Article ID: 833230
Article Last Modified on 7/24/2007
APPLIES TO
- Microsoft Windows Server 2003, Standard Edition (32-bit x86)
- Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
SYMPTOMS
If you migrate users from a source domain to a target domain, Active Directory Migration Tool version 2 (ADMT) fails to make previously migrated user accounts members of security groups in the target domain. The user accounts were in the target domain that they were a member of in the source domain. This symptom occurs despite checking the Fix user's group memberships check box, or running the command line equivalent of this check box. ADMT is a Microsoft utility that migrates user accounts, computer accounts, and security groups from Microsoft Windows NT 4.0, Microsoft Windows 2000, and Microsoft Windows Server 2003 source domains to Windows 2000 and Windows Server 2003 target domains.
CAUSE
A typical domain migration consists of first migrating security groups without group members from the source domain to the target domain in one migration pass. After you do so, you complete additional migrations to move user accounts from source domains to target domains.
As memberships to security groups are modified in the source domain, security groups are re-migrated from the source to the destination domain on a recurring basis.
During each migration, the database on the ADMT console computer records the name of the domain controller in the source domain that accepted migrated objects from the source domain domain controller. The source domain controller in the source domain was discovered by using domain controller locator functions.
The code defect that is described in this article occurs if the following conditions are true:
- During user migration, the Fix user's group memberships setting or its command line equivalent is enabled.
- The destination domain controller listed in the ADMT migration database as having last received the user account is offline, renamed, or otherwise inaccessible to the ADMT console computer.
If these conditions are true, ADMT successfully migrates the user account to another domain controller in the destination domain if the ADMT console computer can bind to another domain controller in the target domain. However, ADMT does not update the user's group membership in the target domain.
RESOLUTION
Hotfix information
A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.
To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:
Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:
This hotfix makes it possible for the ADMT console computer to update the group membership information on the domain controller in the target domain that the ADMT console bound to during the migration of the user account.
Prerequisites
Install this hotfix on all computers in your environment that are used to perform ADMT migrations.
Restart requirement
You do not have to restart your computer after you apply this hotfix. However, you must stop ADMT if it is currently running, install the hotfix, and then restart ADMT.
Hotfix replacement information
This hotfix does not replace any other hotfixes.
File information
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
Date Time Version Size File name --------------------------------------------------------------------- 13-Feb-2004 20:41 5.2.3790.127 536,576 Mcsdctworkerobjectsnt4.dll 13-Feb-2004 20:41 5.2.3790.127 463,872 Mcsdctworkerobjects.dll
WORKAROUND
To work around this problem, follow these steps:
- Re-migrate all groups. Click the Replace conflicting accounts option, and do not click the following options:
- Remove existing user rights
- Remove existing members of groups being replaced
- Move the existing account to the previously specified target Organizational Unit
- Re-migrate the users. Click the Replace conflicting accounts and Fix users' group memberships options. You can also click other options that you want to apply.
STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
MORE INFORMATION
For additional information about the standard terminology that is used to describe Microsoft software updates, click the following article number to view the article in the Microsoft Knowledge Base:
824684 Description of the standard terminology that is used to describe Microsoft software updates
Keywords: kbhotfixserver kbqfe kbbug kbfix kbqfe kbwinserv2003presp1fix KB833230
