This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

RUM unable to join the computer to the target domain

Hi guys.

I am doing a Intra-Forest migration with QMM/AD, I was able to setup the QMM tool and clone users successfully. With RUM I am able to discover, and process computers with no problem.

When I move the computer to the target domain, RUM shows the move as successful but when the user try to login he received the error:

"The security database on the server does not have a computer account for this workstation trust."

I have the same behaviour in my LAB and PROD environment. Not sure if I Am missing a setting or if Intra-Forest require additional setting.

I am using QMM 8.13

The workstation to migrate is win7 x64

0 david_henry over 8 years ago

Show us a copy of the RUM logs.

Did you copy the computer account before you moved the PC with RUM? Or, did you let RUM create the computer object?
0 Jeff Shahan over 8 years ago

This issue is related to the SPN on the workstation object. The source workstation object need to be disabled or deleted during the move operation. Looks to me like this is failing. Check the Domain Credential configured in the RUM Console, and verify it has Full Control over the computer object in question.
0 eric_bergstrom over 8 years ago

I ran into the same issue today doing the same thing.. Found this article which nailed it: support.quest.com/.../181337
Works fine moving to the default /Computers OU then I manually move. Major PIA. When I pre-staged using QMMAD, RUM gave me a ton of Kerberos errors and would not enable the computer object. Investigating post-RUM scripts that may help in moving.
0 Jeff Shahan over 8 years ago
Eric, Try this.

Using a migration session, migrate the computer object

Target the OU you want to create them in.

Skipping the SPN attribute

All other options the default

This will create a disabled Computer object in AD in the OU you want.

Now using RUM, Move the computer and leave the OU blank. IT will join to the existing Computer object and enable it.
0 eric_bergstrom over 8 years ago

Good advice, Jeff. Once I get through the pilot and the dust settles, I'll try it out. Stay tuned...Eric
0 eric_bergstrom over 8 years ago

I should <hopefully> be able to test this process today..Waiting on the customer.
+1 eric_bergstrom over 8 years ago

Ok. So far, things look better with this approach. I did notice that after the first reboot, the same error cropped up but after waiting about 5 minutes, rebooting, everything came up as expected and the user can log on.
0 Chris.Holley over 7 years ago

Hi Frederic,

Have a look at the below KB with regards to an Intra-forest move and using RUM.

https://support.quest.com/migration-manager-for-ad/kb/232854/error-the-security-database-on-the-server-does-not-have-a-computer-account-for-this-workstation-trust-relationship-intra-forest-domain-move-task-with-resource-updating-manager

Resolution:
When creating a Move task in an Intra-Forest migration, deselect 'Preserve computer account in the source domain'. This will delete the PC samaccountname from the Source Domain when it successfully joins to the Target Domain. Therefore, there is no conflicting samAccountName in the same Forest.