[keycloak-user] decouple Keycloak from Active Directory

Hi guys, We've made the initial mistake to store our users in Active Directory. After the number of Keycloak-AD issues increased significantly, we are considering using just Keycloak DB to store the users. Is there a way to migrate the users from AD to Keycloak, without forcing them to update their passwords? If I remove the User-Federation AD Provider all users are gone... Thanks, Adrian