), which to skip. Default to skip; opt-in for retention. Migrating disabled accounts inflates SIDHistory bloat and complicates the post-cutover SID filtering decision.
  6. SID filtering policy confirmed on the trust. SID filtering OFF during migration, scheduled to be turned ON post-cutover. Document the date. Document the validation criteria for re-enabling. Get sign-off from the security team before the trust is opened.

Policy

  1. GPO inventory for source forest exported via Get-GPOReport to XML. Diff against target forest to identify conflicts. Conflicts are usually settings collisions — the target has a more restrictive baseline; migrating users get a behavior change they did not ask for.
  2. WMI filters audited. They are often used as silent kill switches and they do not migrate the same way GPOs do. The filter exists in source AD; the GPO references it; on target you have to either rebuild the filter or remove the reference.
  3. Software Installation policies (legacy MSI deployments via GPO) identified. These almost never migrate cleanly — the install path is usually a UNC reference that will not be valid in the target environment. Plan retirement, not migration.
  4. Login script inventory plus dependency map. UNC paths inside scripts must point to targets that exist post-cutover. Half the cutover-day "I cannot sign in" tickets are users whose login scripts try to map drives to source-forest file servers.

Network

  1. Site link costs in target forest reviewed against current WAN topology. Don't carry forward 2008-era costs. Cloud regions are now sites; physical DR sites may now be on lower-cost links than the primary.
  2. DNS conditional forwarders added on both sides for the duration of the migration. Do not rely on root hints for cross-forest resolution — too slow, too unreliable, too fragile to authentication fallbacks.
  3. Firewall rules for AD ports between source and target environments verified live. Document specific ports: 53, 88, 135, 389, 445, 464, 636, 3268, 3269, ephemeral RPC range 49152-65535. "Verified live" means you have tested authentication, not just opened the rule.
  4. NetLogon and Kerberos token sizes monitored on the most-grouped users. SIDHistory bloat will push some users over the default 12 KB token limit. Token size is the silent killer of cross-forest authentication.

Communications

  1. Cutover runbook reviewed by every team that touches an authentication-dependent system. Not just "infrastructure" — any team that has an SSPR, MFA, certificate-template, or SSO dependency. The list of dependencies is always longer than the IT team thinks.
  2. Helpdesk briefed on the failure modes. The most common cutover-day calls are not migration failures — they are cached credentials on user laptops requiring password resync. Train the helpdesk script before cutover, not during.
  3. Executive communication sent at least 5 business days ahead. With a clear "what to do if your account does not work" instruction. Most users who can authenticate but think they cannot will solve their own problem if you give them the option.
  4. Rollback criteria documented. NOT a rollback plan — criteria. "If X% of users cannot authenticate within Y minutes, we roll back at HH:MM." Decide before, not during.

The point

This is twenty-three items because those are the ones that, missing any one of, have made past cutovers go long. The good news: they are all verifiable in advance. The bad news: there is not a shortcut. Run the list. Sign each item off with the engineer responsible for it. Keep the signed copy.