Windows 2000 adprep /domainprep error

Were running adprep on our Windows 2000 domain controller, so we can add a 2003 domain controller into a child domain.  

adprep /forestprep ran with no problems, everything completed successfully.

adprep /domainprep produced the following error:

This is the error returned at the command prompt:
Adprep was unable to modify some attributes on object DC=XXX(editedout) ,DC=LOCAL.

[User Action]

Check the log file Adprep.log in the system root System32\Debug\Adprep\Logs directory for more information.

Adprep encountered an LDAP error.

Error code: 0x32. Server extended error code: 0x2098, Server error message: 00002098: SecErr: DSID-03150646, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

Adprep was unable to update domain-wide information.


Adprep requires access to existing domain-wide information from the infrastructure master in order to complete this operation.

[User Action]

Check the log file, Adprep.log, in the C:\WINNT\system32\debug\adprep\logs\20041023155507 directory for more information.

I've verified that the administrator account is a member of domain admins, schema admins, and enterprise admins.  I'm not sure where the insuffcient rights part of that is coming from.

Anyone have any ideas why forestprep ran fine, but domain prep errored out?


Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

is this account a member of the Enterprise Admins Universal group?
rsoxhaterAuthor Commented:
Whats the difference?  We currently only have one domain that I'm trying to create a child one off of - I'm on the Primary DC and administrator is located in the enteprise admin group - is there another group I'm missing somewhere?
I had very similar errors. Open schema snap-in and make sure that updates enabled on this domain controller.
Maybe you will have to reboot after this.
Cloud Class® Course: Certified Penetration Testing

This CPTE Certified Penetration Testing Engineer course covers everything you need to know about becoming a Certified Penetration Testing Engineer. Career Path: Professional roles include Ethical Hackers, Security Consultants, System Administrators, and Chief Security Officers.

is the server schema that you are trying to upgrade is main server itself ? where infrastructure master is located ? or is it on another server ?

try to move the infrastructure master to the server where you want to perform the adprep
I agree with all the above points, you need to ensure that you're logging on with an account that has membership of:
Schema Admins and Enterprise Admins groups for adprep /forestprep, and domain admins for adprep /domainprep. You need to run these against the correct servers, and you need to ensure that the schema is set to allow updates.
If you are running exchange 2000 in your domain then you must also take note and act on the following prior to doing anything else:

What do I need to do to make sure Exchange 2000 runs fine on my Windows Server 2003 forest?
Windows Server 2003 adprep /forestprep Command Causes Mangled Attributes in Windows 2000 Forests That Contain Exchange 2000 Servers

What do I need to do to prepare my Windows 2000 forest for the installation of the first Windows Server 2003 DC?

How To Find Servers That Hold Flexible Single Master Operations Roles;en-us;234790

Registry Modification Required to Allow Write Operations to Schema;EN-US;216060

Deb :))

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
rsoxhaterAuthor Commented:
When you bring up active directory snap in you have at the top of the tree domainname.local - I right clicked on it, brought up properties and security and saw that there was no admins in the security setting. I added the domain admin account and gave it full control. Domain prep ran perfect after that.

Thanks for the help and pointing me in the right direction guys.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 2000

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.