Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2659
  • Last Modified:

Move user account between 2 child DC in the same forest

Dear All,

I have situation like that

AD root - test.com
child DC - hk.test.com ( this DC store example.com 's mailbox )


AD root - example.com

(When I  create an account in example.com for user login, At the same time, I would also create the same mail-enable account in hk.test.com using exchange2003.
That mean
create user1 in example.com for login
then
create user1 in hk.test.com for email account)

And I have 2 choices

Choice 1
 I would like to demote example.com and then dcpromo this server to become cn.test.com. Then, I cannot manage the account easily. But the duplicate account will be a problem when I join this computer to be cn.test.com. Is there any solution to solve the problem easily?

Choice 2
I have new server installed with windows2003, then, I join this server to be child DC called cn.test.com. But can I move the account from hk.test.com to cn.test.com, whose mailbox account is for example.com before.

What choice is better, or is there any other good solutions?

Thanks everyone to reply in advance
0
newexhsh
Asked:
newexhsh
  • 10
  • 7
1 Solution
 
Chris DentPowerShell DeveloperCommented:

Hi,

It's not too tricky to move an account between Domains in the same forest. You need to use the Support Tools utility called MoveTree.

It's a command line too but works very well (or at least did when we tested it).

First of all you need to boot the user out of any groups they're in. Then you can use MoveTree (it's a bit of a long command) to first :

MoveTree /check /s <SourceDC> /d <DesintationDC> /sdn CN=User Name,OU=SomeOU,OU=SomeOtherOU,DC=HK,DC=Test,DC=com /ddn CN=User Name,OU=SomeOU,OU=SomeOtherOU,DC=CN,DC=Test,DC=com

Then the same again with /start to move it:

MoveTree /start /s <SourceDC> /d <DesintationDC> /sdn CN=User Name,OU=SomeOU,OU=SomeOtherOU,DC=HK,DC=Test,DC=com /ddn CN=User Name,OU=SomeOU,OU=SomeOtherOU,DC=CN,DC=Test,DC=com

The mailbox will still be attached to the original mail server at this point and if you need to move it you can do so with the Move Mailbox function from Exchange Tasks.

Full documentation on the command is here:

http://support.microsoft.com/?kbid=238394

All our testing was with Windows 2003 Domains and we didn't bump into any problems using it.

Chris
0
 
newexhshAuthor Commented:
Hi Chris,

I have created the OU "idaccount" in hk.test.com, now I want to move this OU including OU 's user to cn.test.com

movetree /check/ s hk.test.com /d cn.test.com /sdn OU=idaccount,DC=hk,DC=test,DC=com /dnn OU=idaccount,DC=cn,DC=test,DC=com
 
then it shown
"MOVETREE PRE-CHECK FINISHED.
 MOVETREE IS READY TO START THE MOVE OPERATIION"

However, when I type
movetree /start / s hk.test.com /d cn.test.com /sdn OU=idaccount,DC=hk,DC=test,DC=com /dnn OU=idaccount,DC=cn,DC=test,DC=com

The movetree.err shown

"ERROR: 0x80090303 The specified target is unknown or unreachable
MoveTree cross domain move failed. The extended error is 80090303: SecErr: DSID-031B0677, problem 4001 (INAPPROPRIATE_AUTH), data 0

ERROR: 0x80090303 The specified target is unknown or unreachable

MoveTree cross domain move failed to move object OU=idaccount,cn=a946fb0f-4751-4619-b108-73e471f5792a,CN=LostAndFound,DC=hk,DC=test,DC=com to container DC=cn,DC=test,DC=com"

I have raise the operational level, so it is in Window2003 native mode

Is it I miss something?

Thanks
0
 
Chris DentPowerShell DeveloperCommented:

/s and /d are (at least when we tested it) the Servernames. So /s Server1.hk.test.com and /d Server1.cn.test.com.

It could also be that I remember the syntax incorrectly. Could you try creating an OU called idaccount on CN to see if it just does from that point down?

Chris
0
NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

 
newexhshAuthor Commented:
I have tried to create the idaccount OU in cn.test.com
then, I run the movetree command again

it shown
" MOVETREE PRE-CHECK FINISHED.
 MOVETREE DETECTED THERE ARE SOME OBJECTS CAN NOT BE MOVED.
 PLEASE CLEAN THEM UP FIRST BEFORE TRYING TO START THE MOVE TREE  OPERATION."

"ReturnCode: 0x210a The replication operation failed due to a collision of object names.

MoveTree check destination RDN conflict for object: OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.

MoveTree cross domain move check for object: OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.

MoveTree cross domain move check for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.

MoveTree check Duplicate SAM Account Name for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.

MoveTree cross domain move check for object: CN=idaccount2,OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.

MoveTree check Duplicate SAM Account Name for object: CN=idaccount2,OU=idaccount,DC=hk,DC=test,DC=com


THANKS
0
 
Chris DentPowerShell DeveloperCommented:

A little odd that it wouldn't do that the first time, but as long as it has the user accounts across.

