The migration.log contains an error when trying to translate security for Exchange mailboxes. (NETIQKB28723)

fact
Domain Migration Administrator 7.x

symptom
The migration.log contains an error when trying to translate security for Exchange mailboxes.

symptom
Error: 'Failed to bind to Exchange server.'

symptom
Error: '[7502]E21665: Failed to bind to Exchange server SERVERNAME using credentials cn=userid,cn=domainname, rc=58.  The specified server cannot perform the requested operation.'

cause
You must be able to bind to the LDAP directory for the reACLing process to complete.  You may not be able to bind to the directory if the Exchange server already has a process bound to that port.  

For example, Microsoft RDP (Remote Desktop Protocol) uses port 3389. This is the terminal services client, which is configured, by default, on a computer running Windows XP.  If Domain Migration Administrator (DMA) is installed on a computer running Windows XP, this may be causing a conflict with DMA.  Or, if Exchange 5.5 is installed on an Active Directory Domain Controller, then the port must be changed from Port 389, as Port 389 is reserved for Active Directory.

fix
Below are some typical resolutions to LDAP issues when binding to Exchange 5.5:

1. Install Microsoft Exchange 5.5 Administrator on the Domain Migration Administrator (DMA) console.
2. Install the same Exchange service pack as the Exchange server you are connecting to.
3. Enable the LDAP protocol on the Exchange server.
4. Verify that the port used by the LDAP protocol on the Exchange 5.5 server is unique to LDAP and is not being used by any other application.
5. Change the LDAP port number on the Exchange server.

note

You can use the Active Directory Administration Tool (Ldp.exe) from the Windows Support Tools to test the port and protocol connection described above.

1. Open the Active Directory Administration Tool (Ldp.exe).
2. Select Connection.
3. Select Connect.
4. Enter the servername and LDAP port number of your Exchange server.

1. Leave the Connectionless box clear.
5. Click OK.
6. Select Connection.
7. Select Bind.
8. Enter your administrative account credentials.

1. These should be the same credentials you are logged in with when trying to run DMA.
9. Click OK.

1. This is where you may see an error on the right pane.
10. Select View.
11. Select Tree.
12. Leave the BaseDN blank.
13. Click OK.
14. Browse to one of the objects you are trying to translate.

Formerly known as NETIQKB28723