Windows 2000 Active Directory permissions problem

Every dcdiag test passed. Netdiag only gives me 1 warning which I can't find much information about... The outputs from each test are below - further assistance would be super fantastic.

//DCDIAG
DC Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial non skippeable tests

   Testing server: Default-First-Site-Name\EVE
      Starting test: Connectivity
         ......................... EVE passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\EVE
      Starting test: Replications
         ......................... EVE passed test Replications
      Starting test: NCSecDesc
         ......................... EVE passed test NCSecDesc
      Starting test: NetLogons
         ......................... EVE passed test NetLogons
      Starting test: Advertising
         ......................... EVE passed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... EVE passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... EVE passed test RidManager
      Starting test: MachineAccount
         ......................... EVE passed test MachineAccount
      Starting test: Services
         ......................... EVE passed test Services
      Starting test: ObjectsReplicated
         ......................... EVE passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... EVE passed test frssysvol
      Starting test: kccevent
         ......................... EVE passed test kccevent
      Starting test: systemlog
         ......................... EVE passed test systemlog

   Running enterprise tests on : mcstudios.com
      Starting test: Intersite
         ......................... mcstudios.com passed test Intersite
      Starting test: FsmoCheck
         ......................... mcstudios.com passed test FsmoCheck

//NETDIAG

.........................................

    Computer Name: EVE
    DNS Host Name: eve.mcstudios.com
    System info : Windows 2000 Server (Build 2195)
    Processor : x86 Family 6 Model 8 Stepping 3, GenuineIntel
    List of installed hotfixes :
        KB820888
        KB822831
        KB823182
        KB823559
        KB823980
        KB824105
        KB824141
        KB824146
        KB824151
        KB825119
        KB826232
        KB828028
        KB828035
        KB828741
        KB828749
        KB830352
        KB832359
        KB834707-IE6SP1-20040929.091901
        KB835732
        KB837001
        KB839643
        KB839645
        KB840315
        KB840987
        KB841356
        KB841533
        KB841872
        KB841873
        KB842526
        KB842773
        KB867282-IE6SP1-20050127.163319
        KB870763
        KB871250
        KB873333
        KB873339
        KB883935
        KB885250
        KB885834
        KB885835
        KB885836
        KB888113
        KB889293-IE6SP1-20041111.235619
        KB890047
        KB890175
        KB890859
        KB890923-IE6SP1-20050225.103456
        KB891711
        KB891781
        KB893066
        KB893086
        KB893803
        KB894320
        Q147222
        Q828026


Netcard queries test . . . . . . . : Passed



Per interface results:

    Adapter : {51EA14E3-1767-44C7-A237-107A4565E3C2}

        Netcard queries test . . . : Passed

        Host Name. . . . . . . . . : eve
        IP Address . . . . . . . . : 192.168.110.10
        Subnet Mask. . . . . . . . : 255.255.255.0
        Default Gateway. . . . . . : 192.168.110.2
        Primary WINS Server. . . . : 192.168.110.11
        Dns Servers. . . . . . . . : 192.168.110.10
                                     192.168.110.11
                                     192.168.110.13


        AutoConfiguration results. . . . . . : Passed

        Default gateway test . . . : Passed

        NetBT name test. . . . . . : Passed
        [WARNING] At least one of the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names is missing.

        WINS service test. . . . . : Passed

    Adapter : IPX Internal Interface

        Netcard queries test . . . : Passed

        Ipx configration
            Network Number . . . . : d87820fd
            Node . . . . . . . . . : 000000000001
            Frame type . . . . . . : Ethernet II



    Adapter : IpxLoopbackAdapter

        Netcard queries test . . . : Passed

        Ipx configration
            Network Number . . . . : d87820fd
            Node . . . . . . . . . : 000000000002
            Frame type . . . . . . : 802.2



    Adapter : NDISWANIPX

        Netcard queries test . . . : Passed

        Ipx configration
            Network Number . . . . : 00000000
            Node . . . . . . . . . : 840c20524153
            Frame type . . . . . . : Ethernet II




Global results:


Domain membership test . . . . . . : Passed


NetBT transports test. . . . . . . : Passed
    List of NetBt transports currently configured:
        NetBT_Tcpip_{51EA14E3-1767-44C7-A237-107A4565E3C2}
    1 NetBt transport currently configured.


Autonet address test . . . . . . . : Passed


IP loopback ping test. . . . . . . : Passed


Default gateway test . . . . . . . : Passed


NetBT name test. . . . . . . . . . : Passed
    [WARNING] You don't have a single interface with the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names defined.


Winsock test . . . . . . . . . . . : Passed


DNS test . . . . . . . . . . . . . : Passed
    PASS - All the DNS entries for DC are registered on DNS server '192.168.110.10' and other DCs also have some of the names registered.
    PASS - All the DNS entries for DC are registered on DNS server '192.168.110.11' and other DCs also have some of the names registered.
    PASS - All the DNS entries for DC are registered on DNS server '192.168.110.13' and other DCs also have some of the names registered.


Redir and Browser test . . . . . . : Passed
    List of NetBt transports currently bound to the Redir
        NetBT_Tcpip_{51EA14E3-1767-44C7-A237-107A4565E3C2}
    The redir is bound to 1 NetBt transport.

    List of NetBt transports currently bound to the browser
        NetBT_Tcpip_{51EA14E3-1767-44C7-A237-107A4565E3C2}
    The browser is bound to 1 NetBt transport.


