Users are not migrated when you use Active Directory Migration Tool with the "Fix users' group memberships" option in Windows Server 2003 (833230)

SYMPTOMS

If you migrate users from a source domain to a target domain, Active Directory Migration Tool version 2 (ADMT) fails to make previously migrated user accounts members of security groups in the target domain. The user accounts were in the target domain that they were a member of in the source domain. This symptom occurs despite checking the Fix user's group memberships check box, or running the command line equivalent of this check box. ADMT is a Microsoft utility that migrates user accounts, computer accounts, and security groups from Microsoft Windows NT 4.0, Microsoft Windows 2000, and Microsoft Windows Server 2003 source domains to Windows 2000 and Windows Server 2003 target domains.

CAUSE

A typical domain migration consists of first migrating security groups without group members from the source domain to the target domain in one migration pass. After you do so, you complete additional migrations to move user accounts from source domains to target domains.

As memberships to security groups are modified in the source domain, security groups are re-migrated from the source to the destination domain on a recurring basis.

During each migration, the database on the ADMT console computer records the name of the domain controller in the source domain that accepted migrated objects from the source domain domain controller. The source domain controller in the source domain was discovered by using domain controller locator functions.

The code defect that is described in this article occurs if the following conditions are true:

During user migration, the Fix user's group memberships setting or its command line equivalent is enabled.
The destination domain controller listed in the ADMT migration database as having last received the user account is offline, renamed, or otherwise inaccessible to the ADMT console computer.

If these conditions are true, ADMT successfully migrates the user account to another domain controller in the destination domain if the ADMT console computer can bind to another domain controller in the target domain. However, ADMT does not update the user's group membership in the target domain.

RESOLUTION

Hotfix information

A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Only apply it to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Windows Server 2003 service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.
This hotfix makes it possible for the ADMT console computer to update the group membership information on the domain controller in the target domain that the ADMT console bound to during the migration of the user account.

Prerequisites

Install this hotfix on all computers in your environment that are used to perform ADMT migrations.

Restart requirement

You do not have to restart your computer after you apply this hotfix. However, you must stop ADMT if it is currently running, install the hotfix, and then restart ADMT.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

   Date         Time   Version       Size     File name
   ---------------------------------------------------------------------
   13-Feb-2004  20:41  5.2.3790.127  536,576  Mcsdctworkerobjectsnt4.dll
   13-Feb-2004  20:41  5.2.3790.127  463,872  Mcsdctworkerobjects.dll

WORKAROUND

To work around this problem, follow these steps:

Re-migrate all groups. Click the Replace conflicting accounts option, and do not click the following options:
- Remove existing user rights
- Remove existing members of groups being replaced
- Move the existing account to the previously specified target Organizational Unit
This process updates the server information for the security groups.
Re-migrate the users. Click the Replace conflicting accounts and Fix users' group memberships options. You can also click other options that you want to apply.