Is it a local account or is it a domain account? If a domain account is the domain available? Does "vfiler run vfilername useradmin user list" and "vfiler run vfilername domainuser list -g administrators" match on the source vfiler and the target dr vfiler? It might be that the group is there but not able to resolve. The vfiler entry should match exactly for the users, but if not then that sounds like a possible bug and should have support check to make sure.