Solved

Move a user to a child domain with ADSI MoveHere: the server is unwilling to process the request.

Posted on 2007-03-30
3
792 Views
Last Modified: 2012-08-13
When trying to move a user to a child domain with ADSI following script (saved in a .vbs file):
set objOU= GetObject("LDAP://ou=users,ou=zurich,dc=ch,dc=group,dc=local")
objOU.MoveHere "LDAP://cn=ZeZS,ou=users,ou=Zurich,ou=Stonehage,dc=group,dc=local", "cn=ZeZS"
I get the following error message: (line2, char1)
Error: the server is unwilling to process the request.
Code: 80072035
We are on 2003 native, the user is not belonging to any Global Group; made it member ot a dummy "TRANSFERT" group, set as primary group. Tried both with TRANSFERT being Universal or Domain Local groups.
If I change the cn=ZeZS, it tells me it does not find the user, hence proving that the typing is correct, the user is found, but ADSI refuses to move it.
I launch the vbs from a DC in the top domain, with an admin account which is member of Enterprise Admins.
Can someone help quickly, as my time to fix it is very very short, and if not successfull, I'll have to delete users and create them manually in the child domain. Marc
0
Comment
Question by:stonehage
  • 2
3 Comments
 
LVL 70

Accepted Solution

by:
Chris Dent earned 500 total points
Comment Utility

You can't use MoveHere I'm afraid, that only works within a domain as far as I know.

You can use the command line tool MoveTree tool that comes with the Support Tools. You will have to strip all group memberships from the account (except Domain Users).

Chris
0
 

Author Comment

by:stonehage
Comment Utility
http://www.microsoft.com/technet/scriptcenter/guide/sas_usr_aznz.mspx?mfr=true says:

Preparing a User Account for a Cross-Domain Move
Moving user accounts to other domains within the same forest is possible when the following conditions are met:

• The destination domain is running in native mode.
 
• Both the destination and the source domain use Kerberos authentication.
 
• The move operation must be completed from the source domain to the destination, or target, domain. If you attempt to move a user while logged on to the destination domain, the following message will appear:

(null): Inappropriate authentication

To move a user from one domain to another, you must have permission to remove a user from the source domain and add a user to the target domain. For example, a user with administrator credentials in a root domain can move a user to a child domain because the user is a member of the Enterprise Admins group. However, a user with administrator credentials in a child domain cannot move a user to a parent domain because the user does not have permission, by default, to add user accounts to the parent domain.
....
If you need to move an OU or another container (and all of the objects within the container) to a different domain in the forest, use the Movetree.exe command-line tool

IN MY CASE, it is a user, not a OU I want to move.

NOW, I'm ready to create a dummy OU and test MoveTree, despited it is in one unique tree. What is the syntax?
movetree /? gives many information, but I am in production and cannot risk to do it wrong.
Should I do a /check first, and how am I sure it will do what I want when doing the /start?
Marc
0
 

Author Comment

by:stonehage
Comment Utility
The MoveTree with the /verbose is very talkative. That permitted to point out that oru source DS was not having sufficient rights, and changing to another and using the MoveTree on a floder was successfull. Being able to do a /check /verbose fist and look at the details is very helpfull. When ready, we replaced the /check with a /start. Marc
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
A quick step-by-step overview of installing and configuring Carbonite Server Backup.
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now