erm, I meant seize infrastructure master role from another DC (not just a box) :)
Main Topics
Browse All TopicsHello Dear Experts,
I am currently in the process of promoting a new Windows Server 2008 into my Windows server 2003 Forest. The ADPREP /forestprep ran just fine, without errors.
Now, when trying with the /domainprep /gpprep switches, I have this following error :
"D:\sources\adprep>adprep.
Running domainprep ...
Domain-wide information has already been updated.
[Status/Consequence]
Adprep did not attempt to rerun this operation.
Adprep was unable to complete because the call back function failed.
[Status/Consequence]
Error message: (null)
[User Action]
Check the log file ADPrep.log, in the C:\WINDOWS\debug\adprep\lo
7 directory for more information."
I looked at "'http://technet.microsoft
I also looked at a post here "http://www.experts-exchan
One thing I must mention; I recently had to restore the policies on this server using a backup (due to some 1030/1058 errors), but not ALL the policies I had on the backup needed to be restored ( I stopped restoring when my server gave me the event 1704 "Security policy in the Group policy objects has been applied successfully").
Here the most recent ADPREP log :
Adprep created the log file ADPrep.log under C:\WINDOWS\debug\adprep\lo
Adprep copied file D:\sources\adprep\schema.i
Adprep copied file D:\sources\adprep\schupgra
Adprep copied file D:\sources\adprep\PAS.ldf from installation point to local machine under directory C:\WINDOWS\system32.
Adprep successfully made the LDAP connection to the local Active Directory Domain Controller FS1.
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is (null).
LDAP API ldap_search_s() finished, return code is 0x0
Adprep successfully retrieved information from the local Active Directory Domain Services.
Adprep successfully initialized global variables.[Status/Conseque
Domain-wide information has already been updated.[Status/Consequenc
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=a3dac986-80e7-4e59-a059
LDAP API ldap_search_s() finished, return code is 0x20
Adprep verified the state of operation cn=a3dac986-80e7-4e59-a059
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=446f24ea-cfd5-4c52-8346
LDAP API ldap_search_s() finished, return code is 0x0
Adprep checked to verify whether operation cn=446f24ea-cfd5-4c52-8346
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=51cba88b-99cf-4e16-bef2
LDAP API ldap_search_s() finished, return code is 0x0
Adprep checked to verify whether operation cn=51cba88b-99cf-4e16-bef2
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=a3dac986-80e7-4e59-a059
LDAP API ldap_search_s() finished, return code is 0x20
Adprep verified the state of operation cn=a3dac986-80e7-4e59-a059
Adprep was unable to complete because the call back function failed. [Status/Consequence]Error message: (null)[User Action] Check the log file ADPrep.log, in the C:\WINDOWS\debug\adprep\lo
Adprep was unable to update domain information. [Status/Consequence]Adprep
I recently experienced other problems, seeing this post might give you clues for what is happenening now : http://www.experts-exchang
Now Im all lost regarding next actions to take....
Thanks in advance
Eric
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
seems like the server you are running ADprep on can't find the infrastructure master role..
"Adprep requires access to existing domain-wide information from the infrastructure master in order to complete this operation."
go to command prompt and run netdom query fsmo
see what server has the infrastructure master role. Make sure you can ping that server.. Make sure dns on the server you are running adprep from is pointing to a domain controller for DNS.
If this doesn't fix the issue run DCdiag from a command prompt and try to resolve any issues that it reports..
Hi and thanks for your quick reply,
I am working on the only available D.C on the network atm, it has all the roles since I had to seize em few weeks ago due to previous master D.C failure.
I ran a DcDiag. NetDiag, queried FSMO and even ipconfig /all, I could not find any error ! Here are the results (on 2 posts) :
FSMO HOLDER
----------------
C:\>netdom query fsmo
Schema owner FS1.domain.local
Domain role owner FS1.domain.local
PDC role FS1.domain.local
RID pool manager FS1.domain.local
Infrastructure owner FS1.domain.local
The command completed successfully.
--------------------------
NETDIAG
--------------------------
C:\Program Files\Support Tools>netdiag
..........................
Computer Name: FS1
DNS Host Name: FS1.domain.local
System info : Microsoft Windows Server 2003 (Build 3790)
Processor : x86 Family 6 Model 15 Stepping 11, GenuineIntel
List of installed hotfixes :
KB923561
KB924667-v2
KB925398_WMP64
KB925902
KB926122
KB927891
KB929123
KB930178
KB931784
KB931836
KB932168
KB933729
KB933854
.... etc etc
Netcard queries test . . . . . . . : Passed
Per interface results:
Adapter : Local Area Connection 2
Netcard queries test . . . : Passed
Host Name. . . . . . . . . : FS1
IP Address . . . . . . . . : 192.168.0.250
Subnet Mask. . . . . . . . : 255.255.255.0
Default Gateway. . . . . . : 192.168.0.1
Dns Servers. . . . . . . . : 192.168.0.250
192.168.0.254
AutoConfiguration results. . . . . . : Passed
Default gateway test . . . : Passed
NetBT name test. . . . . . : Passed
WINS service test. . . . . : Skipped
There are no WINS servers configured for this interface.
