Link to home
Create AccountLog in
Avatar of sparky1977

asked on

Moving Users In Active Directory

Hi All,

I need to move a user in Active directory from one subdomain to another subdomain.
I have a network with domain A being top level, domains B and C are child domains from domain A.
I need to move 2 users one from domain A to domain C and one from domain B to domain C.
I am trying to use the movetree utility and i have tried doing a test run, however it comes back with a SAM error saying that the object already exists.
What am i doing wrong or how do i do this correctly?

Many Thanks
Avatar of Mike Kline
Mike Kline
Flag of United States of America image

Just in case anyone else wants info on the utilit;en-us;q238394
How to Use the MoveTree Utility to Move Objects Between Domains in a Single Forest

Did you search domain C for that object

Create a test user in domain A and try to move that object, I wonder if you get the same error.

I'll let you know if I find anything.

Avatar of sparky1977


Hi Mike,

I have tried the Microsoft article you mentioned and had no luck.
The other part of the question is how do you specify a single user? the MS article refers to OU's.
I get the same error and i have checked that the user does not exist in domain C.
Make sure you don't have other users with the same logon name in the target domain.

you can find out with the following command:

csvde -f output.csv -r"(&(objcetClass=user)(sAMAccountName=LOGONNAME))" -l sAMAccountName  <-replace LOGONNAME for the logon name of the user you are trying to move. If anything is found, the object names are in the resulting output.csv file.
Thanks for that but it generated an error

Invalid Argument: sAMAccountName
Sorry about that, try it this way:
csvde -f output.csv -r "(&(objectCategory=person)(sAMAccountName=bob))" -l "DN,sAMAccountName"          

This is an example output:

"CN=Bob Boss,CN=Users,DC=mydomain,DC=local",bob
I changed it to objectcategory=person, because it includes users and groups. Users and groups most have unique logon names. Even if different object class.

I have run the command successfully and have found that the user exists only once in the forest, therefore movetree should not complain that it already exists and cannot move the user.
Also, with the movetree how do you specify a user rather than an OU?
All microsofts examples refer to OU's

to move a single object, specify the object's dn like:
/sdn="CN=Bob Boss,CN=Users,DC=mydomain,DC=local"

Could you post the entire command you are using?
Hi all,

Got it working,

Found out the following, you need to remove the user to be moved from any group memberships other than domain users.
Then run the movetree command with syntax as follows:

C:\>MoveTree /check /s /d /sdn OU=Source OU,DC=Domain,DC=Com /ddn Destination OU,DC=Domain,DC=Com /u Domain\administrator /p password

This makes the check and completes fine, then you change the /check to /start to carry out the operation.

I had problems targetting single objects but i just created a temporary OU and moved that, then moved the user out and deleted the OU.

Thanks for all your suggestions though people!
No comment has been added to this question in more than 21 days, so it is now classified as abandoned.
I will leave the following recommendation for this question in the Cleanup topic area:

PAQ - Refund

Any objections should be posted here in the next 4 days. After that time, the question will be closed.

EE Cleanup Volunteer
Avatar of CetusMOD
Flag of Netherlands image

Link to home
Create an account to see this answer
Signing up is free. No credit card required.
Create Account