Windows 2000 adprep /domainprep error

Posted on 2004-10-23
Last Modified: 2007-12-19
Were running adprep on our Windows 2000 domain controller, so we can add a 2003 domain controller into a child domain.  

adprep /forestprep ran with no problems, everything completed successfully.

adprep /domainprep produced the following error:

This is the error returned at the command prompt:
Adprep was unable to modify some attributes on object DC=XXX(editedout) ,DC=LOCAL.

[User Action]

Check the log file Adprep.log in the system root System32\Debug\Adprep\Logs directory for more information.

Adprep encountered an LDAP error.

Error code: 0x32. Server extended error code: 0x2098, Server error message: 00002098: SecErr: DSID-03150646, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

Adprep was unable to update domain-wide information.


Adprep requires access to existing domain-wide information from the infrastructure master in order to complete this operation.

[User Action]

Check the log file, Adprep.log, in the C:\WINNT\system32\debug\adprep\logs\20041023155507 directory for more information.

I've verified that the administrator account is a member of domain admins, schema admins, and enterprise admins.  I'm not sure where the insuffcient rights part of that is coming from.

Anyone have any ideas why forestprep ran fine, but domain prep errored out?


Question by:rsoxhater
    LVL 10

    Expert Comment

    is this account a member of the Enterprise Admins Universal group?

    Author Comment

    Whats the difference?  We currently only have one domain that I'm trying to create a child one off of - I'm on the Primary DC and administrator is located in the enteprise admin group - is there another group I'm missing somewhere?
    LVL 3

    Expert Comment

    I had very similar errors. Open schema snap-in and make sure that updates enabled on this domain controller.
    Maybe you will have to reboot after this.
    LVL 4

    Expert Comment

    is the server schema that you are trying to upgrade is main server itself ? where infrastructure master is located ? or is it on another server ?

    try to move the infrastructure master to the server where you want to perform the adprep
    LVL 20

    Accepted Solution

    I agree with all the above points, you need to ensure that you're logging on with an account that has membership of:
    Schema Admins and Enterprise Admins groups for adprep /forestprep, and domain admins for adprep /domainprep. You need to run these against the correct servers, and you need to ensure that the schema is set to allow updates.
    If you are running exchange 2000 in your domain then you must also take note and act on the following prior to doing anything else:

    What do I need to do to make sure Exchange 2000 runs fine on my Windows Server 2003 forest?
    Windows Server 2003 adprep /forestprep Command Causes Mangled Attributes in Windows 2000 Forests That Contain Exchange 2000 Servers

    What do I need to do to prepare my Windows 2000 forest for the installation of the first Windows Server 2003 DC?

    How To Find Servers That Hold Flexible Single Master Operations Roles;en-us;234790

    Registry Modification Required to Allow Write Operations to Schema;EN-US;216060

    Deb :))

    Author Comment

    When you bring up active directory snap in you have at the top of the tree domainname.local - I right clicked on it, brought up properties and security and saw that there was no admins in the security setting. I added the domain admin account and gave it full control. Domain prep ran perfect after that.

    Thanks for the help and pointing me in the right direction guys.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
    Microservice architecture adoption brings many advantages, but can add intricacy. Selecting the right orchestration tool is most important for business specific needs.
    This video Micro Tutorial is the first in a two-part series that shows how to create and use custom scanning profiles in Nuance's PaperPort 14.5 ( But the ability to create custom scanning profiles al…
    This Experts Exchange video Micro Tutorial shows how to tell Microsoft Office that a word is NOT spelled correctly. Microsoft Office has a built-in, main dictionary that is shared by Office apps, including Excel, Outlook, PowerPoint, and Word. When …

    884 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    22 Experts available now in Live!

    Get 1:1 Help Now