Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


Windows 2000 adprep /domainprep error

Posted on 2004-10-23
Medium Priority
Last Modified: 2007-12-19
Were running adprep on our Windows 2000 domain controller, so we can add a 2003 domain controller into a child domain.  

adprep /forestprep ran with no problems, everything completed successfully.

adprep /domainprep produced the following error:

This is the error returned at the command prompt:
Adprep was unable to modify some attributes on object DC=XXX(editedout) ,DC=LOCAL.

[User Action]

Check the log file Adprep.log in the system root System32\Debug\Adprep\Logs directory for more information.

Adprep encountered an LDAP error.

Error code: 0x32. Server extended error code: 0x2098, Server error message: 00002098: SecErr: DSID-03150646, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

Adprep was unable to update domain-wide information.


Adprep requires access to existing domain-wide information from the infrastructure master in order to complete this operation.

[User Action]

Check the log file, Adprep.log, in the C:\WINNT\system32\debug\adprep\logs\20041023155507 directory for more information.

I've verified that the administrator account is a member of domain admins, schema admins, and enterprise admins.  I'm not sure where the insuffcient rights part of that is coming from.

Anyone have any ideas why forestprep ran fine, but domain prep errored out?


Question by:rsoxhater
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 10

Expert Comment

ID: 12390289
is this account a member of the Enterprise Admins Universal group?

Author Comment

ID: 12390531
Whats the difference?  We currently only have one domain that I'm trying to create a child one off of - I'm on the Primary DC and administrator is located in the enteprise admin group - is there another group I'm missing somewhere?

Expert Comment

ID: 12390685
I had very similar errors. Open schema snap-in and make sure that updates enabled on this domain controller.
Maybe you will have to reboot after this.
Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.


Expert Comment

ID: 12391597
is the server schema that you are trying to upgrade is main server itself ? where infrastructure master is located ? or is it on another server ?

try to move the infrastructure master to the server where you want to perform the adprep
LVL 20

Accepted Solution

Debsyl99 earned 2000 total points
ID: 12393945
I agree with all the above points, you need to ensure that you're logging on with an account that has membership of:
Schema Admins and Enterprise Admins groups for adprep /forestprep, and domain admins for adprep /domainprep. You need to run these against the correct servers, and you need to ensure that the schema is set to allow updates.
If you are running exchange 2000 in your domain then you must also take note and act on the following prior to doing anything else:

What do I need to do to make sure Exchange 2000 runs fine on my Windows Server 2003 forest?
Windows Server 2003 adprep /forestprep Command Causes Mangled Attributes in Windows 2000 Forests That Contain Exchange 2000 Servers

What do I need to do to prepare my Windows 2000 forest for the installation of the first Windows Server 2003 DC?

How To Find Servers That Hold Flexible Single Master Operations Roles

Registry Modification Required to Allow Write Operations to Schema

Deb :))

Author Comment

ID: 12395838
When you bring up active directory snap in you have at the top of the tree domainname.local - I right clicked on it, brought up properties and security and saw that there was no admins in the security setting. I added the domain admin account and gave it full control. Domain prep ran perfect after that.

Thanks for the help and pointing me in the right direction guys.

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Let's take a look into the basics of ransomware—how it spreads, how it can hurt us, and why a disaster recovery plan is important.
Video by: ITPro.TV
In this episode Don builds upon the troubleshooting techniques by demonstrating how to properly monitor a vSphere deployment to detect problems before they occur. He begins the show using tools found within the vSphere suite as ends the show demonst…
In this video you will find out how to export Office 365 mailboxes using the built in eDiscovery tool. Bear in mind that although this method might be useful in some cases, using PST files as Office 365 backup is troublesome in a long run (more on t…

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question