Active Directory Migration Agent Hell

[lasergecko]

I've been trying really hard to get the Active Directory migration Agent to install on several NT 4 and XP Machines.


I've been getting the following error:

2004-07-09 19:22:22 Installing agent on 1 servers
2004-07-09 19:22:22 The Active Directory Migration Tool Agent will be installed on \\NTWKS
2004-07-09 19:22:22 ERR2:7006 Failed to install agent on \\NTWKS, rc=5
Access is denied.
2004-07-09 19:22:22 ERR2:7005 Failed to launch agent on \\NTWKS,
hr=80070005 Access is denied.
2004-07-09 19:22:23 All agents are installed. The dispatcher is finished.


I've checked and made sure that DNS is working.
I originally had the processor architecture problem (Error accessing registry key

SYSTEM\CurrentControlSet\Control\Session Manager\Environment rc=5 Access is denied.)

I've tried adding the Domains Admins group to the local administrators group by using the command:
net localgroup administrators "<domain name>\domain admins" /add (If I right click on My computer, I don't get a Manage menu choice as is mentioned in other solutions people have

given).

I found a suggestion to see if the LOCAL SERVICE group have permissions to the key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg

But I'm unsure how to do this as I find a LOCAL SERVICE group.

I've been through the How To Set Up ADMT for a Windows NT 4.0-to-Windows Server 2003 Migration (MS KB 325851)

The only thing I didn't know how to do was: Enable auditing for the success and failure of Audit account management on the target domain in the Default Domain Controllers policy.


Any suggestions? I've been trying all day.

 

[stash]

I'm going to assume you are running ADMT from the 2003 DC (correct me if I'm wrong), logged on as the domain administrator of the 2003 domain.

In that case, have you added that user to the domain admins group in the NT domain?

Also, are you sure the trust is working between the two domains? A good way to test is to try to add a group from one domain to a group in the other domain. If you can list the users and groups from the other domain (in both directions), the trust is working.

 

[lasergecko]

When I open up the Domain Admins group on the NT machine, I'm not sure how to add the 2003 domain admin user b/c all it lists is not members and an "<-add" button. I'm able to add the account to the LOCAL administrators group but not sure how to add it to the GLOBAL group of Domain Admins.


How do I do this?