Password Export Server Service _VERIFIED_ Download
Carmen Hoogland
This article helps resolve an issue where an "The supplied password does not match this encryption key's password" error occurs when you configure the Password Export Server (PES) service on Active Directory Migration Tool version 3.1.
The supplied password was correct, but Windows Installer (msiexec.exe) failed to open a handle to the policy object on the domain controller for saving the password that will be used by the PES service. The failure indicates that the user account didn't have the required permission.
I am currently migrating from Windows 2012 R2 FFL/DFL Windows Server 2008 R2 to Windows 2019 FFL/DFL Windows Server 2016 using a domain trust. I have set everything up using -series-4-password-export-server.html and I have migrated OUs, Groups and Users but when I try and migrate passwords I get "Unable to establish a session with the password export server. The RPC server is unavailable. I have uninstalled the password export server and reinstalled using the domain admin of the target domain for the service credentials. I confirmed that the firewall is turned off on the PDC emulator server which hosts the password export service. Does anyone have any other ideas?
This is my first time trying to do a migration using ADMT. I've got everything configured. Two-way forest trust, DNS is working between forests, ADMT installed on Target DC, PES installed on Source member server. Administrative account from Source domain located on Target and vice versa. I can migrate a user accounts just fine without passwords, but if I try to do it with a password, I receive this error. The PES service is started on the Source. Any tips?
The RPC server is unavailable because the service couldn't function properly because it's dependancy (server service) couldn't start.check the dependencies through the server's properties->services and start those required dependancies to start the server service.
If in addition to migration objects (users, groups, computers, etc.) you also need to migrate passwords, then you also need to install the Password Export Service (PES) on a(ny) writable DC in the source AD domain. PES cannot be installed on a read-only domain controller (RODC). The default behavior of ADMT, when migrating passwords, is to configure every target user account with "change password at next logon", unless "password never expires" (most likely service accounts) or "smartcard is required for interactive logon" on the source user account. After the password migration, it is also possible to revert the setting of "change password at next logon" by using PowerShell, ADMOD or any other LDAP modification tool.
password migration is failing because the PES service is not running. Why the service is not starting I do not know. I do not know the event IDs from thw top of my head. Can you post the contents of the event id?
I would like to suggest we check the procedure of PES setup and check how
things are working:Part 1: PES setup.
================
When performing inter-forest migrations using ADMT v.3, we need to setup
Password Export Server (PES) service in the source domain DC and install
ADMT in the target domain DC. The two DCs share the same key to ensure the
passwords are migrated in a secure way.The PES service can be installed on any domain controller in the source
domain that supports 128-bit encryption. ADMT v.3 provides the option to
run the PES service under the Local System account or by providing the
credentials of an authenticated user in the target domain.Note: To improve security, run the PES service as an authenticated user in
the target domain rather than under the Local System account. If you choose to run the PES service under the Local System account, you
must ensure that the built-in Pre-Windows 2000 Compatible Access group
contains the Everyone group in the target domain. The Everyone group will
not be in the Windows 2000 Compatible Access group if you selected
Permissions compatible only with Windows 2000 or Windows Server 2003
operating systems when you installed Active Directory in the target domain.If the Everyone group is not in the Windows 2000 Compatible Access group,
you will receive an Access Denied error message. You must then manually add
the Everyone group to the Windows 2000 Compatible Access group to enable
support for password migration. To do this, type the following at the
command line on a target domain controller:NET LOCALGROUP"Pre-Windows 2000 Compatible Access" Everyone /ADDIf your target domain is a Windows Server 2003 domain, you must also add
the Anonymous Logon group to the Pre-Windows 2000 Compatible Access group.
To do this, type the following at the command line on a target domain
controller:NET LOCALGROUP"Pre-Windows 2000 Compatible Access""ANONYMOUS LOGON" /ADD.After this update to the Pre-Windows 2000 Compatible Access group
replicates, restart the Server service on all domain controllers in the
target domain.The PES service installation requires an encryption key created on the
computer running ADMT in the target domain. The key must be available on a
local drive. This can be a floppy drive or a folder on the local hard disk,
but not a network mapped drive or shared folder. For security reasons, it
is best to use a floppy disk so that the key can be stored in a secure
location or reformatted after the migration is complete. The encryption key is created by using admt key from a command line. TASK1: To create an encryption key.
