Corruption of ADMT translated profile

[Gabe - GMail]

Folks,

I have a native mode (child) domain on W2K3. I have an existing NT4 source domain. I have correctly setup ADMT on a target DC in the W2K3 domain and am able to migrate users and groups (with SID history) and computers from source to target.

After migration, I am able to successfully translate user profiles on migrated computers both when the user is logged off (in replace mode) and when the user is logged on (in add mode).

In a number of cases, the security translation fails. In one specific case, the user is logged off. I run the Security translation wizard to translate the local profiles on a computer. After the translation, i log in with the migrated account of the target domain. normally i should get the profile of the source domain account. But i don't! Instead, I get a dialog box with the following message: "Windows cannot find the local profile and is logging you on with a temporary profile. changes you make to this profile will be lost when you log off."

Portions of the ADMT log file are reproduced below:
=======
2004-11-15 15:50:14 This profile translation automatically switches from replace mode to add mode if the user is currently logged on or if the profile is in use for other reasons. In order to disable the switching, you need to set the registry HKLM\Software\Microsoft\ADMT\DisallowFallbackToAddInProfileTranslation (REG_DWORD) to 1 on the ADMT machine.
2004-11-15 15:50:21 Translating user profile for johndoe
2004-11-15 15:50:21 WRN1:7654 Switched from replace mode to add mode since the source account 'johndoe' is currently logged on or the profile is in use for other reasons.
2004-11-15 15:50:23 ERR3:7330 Failed to open registry key \Software\Classes, rc=87 The parameter is incorrect.
2004-11-15 15:50:23 ERR3:7331 RegEnumKeyEx failed, rc=87 The parameter is incorrect.
2004-11-15 15:50:23 SecurityTranslation Files:Yes TranslationMode:Add
2004-11-15 15:50:23 Starting
2004-11-15 15:50:25 ------Account Detail---------
2004-11-15 15:50:25 The account detail section uses the following format: AccountName(OwnerChanges, GroupChanges, DaclChanges, SaclChanges).
2004-11-15 15:50:25 johndoe (83, 0, 6, 0)
2004-11-15 15:50:25 -----------------------------
.
2004-11-15 15:50:26 Operation completed.
=======

ADMT reports that the profile is in use (logged on when it is not) which could imply the profile is not unloaded properly. But it also gives the 7330 & 7331 errors and I do not know how to troubleshoot that further. Can i setup some detailed event logging? Any tips or ideas would be appreciated.

Thanks,
Gabe

[Bob Qin [MSFT]]

Hi Gabe,

Thanks for your posting here.

First I would like to confirm the following information with you.

1 Can you get good DNS name resolution to both domains at client machine?

2 Did you migate in "Test mode" or "reall mode"? "Real mode" is relative
to "test mode".

3 Can you check the client machine to see if it really rebooted and post
the netsetup.log on the client machine?

4 Please run computer migration only without other Translate Objects first.
What is the result?

5 Is the Target DC the only DC in the target domain? If so, is it a global
catalog server?

6 Please ping each DC in Source Domain and Target domain on the client.
What is the result? Please also try "nltest /dsgetdc:<domainname> /dns" for
source & target domain, as well as nslookup, set type=srv, query for
_ldap._tcp.dc._msdcs.<domainname>.

I am looking forward to your response.

Regards,
Bob Qin
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
From: "Gabe - GMail" <***@gmail.com>
Subject: Corruption of ADMT translated profile
Date: Tue, 16 Nov 2004 08:13:16 -0600
Newsgroups: microsoft.public.windows.server.migration


