Move user account between 2 child DC in the same forest

Hi,

It's not too tricky to move an account between Domains in the same forest. You need to use the Support Tools utility called MoveTree.

It's a command line too but works very well (or at least did when we tested it).

First of all you need to boot the user out of any groups they're in. Then you can use MoveTree (it's a bit of a long command) to first :

MoveTree /check /s <SourceDC> /d <DesintationDC> /sdn CN=User Name,OU=SomeOU,OU=SomeOtherOU,DC=HK,DC=Test,DC=com /ddn CN=User Name,OU=SomeOU,OU=SomeOtherOU,DC=CN,DC=Test,DC=com

Then the same again with /start to move it:

MoveTree /start /s <SourceDC> /d <DesintationDC> /sdn CN=User Name,OU=SomeOU,OU=SomeOtherOU,DC=HK,DC=Test,DC=com /ddn CN=User Name,OU=SomeOU,OU=SomeOtherOU,DC=CN,DC=Test,DC=com

The mailbox will still be attached to the original mail server at this point and if you need to move it you can do so with the Move Mailbox function from Exchange Tasks.

Full documentation on the command is here:

http://support.microsoft.com/?kbid=238394

All our testing was with Windows 2003 Domains and we didn't bump into any problems using it.

Chris

Hi Chris,

I have created the OU "idaccount" in hk.test.com, now I want to move this OU including OU 's user to cn.test.com

movetree /check/ s hk.test.com /d cn.test.com /sdn OU=idaccount,DC=hk,DC=test,DC=com /dnn OU=idaccount,DC=cn,DC=test,DC=com
 
then it shown
"MOVETREE PRE-CHECK FINISHED.
 MOVETREE IS READY TO START THE MOVE OPERATIION"

However, when I type
movetree /start / s hk.test.com /d cn.test.com /sdn OU=idaccount,DC=hk,DC=test,DC=com /dnn OU=idaccount,DC=cn,DC=test,DC=com

The movetree.err shown

"ERROR: 0x80090303 The specified target is unknown or unreachable
MoveTree cross domain move failed. The extended error is 80090303: SecErr: DSID-031B0677, problem 4001 (INAPPROPRIATE_AUTH), data 0

ERROR: 0x80090303 The specified target is unknown or unreachable

MoveTree cross domain move failed to move object OU=idaccount,cn=a946fb0f-4751-4619-b108-73e471f5792a,CN=LostAndFound,DC=hk,DC=test,DC=com to container DC=cn,DC=test,DC=com"

I have raise the operational level, so it is in Window2003 native mode

Is it I miss something?

Thanks

/s and /d are (at least when we tested it) the Servernames. So /s Server1.hk.test.com and /d Server1.cn.test.com.

It could also be that I remember the syntax incorrectly. Could you try creating an OU called idaccount on CN to see if it just does from that point down?

Chris

I have tried to create the idaccount OU in cn.test.com
then, I run the movetree command again

it shown
" MOVETREE PRE-CHECK FINISHED.
 MOVETREE DETECTED THERE ARE SOME OBJECTS CAN NOT BE MOVED.
 PLEASE CLEAN THEM UP FIRST BEFORE TRYING TO START THE MOVE TREE  OPERATION."

"ReturnCode: 0x210a The replication operation failed due to a collision of object names.

MoveTree check destination RDN conflict for object: OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.

MoveTree cross domain move check for object: OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.

MoveTree cross domain move check for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.

MoveTree check Duplicate SAM Account Name for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.

MoveTree cross domain move check for object: CN=idaccount2,OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.

MoveTree check Duplicate SAM Account Name for object: CN=idaccount2,OU=idaccount,DC=hk,DC=test,DC=com


THANKS

A little odd that it wouldn't do that the first time, but as long as it has the user accounts across.

Chris

When I specify the user account, it still fails

I run
movetree /start / s hk.test.com /d cn.test.com /sdn CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com /dnn CN=idaccount1,OU=idaccount,DC=cn,DC=test,DC=com

"ERROR: 0x80090303 The specified target is unknown or unreachable

MoveTree cross domain move failed. The extended error is 80090303: SecErr: DSID-031B0677, problem 4001 (INAPPROPRIATE_AUTH), data 0

ERROR: 0x80090303 The specified target is unknown or unreachable

MoveTree cross domain move failed to move object CN=idaccount1,OU=idaccount,DC=hk,DC=teama,DC=com to container OU=idaccount,DC=id,DC=teama,DC=com"

Thanks

Could you try:

movetree /start / s hk.test.com /d cn.test.com /sdn CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com /dnn OU=idaccount,DC=cn,DC=test,DC=com

Basically just remove the user account from the destination.

Chris

Hmmm no I don't think that'll do it. It should work, and normally works with the full DN of the target specified as you've written above.

The only difference between the command you're using and the examples and the tests I've done is the exclusion of the
server names - it should really be done from the RID Master on each domain. Or are you filling those in?

Chris

The MS examples of it are here. They're a bit better explained than mine:

http://technet2.microsoft.com/WindowsServer/en/Library/ee76d911-1fd4-4a04-be49-03ba407d6dde1033.mspx

Chris

I have followed the instruction  to do, but it still fail, now i wonder it is not the command problem, does i need to configure something in order to move user between different domain and site in a AD forest?

thanks

Not that I'm aware of,  I just set it up to work between the two RID Masters on our network and didn't bump into any problems after that.

Chris

Can I know how can I set the 2 DC to be RID masters?

thanks

Run "netdom query fsmo" at the command line to find it, then use the respective server for each domain with the /s and /d switches.

Chris

Hi Chris

I have run "netdom query fsmo" in both server
however, i still get this error from "movetree.chk" when i type this command



"ReturnCode: 0x210a The replication operation failed due to a collision of object names.MoveTree check destination RDN conflict for object: OU=idaccount,DC=hk,DC=teama,DC=com
ReturnCode: 0x0 The operation completed successfully.MoveTree cross domain move check for object: OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.MoveTree cross domain move check for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.MoveTree check Duplicate SAM Account Name for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.MoveTree cross domain move check for object: CN=idaccount2,OU=idaccount,DC=hk,DC=teama,DC=com
ReturnCode: 0x0 The operation completed successfully.MoveTree check Duplicate SAM Account Name for object: CN=idaccount2,OU=idaccount,DC=hk,DC=test,DC=com "



why show
"ReturnCode: 0x210a The replication operation failed due to a collision of object names.MoveTree check destination RDN conflict for object"
I dont have this account in my destination server

also,
"ReturnCode: 0x0 The operation completed successfully.MoveTree check Duplicate SAM Account Name for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com"
duplicate SAM? I dont know why there are dupicate SAM

and what is the difference between movetree.err and movetree.chk ?

thanks

I can use ADMT to do that finially

Thanks

Hi, I am trying to use MoveTree Utility to move users between two domains in a single forest.
i am using the following syntax:
MoveTree /start /s source domain controller /d destination domain controller /sdn "cn=username,ou=london,dc=domain," /ddn "cn=trichmondwatson,ou=Users,dc=domain" /u domain\username /p ***** /verbose

but i get the follwing eror throw up: ERROR: 0x208f The object name has bad syntax

Any help would be appriciated,

K

If you're using the default Users container then it's CN=Users, not OU=Users.

Chris