SID History Migration Errors

[Franz Schenk]

Have to migrate an NT4 domain into a Windows 2003 AD. Have prepared
evreything according ADMT V3 migration guide, and everything works fine
three weeks ago.

Came back this week after a three week vacation, and tried to migrate a
global group with SID history. This doesn't work anymore, I'm getting the
errors in the ADMT Logfile below. Have verified that the TCPIP Client
Support Registry Entry is still present on the NT4 PDC, as well as the local
group <nt4-domain>$$$, as well as the audit setting for user account
management. Have limited access rights in the Windows 2003 domain, but three
weeks earlier, the exactly same operation worked fine. The Windows 2003
domain admins told me that they had changed nothing (as usual).

Has anybody an advice how to track down the errors described in the ADMT
Logfile below? Thank you all in advance for any help.

regards,
Franz

-------------------

[Settings Section]
Task: Group Migration (29)
ADMT Console
User: newdomain\miguser
Computer: 99002.xx.yy.ch (99002)
Domain: xx.yy.ch (KT)
OS: Microsoft Windows Server 2003 5.2 (3790) Service Pack 2
Source Domain
Name: DOM3
DC: ZPDC
OS: Windows NT 4.0
Target Domain
Name: xx.yy.ch (KT)
DC: 20011.xx.yy.ch (20011)
OS: Windows Server 2003 5.2 (3790) Service Pack 2
OU: LDAP://xx.yy.ch/OU=Groups,OU=Management,DC=xx,DC=yy,DC=ch
Intra-Forest: No
Migrate Security Identifiers: Yes
Update Rights: No
Fix group membership: No
Conflict Option: Ignore
Migrate members: No
[Object Migration Section]
2007-10-23 17:54:45 Starting Account Replicator.
2007-10-23 17:54:48 CN=CUT_PDF - Created
2007-10-23 17:55:52 ERR2:7435 SID History cannot be updated for CUT_PDF.
This operation requires the TcpipClientSupport registry key to be set on .
Changes to the TcpipClientSupport registry key require a restart to take
effect. rc=6.
2007-10-23 17:55:52 WRN1:7392 SIDHistory could not be updated due to a
configuration or permissions problem. The Active Directory Migration Tool
will not attempt to migrate the remaining objects.
2007-10-23 17:55:52 Operation Aborted.
2007-10-23 17:55:52 Operation completed.

[Mike Luo [MSFT]]

Hello,

I suggest you perform some tests to narrow down the problem:

1. Ping the PDC emulator role holder in source domain from the computer
that is running ADMT. Make sure you are successful in Ping FQDN and NetBIOS
name.
2. Ping the PDC emulator role holder in target domain from the PDC in
source domain. Ensure that you are successful in Ping FQDN and NetBIOS name.
3. Try to migrate user account with SID history to see if the error appears.
4. Migrate all users that are inluded in the global group before migrating
the global group, and then migrate global group.

Update me with the result and I look forward to your reply.

Mike Luo

Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

[Franz Schenk]

Hi Mike

Excellent support, thank you very much for your help!

The problem was a wrong DNS entry (typing error) of the NT4 PDC in the new
Windows 2003 domain, that was done during my three week absence! According
the ADMT errors, I didn't suspect a DNS error, and I could access the NT4
PDC from the Windows 2003 migration server without any problem (probably due
to the enries in WINS which are correct).

best regards,
Franz

Post by Mike Luo [MSFT]
Hello,
1. Ping the PDC emulator role holder in source domain from the computer
that is running ADMT. Make sure you are successful in Ping FQDN and NetBIOS
name.
2. Ping the PDC emulator role holder in target domain from the PDC in
source domain. Ensure that you are successful in Ping FQDN and NetBIOS name.
3. Try to migrate user account with SID history to see if the error appears.
4. Migrate all users that are inluded in the global group before migrating
the global group, and then migrate global group.
Update me with the result and I look forward to your reply.
Mike Luo
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

[Mike Luo [MSFT]]

Appreciate your response. I am very glad to hear that information be
helpful to you. It is my pleasure to be of assistance.

Have a nice day!

Mike Luo

Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.