Folks,
I have a native mode (child) domain on W2K3. I have an existing NT4
source domain. I have correctly setup ADMT on a target DC in the W2K3
domain and am able to migrate users and groups (with SID history) and
computers from source to target.
After migration, I am able to successfully translate user profiles on
migrated computers both when the user is logged off (in replace mode) and
when the user is logged on (in add mode).
In a number of cases, the security translation fails. In one
specific case, the user is logged off. I run the Security translation
wizard to translate the local profiles on a computer. After the
translation, i log in with the migrated account of the target domain.
normally i should get the profile of the source domain account. But i
don't! Instead, I get a dialog box with the following message: "Windows
cannot find the local profile and is logging you on with a temporary
profile. changes you make to this profile will be lost when you log off."
Portions of the ADMT log file are reproduced below:
=======
2004-11-15 15:50:14 This profile translation automatically switches
from replace mode to add mode if the user is currently logged on or if the
profile is in use for other reasons. In order to disable the switching,
you need to set the registry
HKLM\Software\Microsoft\ADMT\DisallowFallbackToAddInProfileTranslation
(REG_DWORD) to 1 on the ADMT machine.
2004-11-15 15:50:21 Translating user profile for johndoe
2004-11-15 15:50:21 WRN1:7654 Switched from replace mode to add mode
since the source account 'johndoe' is currently logged on or the profile is
in use for other reasons.
2004-11-15 15:50:23 ERR3:7330 Failed to open registry key
\Software\Classes, rc=87 The parameter is incorrect.
2004-11-15 15:50:23 ERR3:7331 RegEnumKeyEx failed, rc=87 The
parameter is incorrect.
2004-11-15 15:50:23 SecurityTranslation Files:Yes TranslationMode:Add

2004-11-15 15:50:23 Starting
2004-11-15 15:50:25 ------Account Detail---------
2004-11-15 15:50:25 The account detail section uses the following
format: AccountName(OwnerChanges, GroupChanges, DaclChanges, SaclChanges).
2004-11-15 15:50:25 johndoe (83, 0, 6, 0)
2004-11-15 15:50:25 -----------------------------
.
2004-11-15 15:50:26 Operation completed.
=======
ADMT reports that the profile is in use (logged on when it is not)
which could imply the profile is not unloaded properly. But it also gives
the 7330 & 7331 errors and I do not know how to troubleshoot that further.
Can i setup some detailed event logging? Any tips or ideas would be
appreciated.
Thanks,
Gabe

[Gabe - GMail]

Hi Bob,

Just to clarify, I did the computer migration first without security
translation and that worked. I have migrated 200 computers successfully and
the only issue was to have Win XP SP2 firewall turned off before migration.

Some days after the computer is migrated, is when I do the the profile
translation. What I have noticed is that on accounts whose profiles give me
problems, I see the following error:
ERR3:7330 Failed to open registry key \Software\Classes, rc=87 The
parameter is incorrect.
ERR3:7331 RegEnumKeyEx failed, rc=87 The parameter is incorrect.

That error consistently occured and leads me to believe that the something
is holding on to the profile as in it does not unload properly for whatever
reason.

To answer your questions:
1) DNS resolution works to the w2K3 domain and NETBIOS resolution works for
both source and target domains

2) Migration was done in Real Mode.

3) The client machine rebooted and I manually rebooted it too. I'll attempt
to locate netsetup.log and post here

4) As I mentioned above, the computer migration went fine.

5) The target DC is one of 3 DCs. It is the PDC emulator but not a GC.

6) Pinging to all DCs work. Netdiag, dcdiag, and nltest report no errors.

