• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 866
  • Last Modified:

Windows 2000 adprep /domainprep error

Were running adprep on our Windows 2000 domain controller, so we can add a 2003 domain controller into a child domain.  

adprep /forestprep ran with no problems, everything completed successfully.

adprep /domainprep produced the following error:

This is the error returned at the command prompt:
Adprep was unable to modify some attributes on object DC=XXX(editedout) ,DC=LOCAL.

[User Action]

Check the log file Adprep.log in the system root System32\Debug\Adprep\Logs directory for more information.

Adprep encountered an LDAP error.

Error code: 0x32. Server extended error code: 0x2098, Server error message: 00002098: SecErr: DSID-03150646, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

Adprep was unable to update domain-wide information.


Adprep requires access to existing domain-wide information from the infrastructure master in order to complete this operation.

[User Action]

Check the log file, Adprep.log, in the C:\WINNT\system32\debug\adprep\logs\20041023155507 directory for more information.

I've verified that the administrator account is a member of domain admins, schema admins, and enterprise admins.  I'm not sure where the insuffcient rights part of that is coming from.

Anyone have any ideas why forestprep ran fine, but domain prep errored out?


1 Solution
is this account a member of the Enterprise Admins Universal group?
rsoxhaterAuthor Commented:
Whats the difference?  We currently only have one domain that I'm trying to create a child one off of - I'm on the Primary DC and administrator is located in the enteprise admin group - is there another group I'm missing somewhere?
I had very similar errors. Open schema snap-in and make sure that updates enabled on this domain controller.
Maybe you will have to reboot after this.
Learn to develop an Android App

Want to increase your earning potential in 2018? Pad your resume with app building experience. Learn how with this hands-on course.

is the server schema that you are trying to upgrade is main server itself ? where infrastructure master is located ? or is it on another server ?

try to move the infrastructure master to the server where you want to perform the adprep
I agree with all the above points, you need to ensure that you're logging on with an account that has membership of:
Schema Admins and Enterprise Admins groups for adprep /forestprep, and domain admins for adprep /domainprep. You need to run these against the correct servers, and you need to ensure that the schema is set to allow updates.
If you are running exchange 2000 in your domain then you must also take note and act on the following prior to doing anything else:

What do I need to do to make sure Exchange 2000 runs fine on my Windows Server 2003 forest?
Windows Server 2003 adprep /forestprep Command Causes Mangled Attributes in Windows 2000 Forests That Contain Exchange 2000 Servers

What do I need to do to prepare my Windows 2000 forest for the installation of the first Windows Server 2003 DC?

How To Find Servers That Hold Flexible Single Master Operations Roles

Registry Modification Required to Allow Write Operations to Schema

Deb :))
rsoxhaterAuthor Commented:
When you bring up active directory snap in you have at the top of the tree domainname.local - I right clicked on it, brought up properties and security and saw that there was no admins in the security setting. I added the domain admin account and gave it full control. Domain prep ran perfect after that.

Thanks for the help and pointing me in the right direction guys.

Featured Post

Take Control of Web Hosting For Your Clients

As a web developer or IT admin, successfully managing multiple client accounts can be challenging. In this webinar we will look at the tools provided by Media Temple and Plesk to make managing your clients’ hosting easier.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now