Move user account between 2 child DC in the same forest

Dear All,

I have situation like that

AD root - test.com
child DC - hk.test.com ( this DC store example.com 's mailbox )


AD root - example.com

(When I  create an account in example.com for user login, At the same time, I would also create the same mail-enable account in hk.test.com using exchange2003.
That mean
create user1 in example.com for login
then
create user1 in hk.test.com for email account)

And I have 2 choices

Choice 1
 I would like to demote example.com and then dcpromo this server to become cn.test.com. Then, I cannot manage the account easily. But the duplicate account will be a problem when I join this computer to be cn.test.com. Is there any solution to solve the problem easily?

Choice 2
I have new server installed with windows2003, then, I join this server to be child DC called cn.test.com. But can I move the account from hk.test.com to cn.test.com, whose mailbox account is for example.com before.

What choice is better, or is there any other good solutions?

Thanks everyone to reply in advance
newexhshAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Chris DentPowerShell DeveloperCommented:

Hi,

It's not too tricky to move an account between Domains in the same forest. You need to use the Support Tools utility called MoveTree.

It's a command line too but works very well (or at least did when we tested it).

First of all you need to boot the user out of any groups they're in. Then you can use MoveTree (it's a bit of a long command) to first :

MoveTree /check /s <SourceDC> /d <DesintationDC> /sdn CN=User Name,OU=SomeOU,OU=SomeOtherOU,DC=HK,DC=Test,DC=com /ddn CN=User Name,OU=SomeOU,OU=SomeOtherOU,DC=CN,DC=Test,DC=com

Then the same again with /start to move it:

MoveTree /start /s <SourceDC> /d <DesintationDC> /sdn CN=User Name,OU=SomeOU,OU=SomeOtherOU,DC=HK,DC=Test,DC=com /ddn CN=User Name,OU=SomeOU,OU=SomeOtherOU,DC=CN,DC=Test,DC=com

The mailbox will still be attached to the original mail server at this point and if you need to move it you can do so with the Move Mailbox function from Exchange Tasks.

Full documentation on the command is here:

http://support.microsoft.com/?kbid=238394

All our testing was with Windows 2003 Domains and we didn't bump into any problems using it.

Chris
newexhshAuthor Commented:
Hi Chris,

I have created the OU "idaccount" in hk.test.com, now I want to move this OU including OU 's user to cn.test.com

movetree /check/ s hk.test.com /d cn.test.com /sdn OU=idaccount,DC=hk,DC=test,DC=com /dnn OU=idaccount,DC=cn,DC=test,DC=com
 
then it shown
"MOVETREE PRE-CHECK FINISHED.
 MOVETREE IS READY TO START THE MOVE OPERATIION"

However, when I type
movetree /start / s hk.test.com /d cn.test.com /sdn OU=idaccount,DC=hk,DC=test,DC=com /dnn OU=idaccount,DC=cn,DC=test,DC=com

The movetree.err shown

"ERROR: 0x80090303 The specified target is unknown or unreachable
MoveTree cross domain move failed. The extended error is 80090303: SecErr: DSID-031B0677, problem 4001 (INAPPROPRIATE_AUTH), data 0

ERROR: 0x80090303 The specified target is unknown or unreachable

MoveTree cross domain move failed to move object OU=idaccount,cn=a946fb0f-4751-4619-b108-73e471f5792a,CN=LostAndFound,DC=hk,DC=test,DC=com to container DC=cn,DC=test,DC=com"

I have raise the operational level, so it is in Window2003 native mode

Is it I miss something?

Thanks
Chris DentPowerShell DeveloperCommented:

/s and /d are (at least when we tested it) the Servernames. So /s Server1.hk.test.com and /d Server1.cn.test.com.

It could also be that I remember the syntax incorrectly. Could you try creating an OU called idaccount on CN to see if it just does from that point down?

Chris
10 Tips to Protect Your Business from Ransomware

Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.

newexhshAuthor Commented:
I have tried to create the idaccount OU in cn.test.com
then, I run the movetree command again

it shown
" MOVETREE PRE-CHECK FINISHED.
 MOVETREE DETECTED THERE ARE SOME OBJECTS CAN NOT BE MOVED.
 PLEASE CLEAN THEM UP FIRST BEFORE TRYING TO START THE MOVE TREE  OPERATION."

"ReturnCode: 0x210a The replication operation failed due to a collision of object names.

MoveTree check destination RDN conflict for object: OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.

MoveTree cross domain move check for object: OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.

MoveTree cross domain move check for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.

MoveTree check Duplicate SAM Account Name for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.

MoveTree cross domain move check for object: CN=idaccount2,OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.

MoveTree check Duplicate SAM Account Name for object: CN=idaccount2,OU=idaccount,DC=hk,DC=test,DC=com


THANKS
Chris DentPowerShell DeveloperCommented:

A little odd that it wouldn't do that the first time, but as long as it has the user accounts across.