Global results:
Domain membership test . . . . . . : Passed
NetBT transports test. . . . . . . : Passed
List of NetBt transports currently configured:
NetBT_Tcpip_{D3796B1F-84D7
1 NetBt transport currently configured.
Autonet address test . . . . . . . : Passed
IP loopback ping test. . . . . . . : Passed
Default gateway test . . . . . . . : Passed
NetBT name test. . . . . . . . . . : Passed
Winsock test . . . . . . . . . . . : Passed
DNS test . . . . . . . . . . . . . : Passed
PASS - All the DNS entries for DC are registered on DNS server '192.168.0.250'.
PASS - All the DNS entries for DC are registered on DNS server '192.168.0.254'.
Redir and Browser test . . . . . . : Passed
List of NetBt transports currently bound to the Redir
NetBT_Tcpip_{D3796B1F-84D7
The redir is bound to 1 NetBt transport.
List of NetBt transports currently bound to the browser
NetBT_Tcpip_{D3796B1F-84D7
The browser is bound to 1 NetBt transport.
DC discovery test. . . . . . . . . : Passed
DC list test . . . . . . . . . . . : Passed
Trust relationship test. . . . . . : Skipped
Kerberos test. . . . . . . . . . . : Passed
LDAP test. . . . . . . . . . . . . : Passed
Bindings test. . . . . . . . . . . : Passed
WAN configuration test . . . . . . : Skipped
No active remote access connections.
Modem diagnostics test . . . . . . : Passed
IP Security test . . . . . . . . . : Skipped
Note: run "netsh ipsec dynamic show /?" for more detailed information
The command completed successfully
--------------------------
IPCONFIG
--------------------------
Windows IP Configuration
Host Name . . . . . . . . . . . . : FS1
Primary Dns Suffix . . . . . . . : domain.local
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : domain.local
Ethernet adapter Local Area Connection 2:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : HP NC373i Multifunction Gigabit Server Ad
apter #2
Physical Address. . . . . . . . . : 00-xx-xx-xx-xx-xx
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.250
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 192.168.0.250
192.168.0.254
--------------------------
** DCDIAG will be on next post **
Are both of these DCs functioning currently as DCs?
192.168.0.250
192.168.0.254
If the aren't then remove the IP address of the DNS server that isn't functioning currently run ipconfig /flushdns, ipconfig /registerdns, and dcdiag /fix.
Also, if you had a failed DC you need to run metadata cleanup to remove lingering objects in AD.
http://www.petri.co.il/del
DCDIAG
-------------------------
Domain Controller Diagnosis
Performing initial setup:
* Verifying that the local machine FS1, is a DC.
* Connecting to directory service on server FS1.
* Collecting site info.
* Identifying all servers.
* Identifying all NC cross-refs.
* Found 1 DC(s). Testing 1 of them.
Done gathering initial info.
Doing initial required tests
Testing server: Default-First-Site-Name\FS
Starting test: Connectivity
* Active Directory LDAP Services Check
* Active Directory RPC Services Check
......................... FS1 passed test Connectivity
Doing primary tests
Testing server: Default-First-Site-Name\FS
Starting test: Replications
* Replications Check
* Replication Latency Check
DC=ForestDnsZones,DC=domai
Latency information for 1 entries in the vector were ignored.
1 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency information (Win2K DC).
DC=DomainDnsZones,DC=domai
Latency information for 1 entries in the vector were ignored.
1 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency information (Win2K DC).
CN=Schema,CN=Configuration
Latency information for 1 entries in the vector were ignored.
1 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency information (Win2K DC).
CN=Configuration,DC=domain
Latency information for 1 entries in the vector were ignored.
1 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency information (Win2K DC).
DC=domain,DC=local
Latency information for 1 entries in the vector were ignored.
1 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency information (Win2K DC).
......................... FS1 passed test Replications
Test omitted by user request: Topology
Test omitted by user request: CutoffServers
Starting test: NCSecDesc
* Security Permissions check for all NC's on DC FS1.
