-
Title
During a migration the Users are created successfully but the Groups fail to be created in the same OU with the Users. -
Description
During a migration, the Users are created successfully but the Groups fail to be created in the same OU with the Users. The Migration Session Log contains a "Failed Object" for each group that failed to be created and the error:
"LDAP error 0x32. Insufficient Rights (00000005: SecErr: DSID-03151E04, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0). "
The DSA log contains the following errors:
"Object was not created due to error"
"LDAP error 0x32. Insufficient Rights (00000005: SecErr: DSID-03151E04, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0)." -
Cause
When the properties for the OU was checked, the "Permissions Entry for Users" for "Everyone" had an explicit deny set for "Create Group Objects" and "Delete Group Objects" for the OU. -
Resolution
As the intent of the migration is to have the Users and Groups together in one OU, change the Active Directory permissions for "Everyone" on the OU and clear the deny set on "Create Group Objects" and "Delete Group Objects".
An alternation would be to create the groups in another OU which allows the creation of Groups.