During the migration of Active Directory domain we could work ahead to slowly start creating groups in the new domain to start migrating resources. This required a special configuration of AD groups. You should create three types of group like this:

• Global Groups in the OLD DOMAIN
  • This should hold user account objects of the old domain (source domain)
• Global Groups in the NEW DOMAIN
  • This should hold user account objects of the new domain (target domain)
• DomainLocal Groups in the NEW DOMAIN
  • This should hold the global groups created in both domains and should get permissions in the new domain

This works down to this overview of configuration: