First published on TechNet on Oct 19, 2009
Hello all, Jason here again. With this blog post, I just wanted to bring an ADMT issue to the masses’ attention, as I’ve experienced it multiple times within just the last couple of months.
There’s an issue when attempting to migrate computer account objects into a Windows 2008 domain that had been prepared for a Read-Only Domain Controller with the ‘ADPrep /RODCPrep’ command. To confirm if the command had been implemented, look for the following attribute within the ADSIEdit snap-in on the targeted 2008 domain:
CN=ActiveDirectoryRodcUpdate,CN=ForestUpdates,CN=Configuration,DC=<DomainName>,DC=com
Note:
If ran, the value for the ‘Revision’ attribute will be set to ‘2’.
This is what is specifically witnessed within the ADMT log file:
ERR3:7075 Failed to change domain affiliation, hr=800704f1
The system detected a possible attempt to compromise security. Please ensure that you can contact the server that authenticated you.
When this error is generated, it is due to the following hotfix
NOT
being installed onto the client machine that you are migrating into the Windows 2008 domain:
944043 Description of the Windows Server 2008 read-only domain controller compatibility pack for Windows Server 2003 clients and for Windows XP clients and for Windows Vista
http://support.microsoft.com/default.aspx?scid=kb;EN-US;944043
Upon installing the hotfix and rebooting the client machine(s), re-running ADMT for the computer object migration will now succeed.
- Jason “J4” Fournerat
We support Ukraine and condemn war. Push Russian government to act against war. Be brave, vocal and show your support to Ukraine. Follow the latest news
HERE