* Security Permissions Check for
DC=ForestDnsZones,DC=domai
(NDNC,Version 2)
* Security Permissions Check for
DC=DomainDnsZones,DC=domai
(NDNC,Version 2)
* Security Permissions Check for
CN=Schema,CN=Configuration
(Schema,Version 2)
* Security Permissions Check for
CN=Configuration,DC=domain
(Configuration,Version 2)
* Security Permissions Check for
DC=domain,DC=local
(Domain,Version 2)
......................... FS1 passed test NCSecDesc
Starting test: NetLogons
* Network Logons Privileges Check
Verified share \\FS1\netlogon
Verified share \\FS1\sysvol
......................... FS1 passed test NetLogons
Starting test: Advertising
The DC FS1 is advertising itself as a DC and having a DS.
The DC FS1 is advertising as an LDAP server
The DC FS1 is advertising as having a writeable directory
The DC FS1 is advertising as a Key Distribution Center
The DC FS1 is advertising as a time server
The DS FS1 is advertising as a GC.
......................... FS1 passed test Advertising
Starting test: KnowsOfRoleHolders
Role Schema Owner = CN=NTDS Settings,CN=FS1,CN=Servers
Role Domain Owner = CN=NTDS Settings,CN=FS1,CN=Servers
Role PDC Owner = CN=NTDS Settings,CN=FS1,CN=Servers
Role Rid Owner = CN=NTDS Settings,CN=FS1,CN=Servers
Role Infrastructure Update Owner = CN=NTDS Settings,CN=FS1,CN=Servers
......................... FS1 passed test KnowsOfRoleHolders
Starting test: RidManager
* Available RID Pool for the Domain is 4107 to 1073741823
* FS1.domain.local is the RID Master
* DsBind with RID Master was successful
* rIDAllocationPool is 3107 to 3606
* rIDPreviousAllocationPool is 3107 to 3606
* rIDNextRID: 3112
......................... FS1 passed test RidManager
Starting test: MachineAccount
Checking machine account for DC FS1 on DC FS1.
* SPN found :LDAP/FS1.domain.local/dom
* SPN found :LDAP/FS1.domain.local
* SPN found :LDAP/FS1
* SPN found :LDAP/FS1.domain.local/dom
* SPN found :LDAP/20f9efb7-be68-4e89-a
* SPN found :E3514235-4B06-11D1-AB04-0
* SPN found :HOST/FS1.domain.local/dom
* SPN found :HOST/FS1.domain.local
* SPN found :HOST/FS1
* SPN found :HOST/FS1.domain.local/dom
* SPN found :GC/FS1.domain.local/domai
......................... FS1 passed test MachineAccount
Starting test: Services
* Checking Service: Dnscache
* Checking Service: NtFrs
* Checking Service: IsmServ
* Checking Service: kdc
* Checking Service: SamSs
* Checking Service: LanmanServer
* Checking Service: LanmanWorkstation
* Checking Service: RpcSs
* Checking Service: w32time
* Checking Service: NETLOGON
......................... FS1 passed test Services
Test omitted by user request: OutboundSecureChannels
Starting test: ObjectsReplicated
FS1 is in domain DC=domain,DC=local
Checking for CN=FS1,OU=Domain Controllers,DC=domain,DC=l
Object is up-to-date on all servers.
Checking for CN=NTDS Settings,CN=FS1,CN=Servers
Object is up-to-date on all servers.
......................... FS1 passed test ObjectsReplicated
Starting test: frssysvol
* The File Replication Service SYSVOL ready test
File Replication Service's SYSVOL is ready
......................... FS1 passed test frssysvol
Starting test: frsevent
* The File Replication Service Event log test
......................... FS1 passed test frsevent
Starting test: kccevent
* The KCC Event log test
Found no KCC errors in Directory Service Event log in the last 15 minutes.
......................... FS1 passed test kccevent
Starting test: systemlog
* The System Event log test
Found no errors in System Event log in the last 60 minutes.
......................... FS1 passed test systemlog
Test omitted by user request: VerifyReplicas
Starting test: VerifyReferences
The system object reference (serverReference) CN=FS1,OU=Domain Controllers,DC=domain,DC=l
The system object reference (frsComputerReferenceBL) CN=FS1,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=domai
The system object reference (serverReferenceBL) CN=FS1,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=domai
......................... FS1 passed test VerifyReferences
Test omitted by user request: VerifyEnterpriseReferences
Test omitted by user request: CheckSecurityError
Running partition tests on : ForestDnsZones
Starting test: CrossRefValidation
......................... ForestDnsZones passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom
Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom
Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom
Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom
Running partition tests on : domain
Starting test: CrossRefValidation
......................... domain passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... domain passed test CheckSDRefDom
Running enterprise tests on : domain.local
Starting test: Intersite
Skipping site Default-First-Site-Name, this site is outside the scope provided by the command line arguments provided.
