I don't usually stick my nose into Work Item Tracking issues because its not my area.  However, this issue is the cause of so much confusion that it reflects poorly on the whole TFS to TFS migration tool.  When you are running a Work Item Tracking (WIT) migration with the TFS to TFS migration tool, Administrator level permissions are not enough. You need to be a member of the Service Accounts group.

 

Only members of the Service  Accounts group are allowed to bypass the rules check for the WIT web services.  The WIT migration session uses this ability to do things like attribute changes to people who are no longer valid users (left the company).  Even a TFS server Admin cannot bypass those rules, and the Migration tool always makes the web service call with the bypass flag set (does not attempt to determine when its needed).  If the user running the migration isn't a member of the Service Accounts group the WIT migration will crash and be unable to continue. 

The Service Accounts group is such a special group that permissions cannot be set though the UI.  You need to use the command line  TFSecurity.exe from the install location.

TFSSecurity.exe /g+ "Service Accounts" "domain\userName" /server:http://serverName:8080