I know this error is infuriating — you're mid-migration, the ADMT window is open, and Windows throws ERROR_DS_EPOCH_MISMATCH (0x00002123) at you with zero useful context. Let's fix it.
The message reads: "The source and destination of a cross-domain move do not agree on the object's epoch number." That's a mouthful. Translation: the DC you're moving the object from and the DC you're moving it to have different replication state for that object. They disagree on which version is current.
The actual fix
You need to force the two DCs to agree before the move will succeed. Do these in order and stop when it works.
1. Identify which DCs are involved
Grab the source-domain PDC Emulator and the target-domain PDC Emulator (or whichever DCs the move is binding to). In most environments the move-user cmdlet talks to the PDC of each domain by default.
netdom query fsmo
Write down both DC names. Then, from a workstation with RSAT, confirm replication health between the source and target DCs — including the inter-site transport — with:
repadmin /replsummary
repadmin /showrepl <SourceDC>
repadmin /showrepl <TargetDC>
If you see any failures, quorum issues, or "last success" timestamps older than your tombstone lifetime, that's your root cause. Fix replication before anything else.
2. Check the object's epoch metadata on both sides
Use repadmin /showobjmeta to see what each DC thinks of the object's version:
repadmin /showobjmeta <SourceDC> "CN=Jane Doe,OU=Users,DC=corp,DC=local"
repadmin /showobjmeta <TargetDC> "CN=Jane Doe,OU=Users,DC=corp,DC=local"
Look at the version and originating change USN for the key attributes — particularly objectSid, sAMAccountName, userAccountControl. If the numbers diverge, that's the epoch mismatch.
3. Force replication of the partition
From the target DC, kick off a manual replication of the partition that holds the object. Most moves are within the same forest (cross-domain, not cross-forest), so it's a partition of your domain naming context.
repadmin /replicate <TargetDC> <SourceDC> DC=corp,DC=local
repadmin /syncall /AeD
Give it a minute. Then run repadmin /showobjmeta again. If the version numbers now match, retry the move.
4. Retry the move — and bind it to the PDC Emulator
If you're using the ActiveDirectory PowerShell module:
Move-ADObject -Identity "CN=Jane Doe,OU=Users,DC=corp,DC=local" `
-TargetPath "OU=Users,DC=contoso,DC=com" `
-Server <TargetDomainPDC>
Explicitly pointing at the target PDC removes the ambiguity that triggered the mismatch in the first place. If you're using ADMT, set the target DC under the "Migrate Objects" wizard's advanced options to the same explicit DC.
5. If it still fails, reset the epoch with an authoritative restore of the object
This is the last resort and only for stubborn cases where the object was restored from a backup on one DC and never replicated cleanly. You'll need to perform an authoritative restore of just that object from the DC you trust:
ntdsutil
activate instance ntds
ifm
create sysvol full c:\ifm
authoritative restore
restore subtree "OU=Users,DC=corp,DC=local"
quit
quit
Do this on the DC whose version you trust — usually the one that hasn't been restored recently. Then force replication and retry the move.
Why this works
Active Directory uses an epoch number (internally, a combination of the object's objectSid and its originating USN at creation) to detect stale writes. When you move an object across domains, the source DC and target DC must agree which version is authoritative. If replication hasn't caught up — or worse, if a restore on one side rewrote the object's metadata — the target DC sees a version it can't reconcile and rejects the move.
Forcing replication updates the USNs and version numbers so both DCs see the same object state. Binding the move to the PDC Emulator then removes the race condition: you're talking to the one DC in each domain that always has the freshest, most authoritative copy. The error stops because the precondition that triggered it — divergent epochs — no longer exists.
Less common variations
Cross-forest moves (ADMT + PES)
Same error code, different beast. Cross-forest moves involve the Password Export Server (PES), and the epoch mismatch often comes from the PES agent running on a DC that isn't the PDC Emulator. Move PES to the PDC Emulator of the source forest and retry.
Moves after a forest recovery
If you've recently done a forest recovery and are now moving objects, the downtime in replication during recovery can leave objects with epoch metadata that doesn't align. Run repadmin /showutdvec to verify all DCs share a common up-to-dateness vector before attempting any moves.
Groups with many members
Large groups (10k+ members) sometimes trip this because the member attribute replicates in linked-value replication and the version numbers lag. Wait for a full replication cycle (two, to be safe), then retry. Don't try to force it — you'll just get the error again.
Read-only domain controllers
If your target DC is an RODC, epoch mismatches happen more often because the RODC caches credentials and metadata. Point the move directly at a writable DC in the target domain, not the RODC.
Prevention
- Always check replication health before a migration window. Run
repadmin /replsummarythe day before. A two-minute check saves hours of pain. - Never do cross-domain moves right after a restore. Give replication at least one full cycle to settle.
- Pin your moves to the PDC Emulator. Both ADMT and PowerShell accept an explicit target DC. Use it.
- Monitor your tombstone lifetime. Objects older than that are gone and no amount of replication will fix them — the move will fail every time.
- Don't move objects during peak replication hours. Scheduled replication windows can create the exact lag that triggers this error.
Fix the replication first, then retry the move with an explicit DC target. Nine times out of ten, that's the whole job.