Migrate computer from NT domain to Win2K AD

Discussion in 'Server Migration' started by Bruce Cao, Oct 15, 2004.

  1. Bruce Cao

    Bruce Cao Guest

    When I want to migrate our computers from NT domain to Win2K AD domain with
    ADMT, it keeps on getting this information in the log file, and the
    migration failed at last.

    2004-10-15 11:02:37 Created account input file for remote agents:
    DCTCache.007
    2004-10-15 11:02:38 Installing agent on 1 servers
    2004-10-15 11:02:38 The Active Directory Migration Tool Agent will be
    installed on \\SZDK027
    2004-10-15 11:02:38 WRN1:7290 Processor architecture for machine \\SZDK027
    is unknown, Error accessing registry key
    SYSTEM\CurrentControlSet\Control\Session Manager\Environment rc=5
    Access is denied.
    2004-10-15 11:02:38 ERR2:7006 Failed to install agent on \\SZDK027, rc=5
    Access is denied.
    2004-10-15 11:02:38 ERR2:7005 Failed to launch agent on \\SZDK027,
    hr=80070005 Access is denied.
    2004-10-15 11:02:39 All agents are installed. The dispatcher is finished.


    I had already have the domain administrator account in both source and
    target domain, also the 2 domain administrator had been added to another
    domain's local administrator group.

    any advice would be appricated.

    Bruce
     
    Bruce Cao, Oct 15, 2004
    #1
    1. Advertisements

  2. Bruce Cao

    Bruce Cao Guest

    Thanks for attention and I had solved this by myself.

    in the being migrated PC, I add the administrator of the target domain to
    its local adminisrator groups, it works now. but here I wonder why should
    that be since we had set (2) way trust and also add both (2) domain
    administrators to the local administrator groups of each other, so they
    should have the enough rights to do that already.

    if we have to do that one by one, it's a heavy workload for us since we have
    lots of clients over different sites...

    any further advice would be appreciate.


    Best Regards

    Bruce
     
    Bruce Cao, Oct 15, 2004
    #2
    1. Advertisements

  3. Hi Bruce,

    I believe you have encountered the same issue as a thread in this newsgroup
    with the subject " Problem using ADMT to migrate computer accounts".

    I would like to forward Michael's point below, DOMAIN 1 is the source
    domain and DOMAIN 2 is the destination:
    ===========================================
    Sounds like your situation is the one I describe below:

    DOMAIN1 (Source)
    ----------
    DOMAIN1\Administrators contains DOMAIN1\Domain Admins (by default) and
    DOMAIN2\Administrators.

    Workstations in DOMAIN1
    ----------
    By default, WORK1\Administrators (the local administrators group on
    workstations) will only contain global group DOMAIN1\Domain Admins, and NOT
    the local group DOMAIN1\Administrators since it is impossible in NT 4.0 for
    a local group to contain another local group.

    Therefore:
    ----------
    Simply by adding DOMAIN2\Domain Admins to DOMAIN1\Administrators does not
    give access to the workstations. (DOMAIN1\Domain Admins does not contain
    DOMAIN1\Administrators, it is the other way around). You can't give an
    account from another domain administrative access to workstations at the
    domain level, you have to add them to the local Administrators group to
    each workstation.

    If you run the ADMT console under the credencials of someone in
    DOMAIN1\Domain Admins, you have access to all the workstations (unless
    someone removed the Domain Admins group from Administrators in a
    workstation).
    ====================================================

    I believe Michael has addressed this question. Any update, let us get in
    touch!

    Best regards,

    Rebecca Chen

    MCSE2000 MCDBA CCNA


    Microsoft Online Partner Support
    Get Secure! - www.microsoft.com/security

    =====================================================

    When responding to posts, please "Reply to Group" via your newsreader so
    that others may learn and benefit from your issue.

    =====================================================
    This posting is provided "AS IS" with no warranties, and confers no rights.
     
    Rebecca Chen [MSFT], Oct 15, 2004
    #3
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.