I am pulling my hair out over this one.
I am trying to add a 2003 server to a 2000 domain.
adprep /forestprep ran with no errors
adprep /domainprep runs with the following error:
Adprep created the log file ADPrep.log under C:\WINNT\system32\debug\ad
Adprep copied file d:\i386\schema.ini from installation point to local machine under directory C:\WINNT.
Adprep successfully made the LDAP connection to the local domain controller TESTSERVER.
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is (null).
LDAP API ldap_search_s() finished, return code is 0x0
Adprep successfully retrieved information from the local directory service.
Adprep successfully initialized global variables.
[Status/Consequence]
Adprep is continuing.
Adprep was about to call the following LDAP API. ldap_add_s(). The entry to add is cn=DomainUpdates,cn=System
LDAP API ldap_add_s() finished, return code is 0x44
Adprep attempted to create the directory service object cn=DomainUpdates,cn=System
[Status/Consequence]
The object exists so Adprep did not attempt to rerun this operation but is continuing.
Adprep was about to call the following LDAP API. ldap_add_s(). The entry to add is cn=Operations,cn=DomainUpd
LDAP API ldap_add_s() finished, return code is 0x44
Adprep attempted to create the directory service object cn=Operations,cn=DomainUpd
[Status/Consequence]
The object exists so Adprep did not attempt to rerun this operation but is continuing.
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=ab402345-d3c3-455d-9ff7
LDAP API ldap_search_s() finished, return code is 0x0
Adprep checked to verify whether operation cn=ab402345-d3c3-455d-9ff7
[Status/Consequence]
The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing.
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=bab5f54d-06c8-48de-9b87
LDAP API ldap_search_s() finished, return code is 0x0
Adprep checked to verify whether operation cn=bab5f54d-06c8-48de-9b87
[Status/Consequence]
The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing.
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=f3dd09dd-25e8-4f9c-85df
LDAP API ldap_search_s() finished, return code is 0x0
Adprep checked to verify whether operation cn=f3dd09dd-25e8-4f9c-85df
[Status/Consequence]
The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing.
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=2416c60a-fe15-4d7a-a61e
LDAP API ldap_search_s() finished, return code is 0x0
Adprep checked to verify whether operation cn=2416c60a-fe15-4d7a-a61e
[Status/Consequence]
The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing.
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=7868d4c8-ac41-4e05-b401
LDAP API ldap_search_s() finished, return code is 0x0
Adprep checked to verify whether operation cn=7868d4c8-ac41-4e05-b401
[Status/Consequence]
The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing.
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=860c36ed-5241-4c62-a18b
LDAP API ldap_search_s() finished, return code is 0x0
Adprep checked to verify whether operation cn=860c36ed-5241-4c62-a18b
[Status/Consequence]
The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing.
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=0e660ea3-8a5e-4495-9ad7
LDAP API ldap_search_s() finished, return code is 0x0
Adprep checked to verify whether operation cn=0e660ea3-8a5e-4495-9ad7
[Status/Consequence]
The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing.
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=a86fe12a-0f62-4e2a-b271
LDAP API ldap_search_s() finished, return code is 0x0
Adprep checked to verify whether operation cn=a86fe12a-0f62-4e2a-b271
[Status/Consequence]
The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing.
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=d85c0bfd-094f-4cad-a2b5
LDAP API ldap_search_s() finished, return code is 0x0
Adprep checked to verify whether operation cn=d85c0bfd-094f-4cad-a2b5
[Status/Consequence]
The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing.
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=6ada9ff7-c9df-45c1-908e
LDAP API ldap_search_s() finished, return code is 0x20
Adprep verified the state of operation cn=6ada9ff7-c9df-45c1-908e
[Status/Consequence]
The operation has not run or is not currently running. It will be run next.
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=User,CN={31B2F340-016D-
LDAP API ldap_search_s() finished, return code is 0x0
This is my setup:
w2k server is only dc in the domain and has exchange 2000
ran inetorgpersonfix script (after forestprep)
ran adprep /forestprep - no errors
ran adprep /domainprep - error is above
checked all system policy permissions: domain admins, enterpriseadmins, administrators have full control over AD policies etc.
checked registry: schema update is set to 1
sysvol is set to c:\winnt\sysvol\sysvol
I just cannot get the brand new 2003 server to run dcpromo without it telling me I have to run adprep /domainprep.
