1

Hi
I’m currently working on migrating from old.domain to new.domain using Active Directory Migration Tool. Both domains have Windows Servers 2019. The goal is to move all users, groups, computers, and resources with minimal disruption, while preserving SID history to maintain access to existing resources during the transition. I’m running into an issue that I’d appreciate some help with.

Issue -
While user and group migrations (including SID history) are working smoothly. When I try to do security translation and computer migration, it fails with this error -

ERR2:7666 Unable to access server service on the machine ‘OLD-TEST.domain.com’. Make sure netlogon and workstation services are running and you can authenticate yourself to the machine.
hr=0x800706ba. The RPC server is unavailable.

Some Key points about this issue:

The computer does get created in the new domain.
The failure occurs during the post-copy phase, when ADMT tries to install its agent on the source machine to translate profiles and update local permissions.

What I have verified and configured
Two-way forest trust fully established and verified between old and new domains.
DNS resolution (forward and reverse) is working fine between all servers and clients.
Migration admin accounts have Administrator permissions on both domains.
Netlogon, Workstation, and Server services are running on test machines.
Windows Firewall is disabled on test workstations

4 Spice ups
2

Is it possible the profile running the ADMT process isn’t elevating on the computer? I’d start by verifying whatever domain admin you’re using has appropriate access at both ends.

1 Spice up
3

Yes, i have checked and the account running the ADMT has full access. The weird thing is its giving me a same error if i try to migrate a computer from new domain to old domain even though the new domain does not have too many restrictions as i am doing testing on it

1 Spice up
4

Can you see SYSVOL from a member computer on either domain? It’s starting to sound like DC’s aren’t talking.

1 Spice up
5

i just checked and yes computer from old domain can access sysvol from new and old domain and another computer from new domain can also access sysvol from new and old domain

1 Spice up
6

What’s handling NTP on both sides? Are all your clocks in sync? (running down the list of things that can potentially cause these errors)

You mentioned checking DNS, is that hosted on the domain controllers at both domains or on a third-party (like router/firewall)?

Have you tried to manually install the ADMT agent on the computer after it’s created in the new domain? You say it’s added successfully but that fails, does it also still exist in the old domain (in AD) by chance? Are you using Azure and a hybrid environment?

1 Spice up
7

NTP is set up on both domain servers and they are in sync

Old domain has a separate DNS server but on the new domain, the domain controller is handling DNS

I have not tried manually installing the ADMT agent yet. I will try that as well.
for the migration process, yes the computer gets copied to the new server but fails during the post-copy phase migration. It still exist in the old domain as i am trying the Add method instead.

Yes, we are on Azure hybrid. Both domains are on hybrid environment and its working with the user migration as well with delete and re-add into the OU to keep the user on the Azure.

1 Spice up
8

Try the manual install then, and if the machines are working correctly in the new domain as well as Azure, then keep on keeping on…

1 Spice up
9

Check to make sure the account you are running the ADMT console from has administrator rights on the PC you are migrating. When I did a migration a couple years ago, even though I was using a Domain Admin account in the new domain, it didn’t have administrator rights on the workstations in the old domain. I ended up manually adding that account as a local admin on all workstations.

2 Spice ups
10

I tried manually adding the administrator rights on the devices but unfortunately its the same result :frowning:

1 Spice up
11

i am trying to install it manually. i got the agent from the ADMT installed folder on the server but when i am trying to install it on the computer, nothing happens. I thought maybe it just installed in the background so i ran the ADMT migration again but it gave me the same error. Not really sure if i am doing the installation the right way

1 Spice up
12

You’ll have to google the Registry location to verify if it wrote properly.