Chris
newexhshAuthor Commented:
When I specify the user account, it still fails

I run
movetree /start / s hk.test.com /d cn.test.com /sdn CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com /dnn CN=idaccount1,OU=idaccount,DC=cn,DC=test,DC=com

"ERROR: 0x80090303 The specified target is unknown or unreachable

MoveTree cross domain move failed. The extended error is 80090303: SecErr: DSID-031B0677, problem 4001 (INAPPROPRIATE_AUTH), data 0

ERROR: 0x80090303 The specified target is unknown or unreachable

MoveTree cross domain move failed to move object CN=idaccount1,OU=idaccount,DC=hk,DC=teama,DC=com to container OU=idaccount,DC=id,DC=teama,DC=com"

Thanks
Chris DentPowerShell DeveloperCommented:

Could you try:

movetree /start / s hk.test.com /d cn.test.com /sdn CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com /dnn OU=idaccount,DC=cn,DC=test,DC=com

Basically just remove the user account from the destination.

Chris
Chris DentPowerShell DeveloperCommented:

Hmmm no I don't think that'll do it. It should work, and normally works with the full DN of the target specified as you've written above.

The only difference between the command you're using and the examples and the tests I've done is the exclusion of the
server names - it should really be done from the RID Master on each domain. Or are you filling those in?

Chris
Chris DentPowerShell DeveloperCommented:

The MS examples of it are here. They're a bit better explained than mine:

http://technet2.microsoft.com/WindowsServer/en/Library/ee76d911-1fd4-4a04-be49-03ba407d6dde1033.mspx

Chris
newexhshAuthor Commented:
I have followed the instruction  to do, but it still fail, now i wonder it is not the command problem, does i need to configure something in order to move user between different domain and site in a AD forest?

thanks
Chris DentPowerShell DeveloperCommented:

Not that I'm aware of,  I just set it up to work between the two RID Masters on our network and didn't bump into any problems after that.

Chris
newexhshAuthor Commented:
Can I know how can I set the 2 DC to be RID masters?

thanks
Chris DentPowerShell DeveloperCommented:

Run "netdom query fsmo" at the command line to find it, then use the respective server for each domain with the /s and /d switches.

Chris
newexhshAuthor Commented:
Hi Chris

I have run "netdom query fsmo" in both server
however, i still get this error from "movetree.chk" when i type this command



"ReturnCode: 0x210a The replication operation failed due to a collision of object names.MoveTree check destination RDN conflict for object: OU=idaccount,DC=hk,DC=teama,DC=com
ReturnCode: 0x0 The operation completed successfully.MoveTree cross domain move check for object: OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.MoveTree cross domain move check for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.MoveTree check Duplicate SAM Account Name for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com
ReturnCode: 0x0 The operation completed successfully.MoveTree cross domain move check for object: CN=idaccount2,OU=idaccount,DC=hk,DC=teama,DC=com
ReturnCode: 0x0 The operation completed successfully.MoveTree check Duplicate SAM Account Name for object: CN=idaccount2,OU=idaccount,DC=hk,DC=test,DC=com "



why show
"ReturnCode: 0x210a The replication operation failed due to a collision of object names.MoveTree check destination RDN conflict for object"
I dont have this account in my destination server

also,
"ReturnCode: 0x0 The operation completed successfully.MoveTree check Duplicate SAM Account Name for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com"
duplicate SAM? I dont know why there are dupicate SAM

and what is the difference between movetree.err and movetree.chk ?

thanks
Chris DentPowerShell DeveloperCommented:

This one refers to the OU itself:

ReturnCode: 0x210a The replication operation failed due to a collision of object names.MoveTree check destination RDN conflict for object: OU=idaccount,DC=hk,DC=teama,DC=com

Normally you don't need to have an OU on the Target to move things into, just set /sdn as the source and /ddn as whatever you want the destination to be called.

This one is just a duplicate username, it should be easy enough to check if a username exists...

ReturnCode: 0x0 The operation completed successfully.MoveTree check Duplicate SAM Account Name for object: CN=idaccount1,OU=idaccount,DC=hk,DC=test,DC=com

It looks like it carried on regardless though from the errors you got back.

I assume the difference between .chk and .err is that one happens to try and prevent errors, the other happens when things go wrong?

Chris

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
newexhshAuthor Commented:
I can use ADMT to do that finially

Thanks
apcoexchCommented:
Hi, I am trying to use MoveTree Utility to move users between two domains in a single forest.
i am using the following syntax:
MoveTree /start /s source domain controller /d destination domain controller /sdn "cn=username,ou=london,dc=domain," /ddn "cn=trichmondwatson,ou=Users,dc=domain" /u domain\username /p ***** /verbose

but i get the follwing eror throw up: ERROR: 0x208f The object name has bad syntax

Any help would be appriciated,

K
Chris DentPowerShell DeveloperCommented:

If you're using the default Users container then it's CN=Users, not OU=Users.

Chris
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.