When you want to do a scripted migration of Active Directory Objects between different forests keeping the object’s SID history, a commandline tool is available from within the Active Directory Migration Tool (ADMT). This article describes the caveats that exist when you want to install ADMT and the required SQL Server 2008 SP1 on your domain controller.
First off, When you want to do scripted migrations using the ADMT commandline and you need to do SID migrations, ADMT needs to be installed on an domain controller in the target domain. ADMT can be installed on a member server in the target domain, but you won’t be able to use the commandline tool in combination with a SID History migration when you don’t install it on a domain controller. You will receive the following error when you try to do this:
ERR:7615 SID History cannot be updated for username. You must be an administrator in the source domain.
ERR:7392 SIDHistory could not be updated due to a configuration or permissions problem. The Active Directory Migration Tool will not attempt to migrate the remaining objects.