Performing an Active Directory Migration from a windows server 2008 FFL forest to another windows server 2008 FFL forest. User accounts migrate fine, so do computer accounts. However when the ADMT agent goes to update the domain membership on the member computers in one domain I recieve the following error in the ADMT Agent logs:
2009-12-22 14:21:15 ERR3:7075 Failed to change domain affiliation, hr=800704f1 The system detected a possible attempt to compromise security. Please ensure that you can contact the server that authenticated you.
To get around this ensure that you have "Allow cryptography algorithms compatible with Windows NT 4.0" enabled on the default domain controllers policy in both the source and destination domain.
To do this follow Microsoft KB Article 942564:
http://support.microsoft.com/kb/942564
Subscribe to:
Post Comments (Atom)
Hello Clint, this solution (http://blogs.technet.com/askds/archive/2009/10/19/admt-rodc-s-and-error-800704f1.aspx) may work for your issue (or others that are having this same issue) without decreasing the security of your domain.
ReplyDeleteRan into the same problem. I had to modify the domain controller policy on both the source and target DCs. Worked like a charm.
ReplyDeletehttp://support.microsoft.com/default.aspx?scid=kb;EN-US;944043
ReplyDeleteI would like to add the next possible fix for someone that get the same error after the system is migrated with ADMT.
ReplyDeleteKerberos has a limit on the “MaxTokenSize”. If users are member of a lot of groups and subgroups the MaxTokenSize is exceeded.
As a result, the user can’t access the SYSVOL folder. (No policies are loaded)
After creating a new DWORD with the name “MaxTokenSize” at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\
with the value
- fff (HEX) or
- 65535 (Decimal)
The problem was solved.
We hadto do this on every workstation because no logonscript or policy would load.
Greetz Martijn ten Kate