[7508]E23893: Cannot resolve the path WinNT://S-1-5-21-xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxx. This account (NETIQKB17776)

fact
Domain Migration Administrator 7.x

symptom
[7508]E23893: Cannot resolve the path WinNT://S-1-5-21-xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxx. This account will not be updated in the group membership. rc = -2147463155. The ADSI property cannot be found in the property cache.

cause

When groups are migrated, Domain Migration Administrator (DMA)  processes and updates the group membership.  The groups were known to contain members from domains other than the source domain.  The SID represents a group member that cannot be resolved.  This can be caused if the SID is in a domain that is no longer trusted or does not exist.

fix

Re-establish a trust with the correct domain that corresponds to the missing account. If the account is one that has been deleted, ignore the missing account.

note
For more information on how to resolve a sid to an account, or determine which domain a sid belongs to, please consult the Microsoft knowledge base.

Formerly known as NETIQKB17776