......................... domain.local passed test Intersite
Starting test: FsmoCheck
GC Name: \\FS1.domain.local
Locator Flags: 0xe00003fd
PDC Name: \\FS1.domain.local
Locator Flags: 0xe00003fd
Time Server Name: \\FS1.domain.local
Locator Flags: 0xe00003fd
Preferred Time Server Name: \\FS1.domain.local
Locator Flags: 0xe00003fd
KDC Name: \\FS1.domain.local
Locator Flags: 0xe00003fd
.....domain.............. domain.local passed test FsmoCheck
Test omitted by user request: DNS
Test omitted by user request: DNS
--------------------------
So I am probably tired but I dont see a hint here that could help me resolv this issue... Worst thing is, I prepared myself by creating virtual labs (3 times!!) first and was successful in all my atempts. Only difference was that I did not have an anti-virus on the virtual servers.
Thanks again for your time and help
Regards
Hi DariusQ,
Quoting:
"Are both of these DCs functioning currently as DCs?
192.168.0.250
192.168.0.254"
Only the .250 is a D.C atm, I was in the process of promoting the .254; I installed binaries on the 2008, then went on the 2003 to run /forestprep, which ran fine, but no the /domainprep /gpprep.
Couple of minutes before attempting the promote, I installed the DNS service on the new server and reboot both of em. Both event viewers were showing ok and replication/transfer was made without problems.
"If you had a failed DC then you need to run a metadata cleanup. Have you done this? How about the DNS servers?"
The failed D.C was cleaned out (A.D, DNS, FRS metadata cleanup) last week as on this post "http://www.experts-exchan
Remove the DNS server that currently isn't a DC then run domainprep since gpprep isn't needed. Make sure you are logged on as a Enterprise Admin that is part of the Domain Admin group.
http://www.experts-exchang
Hi again dariusq and thanks for taking the time to help me,
I pasted here the last lines of my FIRST "Adprep /domainprep /gpprep" log here, maybe it can explain your previous statement (id 25455327), but I honestly dont know what it means exactly ;s Please take a look at my comments "<------comment" :
"Adprep invoked the call back function UpgradeDSGPOs.
[Status/Consequence]
The call back function finished successfully. <-----------------Are you talking about this statement ??
Adprep was about to call the following LDAP API. ldap_add_s(). The entry to add is cn=51cba88b-99cf-4e16-bef2
LDAP API ldap_add_s() finished, return code is 0x0
Adprep successfully created the Active Directory Domain Services object cn=51cba88b-99cf-4e16-bef2
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=a3dac986-80e7-4e59-a059
LDAP API ldap_search_s() finished, return code is 0x20 <----------------- Here's were it failed I think
Adprep verified the state of operation cn=a3dac986-80e7-4e59-a059
[Status/Consequence]
The operation has not run or is not currently running. It will be run next.
Adprep was unable to complete because the call back function failed.
[Status/Consequence]
Error message: (null) <-------------- Ever encountered this one ??
[User Action]
Check the log file ADPrep.log, in the C:\WINDOWS\debug\adprep\lo
Adprep was unable to update domain information.
[Status/Consequence]
Adprep requires access to existing domain-wide information from the infrastructure master in order to complete this operation. <----------I am running everything from the only D.C we have that is FSMO role holder.
[User Action]
Check the log file, ADPrep.log, in the C:\WINDOWS\debug\adprep\lo
-------------------------
As I stated, my adprep /forestprep was just fine. So I really dont know whats causing this error; should I just ignore it and try to run dcpromo on the new server ? or should I reboot and retry the /domainprep /gpprep ?
Regards
Sorry, in the hurry, |I skipped your comment ID:25455302, stating that /gpprep is not needed. So if I understand correctly my case, the /domainprep I did succeeded exception made of the /gpprep ? Does that mean I could keep going on with the dcpromo and disregard this error ?
As for the DNS installed on the server 2008, it was a nice suggestion from ChiefIT on my post http://www.experts-exchang
Thanks again for your patience !!
Yes, gpprep is not needed.SInce you have udated adprep /forestprep it updated everything as you have single forest & single forest covered yoyr domain too.
Even you can notice from your log
"D:\sources\adprep>adprep.e
Running domainprep ...
Domain-wide information has already been updated.
[Status/Consequence]
So,the command is completed & you can go ahead with configuring new dc.
Succeeded !
The new windows server 2008 is now acting as a backup D.C and DNS. I could complete the dcpromo without problems !
I only had some minor errors at first but upon rebooting, the DNS/A.D were successfully replicated.
Thanks a LOT again ALL for your time and help, I will award the points to Dariusq and Awinish (for the last minute comment that helped me)
Case closed and Bless you all !
Eric
Business Accounts
Answer for Membership
by: CynepMeHPosted on 2009-09-29 at 17:40:15ID: 25454743
As per log details, confirm your "infrastructure master" FSMO holder server is accessible. If it is not, find out why and bring it online. If you can't, seize infrastructure master role from another box and try running it again. Also try running DCDiag and NetDIAG.