[Last Call] Learn about multicloud storage options and how to improve your company's cloud strategy. Register Now

x
?
Solved

Move a user to a child domain with ADSI MoveHere: the server is unwilling to process the request.

Posted on 2007-03-30
3
Medium Priority
?
826 Views
Last Modified: 2012-08-13
When trying to move a user to a child domain with ADSI following script (saved in a .vbs file):
set objOU= GetObject("LDAP://ou=users,ou=zurich,dc=ch,dc=group,dc=local")
objOU.MoveHere "LDAP://cn=ZeZS,ou=users,ou=Zurich,ou=Stonehage,dc=group,dc=local", "cn=ZeZS"
I get the following error message: (line2, char1)
Error: the server is unwilling to process the request.
Code: 80072035
We are on 2003 native, the user is not belonging to any Global Group; made it member ot a dummy "TRANSFERT" group, set as primary group. Tried both with TRANSFERT being Universal or Domain Local groups.
If I change the cn=ZeZS, it tells me it does not find the user, hence proving that the typing is correct, the user is found, but ADSI refuses to move it.
I launch the vbs from a DC in the top domain, with an admin account which is member of Enterprise Admins.
Can someone help quickly, as my time to fix it is very very short, and if not successfull, I'll have to delete users and create them manually in the child domain. Marc
0
Comment
Question by:stonehage
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 71

Accepted Solution

by:
Chris Dent earned 1500 total points
ID: 18822409

You can't use MoveHere I'm afraid, that only works within a domain as far as I know.

You can use the command line tool MoveTree tool that comes with the Support Tools. You will have to strip all group memberships from the account (except Domain Users).

Chris
0
 

Author Comment

by:stonehage
ID: 18823072
http://www.microsoft.com/technet/scriptcenter/guide/sas_usr_aznz.mspx?mfr=true says:

Preparing a User Account for a Cross-Domain Move
Moving user accounts to other domains within the same forest is possible when the following conditions are met:

• The destination domain is running in native mode.
 
• Both the destination and the source domain use Kerberos authentication.
 
• The move operation must be completed from the source domain to the destination, or target, domain. If you attempt to move a user while logged on to the destination domain, the following message will appear:

(null): Inappropriate authentication

To move a user from one domain to another, you must have permission to remove a user from the source domain and add a user to the target domain. For example, a user with administrator credentials in a root domain can move a user to a child domain because the user is a member of the Enterprise Admins group. However, a user with administrator credentials in a child domain cannot move a user to a parent domain because the user does not have permission, by default, to add user accounts to the parent domain.
....
If you need to move an OU or another container (and all of the objects within the container) to a different domain in the forest, use the Movetree.exe command-line tool

IN MY CASE, it is a user, not a OU I want to move.

NOW, I'm ready to create a dummy OU and test MoveTree, despited it is in one unique tree. What is the syntax?
movetree /? gives many information, but I am in production and cannot risk to do it wrong.
Should I do a /check first, and how am I sure it will do what I want when doing the /start?
Marc
0
 

Author Comment

by:stonehage
ID: 19014069
The MoveTree with the /verbose is very talkative. That permitted to point out that oru source DS was not having sufficient rights, and changing to another and using the MoveTree on a floder was successfull. Being able to do a /check /verbose fist and look at the details is very helpfull. When ready, we replaced the /check with a /start. Marc
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Scenerio: You have a server running Server 2003 and have applied a retail pack of Terminal Server Licenses.  You want to change servers or your server has crashed and you need to reapply the Terminal Server Licenses. When you enter the 16-digit lic…
I've always wanted to allow a user to have a printer no matter where they login. The steps below will show you how to achieve just that. In this Article I'll show how to deploy printers automatically with group policy and then using security fil…
Have you created a query with information for a calendar? ... and then, abra-cadabra, the calendar is done?! I am going to show you how to make that happen. Visualize your data!  ... really see it To use the code to create a calendar from a q…
In response to a need for security and privacy, and to continue fostering an environment members can turn to for support, solutions, and education, Experts Exchange has created anonymous question capabilities. This new feature is available to our Pr…
Suggested Courses

650 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question