When installing the Password Export Server on a Server 2008 Domain Controller in the destination forest, the following error was encountered entering the password for the .pes file security key that was generated in the source forest:
The supplied password does not match this encryption key’s password. ADMT’s Password Migration Filter DLL will not install without a valid encryption key.
The error that was being generated “the password does not match this encryption key” is bogus, as the password did match. This error was actually being generated by a permission problem to the SAM database caused by UAC (user account control).
To get around this run a command prompt as administrator and launch pwdmig.msi from there. Ensure the command prompt is running as administrator!