Migration Manager cannot process accounts that fall outside of the scope of the Domain Pair Synchronization or Migration.
Determine the attribute which causes the account to fall out of scope of the DSA LDAP query.
Steps:
1. Locate the LDAP query in the DSA.log. It should look similar to:
Search filter: (&(|(&(objectClass=computer)(objectCategory=computer))(&(objectClass=user)(objectCategory=user))(&(objectClass=contact)(objectCategory=contact))(&(objectClass=organizationalUnit)(objectCategory=organizationalUnit))(&(objectClass=inetOrgPerson)(objectCategory=inetOrgPerson))(&(objectClass=container)(objectCategory=container))(&(objectClass=printQueue)(objectCategory=printQueue))(&(objectClass=group)(objectCategory=group))(&(objectClass=volume)(objectCategory=volume)))(!(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2)))(!(&(objectClass=user)(&(accountExpires>=1)(accountExpires<=130772448000000000))))(!(&(|(objectClass=user)(objectClass=group)(objectClass=computer))(isCriticalSystemObject=TRUE)))(!(useraccountcontrol:1.2.840.113556.1.4.803:=2048))(|(objectClass=container)(objectClass=organizationalUnit)(!(showInAdvancedViewOnly=TRUE)))(|(&(objectGUID=\186p\86\3Fb\01G\97\0A\D3rD\60\A9p))))
2. Export the account using LDIFDE. (See SOL15721)
See SOL27644 for resolution of the showInAdvancedViewOnly attribute
In one case, the user accountExpires attribute fell into the range that the LDAP query skipped:
(!(&(objectClass=user)(&(accountExpires>=1)(accountExpires<=130772448000000000))))
