While working on the MPAD project, we encountered an issue with sIDHistory migration. Although all prerequisites were met, the migration failed due to missing extended account rights, even though the migration account had Domain Admin privileges.
Click Start, select Administrative Tools, and then open Active Directory Users and Computers.
Right-click the domain on which you want to delegate the MigrateSidHistory extended right, and select Delegate Control to launch the Delegation of Control Wizard.
Click Next, then click Add. In the Select Users, Computers, or Groups dialog box, enter the user or group that will perform the SID migration. Click OK, and then click Next.
Select Create a custom task to delegate, and then click Next.
Select This folder, existing objects in this folder, and creation of new objects in this folder, and then click Next.
Select General, then check Migrate SID History in the Permissions list. Click Next.
Review the settings, and click Finish.
