Error: 'Failed to change domain affiliation [hr=8007003a].... specified server cannot perform the re (NETIQKB34789)

  • 7734789
  • 02-Feb-2007
  • 07-Dec-2007


Domain Migration Administrator 7.x

Error: 'Failed to change domain affiliation [hr=8007003a].... specified server cannot perform the requested operation'.

When I migrated a computer I got an error that the computer cannot be added to the domain.

The computer cannot locate the appropriate DNS record to join the new domain.


When a Windows 2000 or later computer joins a new Windows 2000 or later domain, it queries DNS for a _LDAP._TCP.dc._msdcs.domainname DNS record. If DMA is having trouble changing domain affiliation for a computer, use the following nslookup commands on the the computer you want to migrate to ensure it can resolve DNS queries to the target domain.

To use nslookup to verify DNS resolution:

  1. At a Windows command prompt, enter the following command:

    The nslookup command begins a session displaying the > prompt, and returns the following type of information where is the fully qualified domain name of the DNS server for the domain, and is the IP address of the DNS server:

    Default Server:
  2. Enter the following commands to set the query type to SVR (service location resource records):

    > set q=srv
  3. Enter the following command to locate the LDAP record for the domain name:

  4. Enter the following command where   is the fully qualified domain name returned from the query in Step 3.

  5. Review the output of the previous domain name query and determine if further action is needed depending on the success of the query:

    If the query succeeds: Review the SRV resource records to determine if all domain controllers for your Active Directory domain are included and registered with valid IP addresses.

    If the query fails:  Continue troubleshooting dynamic update or DNS server-related issues to determine the exact cause of the problem and to ensure the target domain controller has the appropriate DNS lookup information available.


The nslookup command-line administrative tool helps you test and troubleshoot DNS servers. The nslookup command-line tool offers the ability to perform query testing of DNS servers and obtain detailed responses as the command output. This information is useful in troubleshooting name resolution problems, verifying that resource records are added or updated correctly in a zone, and debugging other server-related problems.


For more information about troubleshooting DNS resolution problems, see the following Microsoft Knowledge Base or TechNet articles:

Additional Information

Formerly known as NETIQKB34789