ADMT - can't migrate sidhistory

[B. Hilliard]

When trying to migrate an nt4 user account including the sid, we're getting
an error that either (a) the tcpipclientsupport registry entry hasn't been
done on the pdc or (b) cannot contact the pdc. (obviously not the exact
error message). The account migrates but without sid history. The controller
is setup to see wins.

The registry entry is in place. A two-way trust is in place, and appears to
work fine. Both netdom and nltest verify this.

Any info or suggestions would be greatly appreciated.

Bobby Hilliard
(e-mail address removed)

 

[smooredhs]

Did you reboot the PDC after the registry change?

 

[B. Hilliard]

Yes. Even removed the registry entry, restarted, added it back, and
restarted.

The error pops up after clicking Next on the "User Account" screen where
credentials are entered that have rights in the nt4 domain. The rights have
been tripled checked. Funny thing, if an invalid account is entered...the
error still pops up.

NBTSTAT -C shows an entry for the old domain, with type Group, and there's
an entry for the pdc.

 

[B. Hilliard]

Was looking at a copy of protar.mdb file int the admt folder in the "Action
History" table and noticed that on a couple of the account migrates that
failed, the BDC was listed as the server??? The BDC didn't have the registry
entry applied, only the PDC. Don't know why the BDC was contacted first...

Worth a try...

 

[smooredhs]

We applied the registry change to one BDC also anyway, in case we had to
promote it to PDC for some reason. I wish I had more suggestions for you,
but we used a third-party migration tool, I haven't worked with ADMT much.

 

[Hotwires]

Another thing to check for is sid history filtering. It is
turned on by default with sp4.

http://support.microsoft.com/default.aspx?scid=kb;en-
us;289243&Product=win2000

Also, get a real tool to migrate......

http://wm.quest.com/products/domainmigrationwizard/

 

[B.Hilliard]

Just for the record, still having the issue. Have removed
and reinstalled admt, no effect. Trusts are working. Reg
entry is applied and pdc restarted. AD controller running
admt is pointed to wins. domain admins added to
respective administrator groups. <domain>$$$ group
created on NT domain. Auditing is turned on on both
domains.

Here's the actual text of the error on the screen
(nothing shows in event log):

Either the source domain's primary domain controller
(PDC) has not been re-started after setting the
TcpipClientSupport registry key to 1 or the PDC could not
be contacted.

Happens on the User Account screen after entering
credentials with admin rights on the source domain.

I haven't been able to reproduce the problem in the lab.

Even tried changing the value of the source domain pdc in
the protar.mdb database (settings table) to a non
existent value, but apparently the settings table
reflects the settings of the last migration attempt.

Still looking.