Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

AD Migration

Posted on 2009-05-19
9
Medium Priority
?
298 Views
Last Modified: 2012-05-07
I am migrating a domain into another.  They are both 2003 and I am using ADMT v3.  I am having difficulty getting the groups to migrate.  I keep getting the following error:

2009-05-19 15:10:12 Starting Account Replicator.
2009-05-19 15:10:42 ERR2:7816 Cannot determine if source object 'LDAP://legends.com/CN=MigTestGroup,OU=Migration,DC=legends,DC=com' matches an object in the target forest or domain.  The handle is invalid.
2009-05-19 15:10:42 ERR2:7301 Failed to migrate source object 'CN=MigTestGroup' to domain 'PCH.local'. The target object could not be created. hr=0x80070006  The handle is invalid.
2009-05-19 15:10:42 Operation completed

Can anyone please help me with this issue?
0
Comment
Question by:PC4N6
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
9 Comments
 
LVL 23

Expert Comment

by:debuggerau
ID: 24428146
have you ensured you have delegate access to MigTestGroup OU?
I'd ensure the destination domain administrators group is added to your local group of your domain.

exert:
I resolved it by adding a target Domain Admin user account to the built-in
Administrators group in the source domain (it's impossible to add an account
to the Domain Admins group from another domain, trusted or not). Then I
logged into the target ADMT server using this Domain Admin account from the
target domain. I migrated a group successfully with ADMT and supplied the
credentials of the source domain admin account when requested.

also this registry settings needs to be checked:
Please Added the following registry key to the Source Domain Controller
that ADMT was pointed to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA
DWORD: TCIPClientSupport = 1

Hope that helps
0
 

Author Comment

by:PC4N6
ID: 24430943
Well I don't have a MigTestGroup OU...it is only a security group.  But yes the OU that I am moving it into has delegated control.  I have also added the target administrator account to the builtin administrators group in the source.  I also have that registry key in place.  I still get the same error.  Do you have any other ideas?
0
 
LVL 23

Expert Comment

by:debuggerau
ID: 24437649
are you migrating in this order?

Domain Global Group
Domain Local Group
User Account
Computer Account

There are some recommended settings for each step too:

For group migration set:
[Group Options]
Copy group members Not Checked
Fix membership of group Checked

For user migration set:
[User Options]
Migrate associated user groups Not Checked
Fix users'' group memberships Checked

Are you selecting these options?
0
Prepare for your VMware VCP6-DCV exam.

Josh Coen and Jason Langer have prepared the latest edition of VCP study guide. Both authors have been working in the IT field for more than a decade, and both hold VMware certifications. This 163-page guide covers all 10 of the exam blueprint sections.

 

Author Comment

by:PC4N6
ID: 24437696
right now I am still trying to get a test group to go through.  I have created the group MigTestGroup.  It fails everytime and gives me the error above in the thread.  But yes that is the order that I am going in.  Still on Domain Global Group.  Any ideas how I can get this test group to go through?
0
 
LVL 23

Expert Comment

by:debuggerau
ID: 24437752
have you checked replication status? maybe some reps are outstanding..

If you've just made the group, is it possible that all DC are not stable yet...

Its the sort of project to do in lab environment, using this on an active system would be dangerous at best...


0
 

Author Comment

by:PC4N6
ID: 24437771
Yes the group has been there for 24 hours.  I am using a test pc, and test group, as to not mess with production environment.
0
 
LVL 23

Expert Comment

by:debuggerau
ID: 24437885
have you got the output of the migration log to post?
0
 

Author Comment

by:PC4N6
ID: 24441203
Yes, look up  at the the top of the question that is pasted from the log file.
0
 
LVL 23

Accepted Solution

by:
debuggerau earned 2000 total points
ID: 24446701
And the event logs on source and destination domain controllers...

I cant see too much information about this specific issue, and it may be some custom settings that ADMT cant cope with, I suspect we are getting close to 'if in doubt rip it out...' part of the solution.

But first some AD checks, like Ntdsutil and ensure nothing is using AD while your doing the migration.



0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question