Any help would be much appreciated.
Thanks for your time
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I read that article also, this is my problem, the GUID identified doesn't exisit in the policies container. I can't find it anywhere.
5)Locate the GUID identified in the last entry of the Adprep log file.
6) Right-click the entry and select Properties, then Security.
7) Change the permissions on this GUID to allow Full Control to the Denied groups. This might involve taking Ownership to accomplish.
Thanks again for your help.
The only thing I can see out of the ordinary is the following line:
===============
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=6ada9ff7-c9df-45c1-908e
LDAP API ldap_search_s() finished, return code is 0x20
===============
All of the other ldap_seach() queries returned 0x0. Have you checked for this GUID? It's a long shot and I'm assuming that 0x0 means it exists and can continue whereas 0x20 seems ot indicate success, but it's the only thing I can see out of the ordinary.
Well, I say I don't know where to look, not completely right: That GUID is not located in the container CN=system, CN=operations,CN= (various containers with varying GUID's none of which are the GUID that errors out in the log.)
Is there somewhere else to look?
I don't see it in adsiedit either.
Thanks for the quick responses on this.
That should be the only place to look System -> Domain Updates -> Operations -> the GUID.
Hmmm. Not sure on this one. If 0x20 successfully created the GUId, you'd expect to see it there. If it didn't, you'd expect to see it there. Are the right permission on System -> Domain Updates -> Operations (ie. Domain Admins, Admins etc. etc)?
It isn't listed anywhere under operations. My permissions under operations and all the GUID containers to the right are FULL CONTROL for Administrators,Domain Admins, Enterprise Admins (allow inheritable permissions is also checked.) I'm logged in as administrator (who is a member in each of the afforementioned groups including schema admins.)
I am at a loss on this one. The only other article I could find that might help is:
http://www.microsoft.com/r
Partiularly the part on the schema master. You've probably followed this though.
No, I didn't have the snap-in registered. I just reloaded the schema. No luck.
The other posts I have seen on this topic seem to include a GUID that is the same as mine. They all solved their problems by fixing errors with dcdiag and / or changing permissions.
I just don't get why the adprep log lists a GUID that I can't find anywhere in active directory.
Thanks for the help.
Wow...I'm famous!
That's my Technet article.
On the main DC you can also use ADUC to look at each and every GPO you created in the Domain. On the Security tab of the GPO itself you must have Enterprise Admins, Domain Admins and SYSTEM with minimum Read/Write permissions - it's best to give full control.
The reason this part of ADPREP fails is because one or more of the above security principals has been removed or denied access to one or more Group Policy objects that have been created. This almost always occurs because an Admin doesn't want a policy to apply to them so they remove access to their group by either denying access or removing the ACE from the policy.
Let me know if you need more help.
Hey Netman66 I'm back. Its been a while but I'm still working on this problem. I ended up installing 2000 on the box and mad AD play nice
with the existing DC. Now everything is great, but I still really need to upgrade to 2003 on the one server.
Is there a way for me to manually create the GUID container the adprep /domainprep is looking for to solve my problem?
Clarification:
Adprep verified the state of operation cn=6ada9ff7-c9df-45c1-908e
[Status/Consequence]
The operation has not run or is not currently running. It will be run next.
If I were to try to create the 6ada9ff7... cn manually (if that is even possible) would it solve my problem.
Thanks again
Not likely - it's pretty specific and getting it right would be very lucky.
You need to find that GUID on one of the SYSVOLs - it's very likely a policy - if it doesn't exist, then remove it from the System>Policies section of ADUC in advanced mode.
You should be able to run /domainprep now.
Looking more closely, I don't think that's where it's failing - at that GUID. I think that GUID is just the state of the AD that adprep uses to determine where it's at in the process. There is very likely another GUID which represents a policy that doesn't have the correct access for EA, DA or Administrators that is stopping it from finishing. Did you look at your GPOs yet?
Business Accounts
Answer for Membership
by: blueivyPosted on 2004-10-21 at 07:35:46ID: 12370407
See here:
http://support.microsoft.c