1. Log onto the computer in the target domain on which you installed ADMT
by using your ADMT migration account.2. Open a command window and navigate to the drive on which ADMT is
installed, and at the command line, type:ADMT KEY /option:create /sourcedomain:"source domain" /keyfile:"key file
path" /keypassword:passwordThe source domain can be specified as either the DNS or NetBIOS name. A
password, which provides key encryption, is optional. To protect the shared
key, type either the password or an asterisk on the command line. The
asterisk causes you to be prompted for a password that is not displayed on
the screen.Note: To ensure maximum security, providing a password is strongly
recommended.After you create the encryption key, configure the PES service on a domain
controller in the source domain. TASK 2: To enable password migration on the source domain.1. On the PES in the source domain, insert the encryption key disk.2. In the Pwdmig directory, run Pwdmig.msi. If you set a password during
the key generation process on the domain controller in the target domain,
the Key Password Required dialog box appears. Provide the password that was
given when the key was created. Click Next.3. Specify the account to run the PES service.Note: To improve security, run the PES service as an authenticated user in
the target domain rather than under the Local System account. 4. After the installation completes, restart the domain controller.5. After the domain controller restarts, start the PES service by clicking
Start, Administrative Tools, and then Services. In the details pane,
right-click Password Export Server Service and select Start.Note: Only run the PES service when migrating passwords. Stop the PES
service after completing password migrations for maximum security.Part 2: ADMT Side issues.From your post, the error message occurs when performing group migration, I
would like to suggest that we:1. Run ADMT 3.0. Choose the two DCs you used when setting up PES.
2. Migrate the groups and users separately (do not migrate the associated
members when migrating groups). During the group migration, please use the following configurations[Group Options]Copy group members* Not Checked
Fix membership of group* CheckedDuring the user migration, please use the following configurations:[User Options]Migrate associated user groups* Not Checked
Fix users' group memberships* CheckedRegarding the additional Exchange issue, I would like to suggest that we
migrate the user accounts using ADMT first. After that, you can use
Exchange side tool to migrate the Exchange related information. If you
want, you can submit questions in our Exchange newsgroups such as:microsoft.public.exchange.adminThere is more qualified pool of respondents who can give you suggestions on
the Exchange side. Meanwhile, other users who visit the newsgroups
regularly can either share their knowledge or learn from your interaction
with us. Hope this helps!
The ADMT tool gives us a great way to migrate to our managed Microsoft AD service that allows powerful customization of the migration, and it does so in a more secure way through encrypted password synchronization. You may need to do additional investigation and planning if the complexity of your environment requires a different approach with some of these steps.
When we are migrating users with password from external domain to our child domain, we are getting the error "unable to establish a session with the password export server. The RPC server is unavailable". But users without password is migrating successfully. The PES server is configured properly in source domain DC and its running fine.The DNS resolution is happening properly.The two-way trust is in place.Also, we found the migrated user (without password) is going to parent domain and not the child domain.Please help us.ThanksBals
I have installed ADMT in child domain DC only. Do we have to install ADMT in root domain and migrate users from source domain to child domain? PES server service is running fine in Source DC and no permission issue.Computer migration is also successful.Are there any tools to check/monitor the ports?RegardsBals
Hi, SantoshIn a cenario we had one windows 2003 ent server,Know we had install windows 2008 server.We want to migrate users and group.The step we had follow are as below,1)We had in ADMT 3.1 toll on Win2k8 server and Password Export Server tool also.2)Created an user on both the Domain and also added in Domain Admin in Win2k8 server and Bulitin Administrator Group in Win2003 server.3)Install Password Service and aslo started the services manually.Error.While Migration on users we select (What type of password do you want to use ?therw we select Migrate PasswordThen we get error Unable to establish a session with the password export server.The specified service does not exit as an installed service.Pl provide the solution for this.Thanks
df19127ead