DC discovery test. . . . . . . . . : Passed


DC list test . . . . . . . . . . . : Passed


Trust relationship test. . . . . . : Skipped


Kerberos test. . . . . . . . . . . : Passed


LDAP test. . . . . . . . . . . . . : Passed


Bindings test. . . . . . . . . . . : Passed


WAN configuration test . . . . . . : Skipped
    No active remote access connections.


Modem diagnostics test . . . . . . : Passed


Netware configuration
    You are not logged in to your preferred server .
    Netware User Name. . . . . . . :
    Netware Server Name. . . . . . :
    Netware Tree Name. . . . . . . :
    Netware Workstation Context. . :

IP Security test . . . . . . . . . : Passed
    IPSec policy service is active, but no policy is assigned.


The command completed successfully

Try this out:

Check out Schema Permissions:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/c93eb971-63e9-45da-aaa8-e18653e02fa2.mspx

And make sure your not just allowed View. You should be allowed the write/modify permission also ... You would in theory check this out by accessing the advanced permissions tab ....

You would then have a detailed list of the permissions you are allowed.

It would be something like what is exaplained here:
http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/prdd_sec_letd.asp?frame=true

For example, you could have "allowed" checked, but when going through the advanced permissions tab, you could only have enabled the READ. The write could be disabled ... which doesn't mean denied.

Thats what I would check out first ...

I am guessing this could be the cause, becuase I really do not have much experience on modifying the schema.

Installing AD Schema Snap-in which I guess you already did .. but just in case ... :
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/8c76ff67-9e9d-4fc7-bfac-ffedee8a04d4.mspx

UICE: I tried checking these properties from both DCs. Unfortunately, this doesn't seem to be the problem. Everything looks as it should (full control, read/write all, etc are all granted/allowed).

However, I tried using the schema snap-in on a Win2003 machine in my domain that is not a DC. I don't get the "You can only view..." message, and I can edit permissions which are then reflected on both DCs...

What could possibly be going on?

"Everything looks as it should (full control, read/write all, etc are all granted/allowed)."

Could you be a bit more specific.... as in who is allowed Full control ... etc ...
And please post all users/groups which are allowed permissions, and if possible the level of permissions they have ...

As for  "I don't get the "You can only view..." message, and I can edit permissions which are then reflected on both DCs..." ...

I really don't know where your going there .. what do you mean?

check the domain controllers OU permissions in AD Users & Computers

Logon as a different user, must be a member of Exchange Schema Admins, and Enterprise Admins, you might have restricted security rights somewhere along the chain, so logging in as a Schema Admin will not any any real restrcitions and therefore the installation of Exchange 2003 will now proceed.

UICE: Perhaps I misspoke last night... Looking at it again this morning, I see this:
--Permissions for Schema
---Administrators -> All Allow/Deny boxes greyed out, no checkmarks
---Authenticated Users -> All Allow/Deny boxes greyed out, no checkmarks
---Enterprise Admins -> All Allow/Deny boxes greyed out, no checkmarks
---ENTERPRISE DOMAIN CONTROLLERS -> All Allow/Deny boxes greyed out, no checkmarks
---Schema Admins -> All Allow/Deny boxes greyed out, no checkmarks
---SYSTEM
----Advanced
-----Allow | Administrators (DOMAIN\Administrators) | Full Control | This object and all child objects
-----Allow | Authenticated Users | Full Control | This object and all child objects
-----Allow | Enterprise Admins (DOMAIN\Enterprise Administrators) | Full Control | This object only
-----Allow | ENTERPRISE DOMAIN CONTROLLERS | Full Control | This object only
-----Allow | Schema Admins (DOMAIN\Schema Admins) | Full Control | This object and all child objects
-----Allow | SYSTEM | Full Control | This object and all child objects
----Owner
-----Schema Admins (MCSTUDIOS\Schema Admins)

What I meant about the other server is that I can open the schema snap-in and view/change all the permissions. The above "Permissions for Schema" Allow/Deny checkboxes are NOT greyed out on the Win2003 system when it's connected to the actual schema master.

SeanUK777: I made a separate account to test what you've mentioned. Said account is a member of Schema, Enterprise and Domain Admins. I got the same results, even if I tried with an account that belongs only to the schema/enterprise admins groups.

Update:

It would appear that I can view/edit schema permissions from any machine *except* the DCs. This, however, doesn't have any effect on whether exchange can be installed.

Should I just start over? I really appreciate everyone's comments, it's just I don't understand what's going on at all...

And this ....

"---SYSTEM
----Advanced
-----Allow | Administrators (DOMAIN\Administrators) | Full Control | This object and all child objects
-----Allow | Authenticated Users | Full Control | This object and all child objects
-----Allow | Enterprise Admins (DOMAIN\Enterprise Administrators) | Full Control | This object only
-----Allow | ENTERPRISE DOMAIN CONTROLLERS | Full Control | This object only
-----Allow | Schema Admins (DOMAIN\Schema Admins) | Full Control | This object and all child objects
-----Allow | SYSTEM | Full Control | This object and all child objects
----Owner
-----Schema Admins (MCSTUDIOS\Schema Admins)"

I don't understand any of that ... could you be a bit more clear twords who is what?

I would be specially interested in this: Schema Admins (MCSTUDIOS\Schema Admins)