Solved

Moving user from child domain to parent domain

Posted on 2015-02-02
6
1,560 Views
Last Modified: 2015-02-03
We are trying to move a user from a child domain ca.domain.com to the parent domain.com.
I was using the Active directory Migration tool and it seemed pretty straight forward until we got an error.

The error we got was
2015-02-02 13:54:27 ERR2:7422 Failed to move source object 'CN=John Doe'. hr=0x8007208c  The operation cannot be performed because child objects exist. This operation can only be performed on a leaf object.

Looking online it looks like this is because the user has an active sync device connected and we need to use ADSI edit to delete this before migrating.

The question I have is if we delete this active sync object from AD will the user have to setup email on their phone again or what can we do to make this seamless to the end-user?

Thanks
0
Comment
Question by:fixitben
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
6 Comments
 
LVL 25

Expert Comment

by:Mohammed Khawaja
ID: 40584911
You would need to setup email on the phone again.  Another way around this would be to use a MDM solution such as XenMobil, AirWatch, etc. where you can provision the devices remotely.
0
 
LVL 53

Accepted Solution

by:
Will Szymkowski earned 500 total points
ID: 40585296
You do not need to use ADSIEdit to remove leaf objects. Simply Open Active Direcotry Users and Computers> Click View> select User,Contact, Groups and Computers as Containers. From there find the user expand the object and remove it from there.

This would be a safer way to remove the leaf object.

Also you will have to re-add the phone once this is removed.

Will.
0
 
LVL 7

Author Comment

by:fixitben
ID: 40585302
What do you mean by add the phone? Remove the account from the phone and set it up again? Would it be better to removed the account from the phone first then delete the leaf then add the account back on the phone.
0
Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

 
LVL 53

Expert Comment

by:Will Szymkowski
ID: 40585305
Removing the account from the phone first would be the easier approach. This way you can ensure that when you remove the entry from Active Directory it will not mess up the phone and give you problems trying to remove the account, without wiping it.

Will.
0
 
LVL 7

Author Comment

by:fixitben
ID: 40585331
Why can't you move the lead object?
0
 
LVL 7

Author Closing Comment

by:fixitben
ID: 40587396
Thanks for your help. I was able to remove the account from the phone then delete the leaf object and it worked great. One thing I didn't realize is you have to delete the exchange folder in AD not just the synced devices. If you removed the devices and leave the folder behind they are in it won't work.
0

Featured Post

NEW Veeam Agent for Microsoft Windows

Backup and recover physical and cloud-based servers and workstations, as well as endpoint devices that belong to remote users. Avoid downtime and data loss quickly and easily for Windows-based physical or public cloud-based workloads!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Last week, our Skyport webinar on “How to secure your Active Directory” (https://www.experts-exchange.com/videos/5810/Webinar-Is-Your-Active-Directory-as-Secure-as-You-Think.html?cid=Gene_Skyport) provided 218 attendees with a step-by-step guide for…
Did you know that more than 4 billion data records have been recorded as lost or stolen since 2013? It was a staggering number brought to our attention during last week’s ManageEngine webinar, where attendees received a comprehensive look at the ma…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question