During the migration an error smilar to the following is found in the dsa.log:
Error 0xe1000051. Cannot compare password hashes, source user: "testuser", target user: "testuser" Error 0x80070005. Cannot install AePAgent. Cannot start service. Access is denied. (source=AePwd.PwdInstEx.
Errors only appears when DSA is pointed to a domain controller where the LSA Protection is on.
Install Quest Migration Manager 8.14 and update 20180619 or later, then follow the documentation to enable pre-installed agent mode. Note that pre-installed agent mode has to be configured on both source and target DCs even if LSA protection is only enabled on one side.
Another option is to deactivate the LSA Protection on the domain controller used by DSA or point it to another DC where protection is off.