Thanks,
Gabe

Post by Bob Qin [MSFT]
Hi Gabe,
Thanks for your posting here.
First I would like to confirm the following information with you.
1 Can you get good DNS name resolution to both domains at client machine?
2 Did you migate in "Test mode" or "reall mode"? "Real mode" is relative
to "test mode".
3 Can you check the client machine to see if it really rebooted and post
the netsetup.log on the client machine?
4 Please run computer migration only without other Translate Objects first.
What is the result?
5 Is the Target DC the only DC in the target domain? If so, is it a global
catalog server?
6 Please ping each DC in Source Domain and Target domain on the client.
What is the result? Please also try "nltest /dsgetdc:<domainname> /dns" for
source & target domain, as well as nslookup, set type=srv, query for
_ldap._tcp.dc._msdcs.<domainname>.
I am looking forward to your response.
Regards,
Bob Qin
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
Subject: Corruption of ADMT translated profile
Date: Tue, 16 Nov 2004 08:13:16 -0600
Newsgroups: microsoft.public.windows.server.migration
Folks,
I have a native mode (child) domain on W2K3. I have an existing NT4
source domain. I have correctly setup ADMT on a target DC in the W2K3
domain and am able to migrate users and groups (with SID history) and
computers from source to target.
After migration, I am able to successfully translate user profiles on
migrated computers both when the user is logged off (in replace mode) and
when the user is logged on (in add mode).
In a number of cases, the security translation fails. In one
specific case, the user is logged off. I run the Security translation
wizard to translate the local profiles on a computer. After the
translation, i log in with the migrated account of the target domain.
normally i should get the profile of the source domain account. But i
don't! Instead, I get a dialog box with the following message: "Windows
cannot find the local profile and is logging you on with a temporary
profile. changes you make to this profile will be lost when you log off."
=======
2004-11-15 15:50:14 This profile translation automatically switches
from replace mode to add mode if the user is currently logged on or if the
profile is in use for other reasons. In order to disable the switching,
you need to set the registry
HKLM\Software\Microsoft\ADMT\DisallowFallbackToAddInProfileTranslation
(REG_DWORD) to 1 on the ADMT machine.
2004-11-15 15:50:21 Translating user profile for johndoe
2004-11-15 15:50:21 WRN1:7654 Switched from replace mode to add mode
since the source account 'johndoe' is currently logged on or the profile is
in use for other reasons.
2004-11-15 15:50:23 ERR3:7330 Failed to open registry key
\Software\Classes, rc=87 The parameter is incorrect.
2004-11-15 15:50:23 ERR3:7331 RegEnumKeyEx failed, rc=87 The parameter is incorrect.
2004-11-15 15:50:23 SecurityTranslation Files:Yes

TranslationMode:Add

Post by Bob Qin [MSFT]
2004-11-15 15:50:23 Starting
2004-11-15 15:50:25 ------Account Detail---------
2004-11-15 15:50:25 The account detail section uses the following
format: AccountName(OwnerChanges, GroupChanges, DaclChanges, SaclChanges).
2004-11-15 15:50:25 johndoe (83, 0, 6, 0)
2004-11-15 15:50:25 -----------------------------
.
2004-11-15 15:50:26 Operation completed.
=======
ADMT reports that the profile is in use (logged on when it is not)
which could imply the profile is not unloaded properly. But it also gives
the 7330 & 7331 errors and I do not know how to troubleshoot that further.
Can i setup some detailed event logging? Any tips or ideas would be
appreciated.
Thanks,
Gabe

[Bob Qin [MSFT]]

Hi Gabe,

Thanks for your reply.

How did you perform "profile translation"? Did you run Security Translation
Wizard?

Based on the logs you provided, it seems that there is currently no logon
server available to service the logon request. I recommend that you set the
target DC as a GC then try again. Please refer to the following documents
for the detailed information.

816105 HOW TO: Create or Move a Global Catalog in Windows Server 2003
http://support.microsoft.com/?id=816105

Have a nice day!

Regards,
Bob Qin
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
From: "Gabe - GMail" <***@gmail.com>
Subject: Re: Corruption of ADMT translated profile
Date: Wed, 17 Nov 2004 06:25:58 -0600
Newsgroups: microsoft.public.windows.server.migration


Hi Bob,

Just to clarify, I did the computer migration first without security
translation and that worked. I have migrated 200 computers
successfully and
the only issue was to have Win XP SP2 firewall turned off before
migration.

Some days after the computer is migrated, is when I do the the profile
translation. What I have noticed is that on accounts whose profiles
give me
problems, I see the following error:
ERR3:7330 Failed to open registry key \Software\Classes, rc=87 The
parameter is incorrect.
ERR3:7331 RegEnumKeyEx failed, rc=87 The parameter is incorrect.

That error consistently occured and leads me to believe that the
something
is holding on to the profile as in it does not unload properly for
whatever
reason.

To answer your questions:
1) DNS resolution works to the w2K3 domain and NETBIOS resolution
works for
both source and target domains

2) Migration was done in Real Mode.

3) The client machine rebooted and I manually rebooted it too. I'll
attempt
to locate netsetup.log and post here

4) As I mentioned above, the computer migration went fine.

5) The target DC is one of 3 DCs. It is the PDC emulator but not a
GC.