Chris
0
 
newexhshAuthor Commented:
When I specify the user account, it still fails

I run
movetree /start / s hk.test.com /d cn.test.com /sdn CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com /dnn CN=idaccount1,OU=idaccount,DC=cn,DC=test,DC=com

"ERROR: 0x80090303 The specified target is unknown or unreachable

MoveTree cross domain move failed. The extended error is 80090303: SecErr: DSID-031B0677, problem 4001 (INAPPROPRIATE_AUTH), data 0

ERROR: 0x80090303 The specified target is unknown or unreachable

MoveTree cross domain move failed to move object CN=idaccount1,OU=idaccount,DC=hk,DC=teama,DC=com to container OU=idaccount,DC=id,DC=teama,DC=com"

Thanks
0
 
Chris DentPowerShell DeveloperCommented:

Could you try:

movetree /start / s hk.test.com /d cn.test.com /sdn CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com /dnn OU=idaccount,DC=cn,DC=test,DC=com

Basically just remove the user account from the destination.

Chris
0
 
Chris DentPowerShell DeveloperCommented:

Hmmm no I don't think that'll do it. It should work, and normally works with the full DN of the target specified as you've written above.

The only difference between the command you're using and the examples and the tests I've done is the exclusion of the
server names - it should really be done from the RID Master on each domain. Or are you filling those in?

Chris
0
 
Chris DentPowerShell DeveloperCommented:

The MS examples of it are here. They're a bit better explained than mine:

http://technet2.microsoft.com/WindowsServer/en/Library/ee76d911-1fd4-4a04-be49-03ba407d6dde1033.mspx

Chris
0
 
newexhshAuthor Commented:
I have followed the instruction  to do, but it still fail, now i wonder it is not the command problem, does i need to configure something in order to move user between different domain and site in a AD forest?

thanks
0
 
Chris DentPowerShell DeveloperCommented:

Not that I'm aware of,  I just set it up to work between the two RID Masters on our network and didn't bump into any problems after that.

Chris
0
 
newexhshAuthor Commented:
Can I know how can I set the 2 DC to be RID masters?

thanks
0
 
Chris DentPowerShell DeveloperCommented:

Run "netdom query fsmo" at the command line to find it, then use the respective server for each domain with the /s and /d switches.

Chris
0
 
newexhshAuthor Commented:
Hi Chris

I have run "netdom query fsmo" in both server
however, i still get this error from "movetree.chk" when i type this command



"ReturnCode: 0x210a The replication operation failed due to a collision of object names.MoveTree check destination RDN conflict for object: OU=idaccount,DC=hk,DC=teama,DC=com
ReturnCode: 0x0 The operation completed successfully.MoveTree cross domain move check for object: OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.MoveTree cross domain move check for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.MoveTree check Duplicate SAM Account Name for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.MoveTree cross domain move check for object: CN=idaccount2,OU=idaccount,DC=hk,DC=teama,DC=com
ReturnCode: 0x0 The operation completed successfully.MoveTree check Duplicate SAM Account Name for object: CN=idaccount2,OU=idaccount,DC=hk,DC=test,DC=com "



why show
"ReturnCode: 0x210a The replication operation failed due to a collision of object names.MoveTree check destination RDN conflict for object"
I dont have this account in my destination server

also,
"ReturnCode: 0x0 The operation completed successfully.MoveTree check Duplicate SAM Account Name for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com"
duplicate SAM? I dont know why there are dupicate SAM

and what is the difference between movetree.err and movetree.chk ?

thanks
0
 
Chris DentPowerShell DeveloperCommented:

This one refers to the OU itself:

ReturnCode: 0x210a The replication operation failed due to a collision of object names.MoveTree check destination RDN conflict for object: OU=idaccount,DC=hk,DC=teama,DC=com

Normally you don't need to have an OU on the Target to move things into, just set /sdn as the source and /ddn as whatever you want the destination to be called.

This one is just a duplicate username, it should be easy enough to check if a username exists...

ReturnCode: 0x0 The operation completed successfully.MoveTree check Duplicate SAM Account Name for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com

It looks like it carried on regardless though from the errors you got back.

I assume the difference between .chk and .err is that one happens to try and prevent errors, the other happens when things go wrong?

Chris
0
 
newexhshAuthor Commented:
I can use ADMT to do that finially

Thanks
0
 
apcoexchCommented:
Hi, I am trying to use MoveTree Utility to move users between two domains in a single forest.
i am using the following syntax:
MoveTree /start /s source domain controller /d destination domain controller /sdn "cn=username,ou=london,dc=domain," /ddn "cn=trichmondwatson,ou=Users,dc=domain" /u domain\username /p ***** /verbose

but i get the follwing eror throw up: ERROR: 0x208f The object name has bad syntax

Any help would be appriciated,

K
0
 
Chris DentPowerShell DeveloperCommented:

If you're using the default Users container then it's CN=Users, not OU=Users.

Chris
0

Featured Post

[Webinar] Cloud and Mobile-First Strategy

Maybe you’ve fully adopted the cloud since the beginning. Or maybe you started with on-prem resources but are pursuing a “cloud and mobile first” strategy. Getting to that end state has its challenges. Discover how to build out a 100% cloud and mobile IT strategy in this webinar.

  • 10
  • 7
Tackle projects and never again get stuck behind a technical roadblock.
Join Now