Re: ADMT v3 Access is Denied

Is the user that you are logged on with have security credentials to do the
function? Check to make sure that it resides in both domain admins groups.
Having a trust doesn't explicity grant you access to all, you still have to
be granted the trust.

--

Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.

"John" <hush@xxxxxxxxxxxxxx> wrote in message
news:%23rsaMJeFGHA.3984@xxxxxxxxxxxxxxxxxxxxxxx
> An update!
>
> I discovered that the Forest functional level on the test domain needed
> upgrading. I've done this and can now create a two way forest trust that
> validates successfully. However, I'm not able to add users from each
> domain into the relevant Domain Admins groups, so I'm still getting Access
> is denied errors when I attempt the user and group wizards in ADMT v3
>
> John
>
>
> "John" <hush@xxxxxxxxxxxxxx> wrote in message
> news:uoX7XbdFGHA.2320@xxxxxxxxxxxxxxxxxxxxxxx
>> Hi Guys.
>>
>> I'm testing an AD Migration from a domain in one forest to another domain
>> in another forest. We have been taken over by another company and i have
>> to migrate our users/PCs etc from our domain into the new companies
>> domain.
>>
>> I have a test setup using Active Directory Migration Tool v3.0 between
>> out main domain and a test domain we already have.
>>
>> I have installed the Password Export Server Service, set up DNS
>> replication both ways and set up an External 2 way trust. I'm not given
>> the option to set up a Forest Trust for some reason. This may be the
>> problem, as I cannot enter the admin accounts from the source domain into
>> the domain admins group in the target domain or vice versa.
>>
>> When I try to migrate a user using ADMT on the Souce domain, I can go all
>> the way through the Migrate Users wizard but the migration fails with an
>> Access Denied error. If I try to run the wizard on the Target DC, the
>> Wizard fails on the "Password Options" screen with an arror:
>>
>> Unable to establish a session with the password export server. Access is
>> denied
>>
>> Is the access denied error caused by the type of trust I have created? If
>> so, why does the Trust Wizard not give me the option for a Forest type
>> Trust?
>>
>> Thanks
>>
>> John
>>
>
>


.

Relevant Pages

  • Re: creating one way trust
    ... of different forest. ... It sounds for me that you do not need/have a trust, ... Once everything is replicated from the win2k svr. ... Let me try to understan a little more about youre network. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Huge AD deployment
    ... That was the case in Windows 2000, but in Windows Server 2003 forest trusts ... note though is that a forest trust is only transitive for domains within the ... >> company.com in that data center and have every country trust company.com ... instead of going over the internet. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Domain Functional Levels and Trusts
    ... other type of trust, i.e., Forest Trust ... A Forest Trust and an External trust are TWO DISTINCT types ... FORESTS to be in Win2003 Forest Functional Level. ... External trusts are possible in any MODE, ...
    (microsoft.public.windows.server.active_directory)
  • RE: Two way forest trust fails only in one direction
    ... After deep research of the SMB signing, we saw that both servers need Reg Key: ... needed to match on both servers on both sides of the trust. ... B's Forest, but Company B can not access Company As forest at all. ... running DNS and WINS under Windows Active Directory. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Domain Admin Access across Trusted domains
    ... > users to a Domain Local security group, I can't add that Domain Local ... Much, not all, can be conferred my making members of the ... same as making them members of Domain Admins. ... >>> The trust is a two way external trust. ...
    (microsoft.public.win2000.security)