Re: Trouble migrating couputers (ADMT v3)

I believe this is related to time sychronization. If your two
domains/forest do not have their time sychronized then you will get
access denied errors when trying to create objects within AD.

Jake



Bill wrote:
I don't think you've missed anything, I've experienced the same thing.
Logging on as the domain admin works in some cases, but in my experience,
you'll still not be able to move some of the computers as the domain admin,
as access will fail. This is hit or miss. The startup script has worked
for me in the past. Once the proper account is in the administrators group,
you should be able to verify connectivity with ADMT. I've also used 3rd
party tools such as Quest's, and all have the same problem.

"Nick" <Nick@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:30CCB3FF-7FE9-4E30-B580-33D99FFF530A@xxxxxxxxxxxxxxxx
I just tried something to see if it would work. I logged on to the domain
controller of the new domain as OldDomain\Administrator and ran ADMT.
When I
attempted to migrate the same computer this way it was successful.

Did I miss something? Is this how it is supposed to work? Or is my trust
not working properly in both directions? I verified it in both
directions.

--Nick



"Bill" wrote:

I've always had this problem with some clients as well. The best
solution
I've found is to write a startup script that adds the appropriate account
to
the administrators group:

net localgroup administrators <account> /add


"Nick" <Nick@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:09D564D6-8C8C-4193-84A2-751DFE6ED331@xxxxxxxxxxxxxxxx
I am having trouble migrating computers from a Windows NT domain to a
Windows
2003 domain(ADMT v3). I have set up a two way trust between the
domains
and
have been successful in migrating users, but when I attempt to migrate
computers I get the following:

ERR2:7006 Failed to install agent on \\COMPUTERNAME, rc=5 Access is
denied.
ERR2:7667 Unable to access ADMIN$ share on the machine 'COMPUTERNAME'.
Make
sure the share exists and the account running ADMT is a member of local
administrators group on the machine 'COMPUTERNAME'. hr=0x80070005.
Access
is
denied.

The computer account is created fine, it's just when ADMT attempts to
move
the system it fails.

I have verified that NewDomain\Domain Admins and
NewDomain\AdministratorAccount are both in the OldDomain\Domain Admins
group
and that OldDomain\Domain Admins is in the Adminitrators LocalGroup on
the
computers. Also, Admin$ is set up on these computers as well.

I found that if I physically go to the computer being migrated and add
NewDomain\AdministratorAccount to the Administrators LocalGroup on the
computer it works fine, but I don't want to have to do this to all the
systems to be able to migrate them.

I read another thread here that suggest that I turn off SID filtering
on
the
trust so I did that, but no change. Any help would be greatly
appreciated.

--Nick




.

Relevant Pages

  • Re: Rid AD of Circular Group Membership
    ... Unfortunately since the previous Admin used Restricted Groups on the Default ... Administrators group in the domain can manage the domain controllers ... and have use on members if it is used there. ... The quess is each has an account and uses it, ...
    (microsoft.public.windows.group_policy)
  • Re: STSadm createssp
    ... The strange thing is that when I log on using the Central Admin ... service account I succeed in creating the SSP, ... my WFE and my SQL box and is member of the farm administrators group. ... All you should need is local admin on the local box for the proper ...
    (microsoft.public.sharepoint.portalserver)
  • Re: WMI Security question...
    ... The account is an admin on the box. ... And this is Windows 2003 Server. ... Administrators group when the computer is joined to the domain. ...
    (microsoft.public.scripting.vbscript)
  • Re: Domain user secuirty
    ... You never want to put a regular user in the domain admins or administrators group on ... > windows 2000 computers. ... > admin or Administrator group. ...
    (microsoft.public.win2000.security)
  • Re: Trouble migrating couputers (ADMT v3)
    ... Logging on as the domain admin works in some cases, but in my experience, ... you'll still not be able to move some of the computers as the domain admin, ... Once the proper account is in the administrators group, ... I've found is to write a startup script that adds the appropriate account ...
    (microsoft.public.windows.server.general)