Resolution
Why do I have to make the account a local administrator on every member server and workstation in the source domain?
fact
Domain Migration Administrator 6.x
fact
Domain Migration Administrator 7.x
fix
Some migration tasks such as migrating computers and translating security require Domain Migration Administrator (DMA) to install an agent on the source computer. When performing a task that installs an agent on a remote computer, the account that you are logged in with ,to the DMA console machine, must be an administrator on the remote computer. There are different ways of making the account an administrator. If you are using an account from the target domain, you must add that account to the local administrators group on every member server and workstation. Alternately, you can use an account defined in the source domain, that is a member of the Domain Admins global group in the source domain, which is automatically a member of local administrators group on every member server and workstation.
Looking at the migration in a simplified way, there are two basic categories of objects to be migrated: Users and groups, and computers. Generally, the best practice is to use an account defined in the target domain when migrating users and groups, and use an account defined in the source domain when migrating computers.
For a review of the best practice for migrating computers, refer to the following knowledge base article:
https://www.netiq.com/kb/esupport/consumer/esupport.asp?id=NETIQKB1434
Please refer to Chapter 2 of the DMA/SC User Guide, under the section of "Establishing Migration Credentials", for further discussion on the selection of accounts to use for the migration.