Re: ADClean errors and complete lack of supporting articles

From: Nitin Shukla \(MSFT\) (nitinsh_at_online.microsoft.com)
Date: 07/13/04 

Date: Tue, 13 Jul 2004 10:50:34 -0500

Hmmm...not sure which attribute it's failing on. On a test account can you
try removing each of those attributes (one at a time) and running ADCLEAN
after each removal? That would help us pinpoint which attribute it's failing
to import.

Also I assume you are using the ADCLEAN from E2K3? 

-- 
Nitin Shukla
Microsoft Support
(nitinsh@online.microsoft.com)
This posting is provided "AS IS" with no warranties, and confers no rights.
"Smith" <Smith@discussions.microsoft.com> wrote in message 
news:12078826-2363-4A96-9348-027463B9AF07@microsoft.com...
> Nitin
>
> Thanks for the response.
>
> The source user has both badPwdCount and BadPasswordTime populated. 
> Resetting the password on the source user seems to make a slight change. 
> Running the ADClean program now produces the following error:
>
> The reason for the failure is (Unwilling To Perform)
>
> I understand this error is related to an inability to populate attributes 
> owned by the system such as:
>
> badPasswordTime
> badPwdCount
> lastLogoff
> lastLogon
> logonCount
> objectGUID
> objectSid
> primaryGroupID
> pwdLastSet
> sAMAccountType
>
> plus ...
> sidHistory
>
> as indicated by articles like
> http://support.microsoft.com/default.aspx?scid=kb;en-us;276382
>
> Unfortunately I can't see any way around this. As we are part way through 
> a long term migration to Exchange 2003 a number of ADC generated accounted 
> are present in AD and need to be linked to "real" accounts. The ADC 
> generated disabled accounts have some of the above attributes populated 
> (such as BadPasswordTime due to hacking attempts). I would think that 
> ADClean could get around this by ignoring these attributes ... ??
>
> How do I get around the "Unwilling to perform" error and get ADClean to 
> actually work as described?
>
> Hope to hear back from you . or anyone else with an answer.
>
> Thanks
> Smith

Relevant Pages

  • Re: 5.5 --> 2003 migration, No SID history
    ... Merging Disabled User and Enabled User by Using the ADClean ... Please do not send e-mail directly to this alias. ... > You can delete the accounts they've already created, ...
    (microsoft.public.exchange.design)
  • Re: ADClean errors and complete lack of supporting articles
    ... On a test account can you ... > try removing each of those attributes and running ADCLEAN ... That would help us pinpoint which attribute it's failing ... Hence there is no way to "fix" it so that ADClean will work. ...
    (microsoft.public.exchange.setup)
  • Re: 5.5 --> 2003 migration, No SID history
    ... merge the accounts using ADClean. ... Please do not send e-mail directly to this alias. ... >>>> migration tool to preserve sid history. ...
    (microsoft.public.exchange.design)
  • Re: ADClean errors and complete lack of supporting articles
    ... ADClean cannot modify attributes like ... Make sure that the accounts are not locked out. ... Then try ADCLEAN again. ... ADC running between AD and 5.5. ...
    (microsoft.public.exchange.setup)