Return
-
Title
Moving a Computer During an Intra-forest Migration Fails with Error 0x574. The target account name is incorrect. -
Description
When performing an intra-forest move of a computer object you get an error in the move log. The target account name is correct, but still not joining the domain.
After looking at the netsetup.log file from the workstation the following error is found.
10/10/2017 20:32:53:687 NetpMapGetLdapExtendedError: Parsed [0x21c7] from server extended error string: 000021C7: AtrErr: DSID-03200BDF, #1:0: 000021C7: DSID-03200BDF, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 90303 (servicePrincipalName)10/10/2017 20:32:53:687 NetpModifyComputerObjectInDs: ldap_modify_s failed: 0x13 0x21c710/10/2017 20:32:53:687 NetpCreateComputerObjectInDs: NetpModifyComputerObjectInDs failed: 0x21c710/10/2017 20:32:53:687 NetpDisplayDupeSPNJoinError: Duplicate SPN found in the forest. -
Cause
This is common behavior for Windows Active Directory. Duplicate SPN's can't exists in the same forest. In Windows Server 2012 R2, Microsoft introduced SPN uniqueness checks/blocks to ensure applications or administrators aren't able to create objects in AD with the same SPN as another object.
-
Resolution
Workarounds:
- Disjoin the workstation from the domain and remove the SPN from AD before rejoining the workstation.
- Follow the steps in this blog from Microsoft which outlines this behavior in more detail. https://blogs.technet.microsoft.com/askpfeplat/2015/07/27/third-party-active-directory-migration-tools-and-kb-3070083/