6) Pinging to all DCs work. Netdiag, dcdiag, and nltest report no
errors.

Thanks,
Gabe

Post by Bob Qin [MSFT]
Hi Gabe,
Thanks for your posting here.
First I would like to confirm the following information with you.
1 Can you get good DNS name resolution to both domains at client machine?
2 Did you migate in "Test mode" or "reall mode"? "Real mode" is relative
to "test mode".
3 Can you check the client machine to see if it really rebooted and post
the netsetup.log on the client machine?
4 Please run computer migration only without other Translate Objects first.
What is the result?
5 Is the Target DC the only DC in the target domain? If so, is it a global
catalog server?
6 Please ping each DC in Source Domain and Target domain on the client.
What is the result? Please also try "nltest /dsgetdc:<domainname>

/dns"
for

Post by Bob Qin [MSFT]
source & target domain, as well as nslookup, set type=srv, query for
_ldap._tcp.dc._msdcs.<domainname>.
I am looking forward to your response.
Regards,
Bob Qin
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
====================================================
When responding to posts, please "Reply to Group" via your

newsreader so

Post by Bob Qin [MSFT]
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
Subject: Corruption of ADMT translated profile
Date: Tue, 16 Nov 2004 08:13:16 -0600
Newsgroups: microsoft.public.windows.server.migration
Folks,
I have a native mode (child) domain on W2K3. I have an

existing NT4

Post by Bob Qin [MSFT]
source domain. I have correctly setup ADMT on a target DC in the W2K3
domain and am able to migrate users and groups (with SID history) and
computers from source to target.
After migration, I am able to successfully translate user

profiles
on

Post by Bob Qin [MSFT]
migrated computers both when the user is logged off (in replace mode) and
when the user is logged on (in add mode).
In a number of cases, the security translation fails. In one
specific case, the user is logged off. I run the Security

translation

Post by Bob Qin [MSFT]
wizard to translate the local profiles on a computer. After the
translation, i log in with the migrated account of the target

domain.

Post by Bob Qin [MSFT]
normally i should get the profile of the source domain account.

But i

Post by Bob Qin [MSFT]
don't! Instead, I get a dialog box with the following message: "Windows
cannot find the local profile and is logging you on with a temporary
profile. changes you make to this profile will be lost when you log off."
=======
2004-11-15 15:50:14 This profile translation automatically switches
from replace mode to add mode if the user is currently logged on or if the
profile is in use for other reasons. In order to disable the

switching,

Post by Bob Qin [MSFT]
you need to set the registry

HKLM\Software\Microsoft\ADMT\DisallowFallbackToAddInProfileTranslation

Post by Bob Qin [MSFT]
(REG_DWORD) to 1 on the ADMT machine.
2004-11-15 15:50:21 Translating user profile for johndoe
2004-11-15 15:50:21 WRN1:7654 Switched from replace mode to add mode
since the source account 'johndoe' is currently logged on or the

profile
is

Post by Bob Qin [MSFT]
in use for other reasons.
2004-11-15 15:50:23 ERR3:7330 Failed to open registry key
\Software\Classes, rc=87 The parameter is incorrect.
2004-11-15 15:50:23 ERR3:7331 RegEnumKeyEx failed, rc=87 The parameter is incorrect.
2004-11-15 15:50:23 SecurityTranslation Files:Yes

TranslationMode:Add

Post by Bob Qin [MSFT]
2004-11-15 15:50:23 Starting
2004-11-15 15:50:25 ------Account Detail---------
2004-11-15 15:50:25 The account detail section uses the

following

Post by Bob Qin [MSFT]
format: AccountName(OwnerChanges, GroupChanges, DaclChanges,

SaclChanges).

Post by Bob Qin [MSFT]
2004-11-15 15:50:25 johndoe (83, 0, 6, 0)
2004-11-15 15:50:25 -----------------------------
.
2004-11-15 15:50:26 Operation completed.
=======
ADMT reports that the profile is in use (logged on when it is not)
which could imply the profile is not unloaded properly. But it also gives
the 7330 & 7331 errors and I do not know how to troubleshoot that further.
Can i setup some detailed event logging? Any tips or ideas would be
appreciated.
Thanks,
Gabe