Errors: "Error 0xe1000040. Per attribute apply failed for object", "Error 0xe1000041" and "LDAP error 0x35" (4351651)

Errors received when migrating groups:

"Error 0xe1000040. Per attribute apply failed for object"
"Error 0xe1000041. Apply of attribute member with value(s) = <SID=0105000000000005150000002ad0375cdbeb0c5016c0ea3248070000> failed."
"LDAP error 0x35. Unwilling To Perform (00002141: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0)."
-------------
Synchronization fails for some objects and DSA log contains entries:

object was not modified due to error
Error 0xe1000040. Per attribute apply failed for object <GUID=F9464858A64E894DB343E571D406CC64>
Error 0xe1000041. Apply of attribute member with value(s) = <SID=010500000000000515000000D931F84254FA555143170A321B1F0100> failed.
LDAP error 0x35. Unwilling To Perform (00002141: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0).

Target DC is Windows 2003 Server with SP1.
The group and the user account are in different domains. The domain controller to which the DSA is connected to in the group's domain, is not a global catalog server.

In most cases the issue can be resolved when applying the Microsoft hotfix on involved DC's and on the console machine where QMM is installed (if the OS is Windows 2003 Server with SP1 with no recent security updates) , for more details please review the Microsoft KB Article ID: 906381 - "A security principal disappears from the Authorization Manager store of a Windows Server 2003-based trusted child domain after you close and then reopen Authorization Manager":

http://support.microsoft.com/?id=906381

NOTE: The MS article wording may seem as though it doesn't relate to the issue; however, it has been confirmed to resolve many migration related issues because migration tools try to add new users to a user group by using their object GUID.

Please follow the instructions from the part "Steps to reproduce the behavior" and if you can reproduce the behaviour contact Microsoft and request the hotfix.

Alternatively another target domain controller can be specified as preferred DC, a domain controller with Windows 2003 which has no SP1 installed.

https://support.quest.com/SUPPORT/index?page=solution&id=SOL30514

https://support.quest.com/SUPPORT/index?page=solution&id=SOL30629 

If the above hotfix is no longer available on the Microsoft Knowledge Base site, you can request it directly from Microsoft by visiting the Hotfix Request Web Submission Form - https://support.microsoft.com/contactus2/emailcontact.aspx?scid=sw;en;1410&WS=hotfix

**Note**

This Microsoft hot fix is not compatible with Windows 2003 SP2 nor certain Windows 2003 SP1 security updates.  In these cases QMM must be upgraded to version 8.0 or later, and the following QMM 8.0 hot fix applied:

https://support.quest.com/SUPPORT/index?page=solution&id=SOL35438

This hot fix changes the method in which group membership is added.