-
Title
Cutover fails Result code: 32768 Domain join failed with error: 1332 -
Description
ReACL is successful. However, cutover job fails with the following error:Result code: 32768Domain join failed with error: 1332In the logs you might see:- Cannot validate argument on parameter 'ComputerName'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again.
- The server can be joined manually to the target domain without any issues using the same credentials we use in On Demand Migration (ODM).
-
Cause
POSSIBLE CAUSE 1"Cannot validate argument on parameter 'ComputerName'. The argument is null or empty.”
This error is indicating that the Target OU you are trying to create computer objects in cannot be validated. This can happen if:- OU path is incorrect or was renamed.
- Your profile’s credentials are incorrect.
POSSIBLE CAUSE 2The network profile wants the DNS suffixes
(more likely when investigating 'possible cause 1' the below was discovered)- Validated the target OU as well as tried using the default Computers OU (CN=Computers,DC=A,DC=Corp,DC=Com) but the same error.
- Profile credentials are validated and there is no error there.
- Not using Credential Cache profile
- Validated the Network profile and DNS settings both on current NIC and in the profile, are set to use static IPs.
POSSIBLE CAUSE 3Migration Profile configuration issue where the 'Join to Existing Computer Account' is not correctly configured based on where the device exists or not in the target.
The 'Join to Existing Computer Account' setting is for one specific scenario:- Select Yes if you expect to join the Device to the existing target Computer during Cutover. Select No if you want the Device to be created in the target by the Cutover job.
POSSIBLE CAUSE 4
As explained as this for the error code from Microsoft document; Too many local user identifiers (LUIDs) were requested at one time.
1332 (0x534)
No mapping between account names and security IDs was done.
ERROR_TOO_MANY_LUIDS_REQUESTED
POSSIBLE CAUSE 5
Security tools prevent the execution of PPKG or the execution required from the tools.
-
Resolution
RESOLUTION FOR POSSIBLE CAUSE 1
- Validate that the OU path is correct and has the correct name. Confirm the Dirsync workflow is setting the Device OU correcting and device is still in scope and has not been moved to an OU which is outside the scope of Dirsync.
- Validate that the target IP is set in the credential cache profile If yes, confirm you can open Windows Power Shell from the AD Pro server and execute the following:
Test-Connection -<ComputerName>
Note: for *ComputerName * plug in the IP address of the Target DC as you have defined within Credential cache profile.- Evaluate your network profile configuration. You want to ensure your network profile configuration under ADM settings > Network Profiles does align with your network adapter of the device.
- For example, in the past, we have seen this error when within the network profile "obtain DNS server via DHCP” is set to true, however the network adapter on the device is set to use Static IPs instead.
RESOLUTION FOR POSSIBLE CAUSE 2- Modify the network profile by adding the required DNS suffixes manually:
RESOLUTION FOR POSSIBLE CAUSE 3- Create multiple Migration profiles, one for Join to Existing Computer Account is set to Yes and another profile set to No.
- Set each profile to the devices which fit each specific scenario where they either exist or do not exist in the target.
Possible RESOLUTION FOR POSSIBLE CAUSE 4Get more clarification from Microsoft for better confirmation and insight of the error code.Where this could be resolution to the target domain is not reachable due to network of security firewall blockage.RESOLUTION FOR POSSIBLE CAUSE 5Please add the following paths to the exclusion list in your security tools:
C:\Program Files (x86)\Quest\On Demand Migration Directory Sync Agent\C:\temp\xxxx.ppkg(this is your ppkg file path).
If the security tools have advanced features that block the execution of
.ppkg,.exe, or.ps1files, make sure to disable or exclude these as well. As part of the troubleshooting process, you may need to temporarily disable or remove the security tools from the device to confirm if they are causing the issue. If disabling the security tools resolves the problem, please contact the security tool vendors to identify the exact cause of the prevention.
