After migrating user account, it is created disabled on the target and the following errors are reported after the session ends:
"Error 0xe1000051. Cannot compare password hashes, source user: "Test5", target user: "Test5"
Error 0x80070005. Cannot install AePAgent. Cannot identify CPU type. Access is denied. (source=AePwd.PwdInstEx.1)."
This is because of insufficient privileges in the source or target domain. For more details about the required permissions please see QMM Quick Start Guide.
When specifying credentials to be used by the Directory Synchronization Agent to connect to the source and target domains on the domain pair properties the requirements are:
1. Account specified for the source domain must have at least Read access to active directory in order to be able to migrate all the attributes. If passwords need to be migrated as well AEPAgent will be installed on the source domain controller to retrieve password hash. In this case Administrator access will be required. Account specified under domain pair properties needs to be added to local built in Administrators group explicitly.
2. Account specified for the target domain must have Administrator access on the target in order to be able to create objects and change attributes.
In the above case errors are caused by insufficient rights in source or in target domain when trying to migrate passwords; because of that target account is created as disabled.
