Users are not migrated when you use Active Directory Migration Tool with the "Fix users' group memberships" option in Windows Server 2003

If you migrate users from a source domain to a target domain, Active Directory Migration Tool version 2 (ADMT) fails to make previously migrated user accounts members of security groups in the target domain. The user accounts were in the target domain that they were a member of in the source domain. This symptom occurs despite checking the Fix user's group memberships check box, or running the command line equivalent of this check box. ADMT is a Microsoft utility that migrates user accounts, computer accounts, and security groups from Microsoft Windows NT 4.0, Microsoft Windows 2000, and Microsoft Windows Server 2003 source domains to Windows 2000 and Windows Server 2003 target domains.

A typical domain migration consists of first migrating security groups without group members from the source domain to the target domain in one migration pass. After you do so, you complete additional migrations to move user accounts from source domains to target domains.

As memberships to security groups are modified in the source domain, security groups are re-migrated from the source to the destination domain on a recurring basis.

During each migration, the database on the ADMT console computer records the name of the domain controller in the source domain that accepted migrated objects from the source domain domain controller. The source domain controller in the source domain was discovered by using domain controller locator functions.

The code defect that is described in this article occurs if the following conditions are true:

• During user migration, the Fix user's group memberships setting or its command line equivalent is enabled.
• The destination domain controller listed in the ADMT migration database as having last received the user account is offline, renamed, or otherwise inaccessible to the ADMT console computer.

If these conditions are true, ADMT successfully migrates the user account to another domain controller in the destination domain if the ADMT console computer can bind to another domain controller in the target domain. However, ADMT does not update the user's group membership in the target domain.

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.
This hotfix makes it possible for the ADMT console computer to update the group membership information on the domain controller in the target domain that the ADMT console bound to during the migration of the user account.

Prerequisites

Install this hotfix on all computers in your environment that are used to perform ADMT migrations.

Restart requirement

You do not have to restart your computer after you apply this hotfix. However, you must stop ADMT if it is currently running, install the hotfix, and then restart ADMT.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

To work around this problem, follow these steps:

1. Re-migrate all groups. Click the Replace conflicting accounts option, and do not click the following options:
   • Remove existing user rights
   • Remove existing members of groups being replaced
   • Move the existing account to the previously specified target Organizational Unit
   This process updates the server information for the security groups.
2. Re-migrate the users. Click the Replace conflicting accounts and Fix users' group memberships options. You can also click other options that you want to apply.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

For additional information about the standard terminology that is used to describe Microsoft software updates, click the following article number to view the article in the Microsoft Knowledge Base: