Thanks for the input. The KB you mention 2034074 is basically the same as the one I'm using http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2042849. Difference being 2034074 explains in a little more detail what's occurring whereas 2042849 is just the steps to follow.
To get around the MASTER password issue I backed up my vCenter and Updatemgr DB's, built a new VM, installed SQL, restored DB's and installed a clean SSO and the vCenter installer upgraded my vCenter and UpdateMgr DB's. Have to keep those as I'm running a vDS. Prod is running SSO in Multisite and vCenter will be linked. Prod is good for now. Getting ready to do the same process for DR. I've exported the PROD SSO and as soon as I install SSO at DR I will import the PROD SSO to DR. When DR is completly built out I will export that SSO and import it to the PROD SSO. Best I can tell from the KB's that's the process to follow. I will keep screen shots of both SSO users before and after each export and import.
It feels like the import/export/ and import process is over writing data verses merging information? Since each SSO config is it's own LDAP and provides no backup for each other how does SSO deferengiate between users at each location? In other words how is admin@system-domain and admin2@system-domain different from each other at each location since the domain names are the same?