[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 350
  • Last Modified:

Windows 2000 Active Directory permissions problem

I recently posted over in the Exchange 2003 Area and a member there suggested that my problem sounds more like a permissions issue. The prior post contains netdiag and dcdiag results, linked below - so I'll just post a brief recap here.

http://www.experts-exchange.com/Networking/Email_Groupware/Exchange_Server/Q_21420862.html

I have a Windows 2000 domain with two DCs. In addition, I have one Windows 2003 machine which only acts as a backup for DNS - if that makes a difference. My account is a member of all the necessary groups (domain/enterprise/schema admins).

I've been trying to install Exchange Server 2003, and I always get the same error at the forestprep stage saying "I do not have permission to modify the schema or the AD service is too busy." In addition, the MMC schema snap-in says I can only view security settings for the schema...

I've never done anything that involved going this deep into AD, but I need to get this working. Any help will be greatly appreciated!
0
CharlesWalton
Asked:
CharlesWalton
  • 4
  • 4
  • 2
  • +2
2 Solutions
 
theruckCommented:
to install exchange you have to be enterprise admin as you will make changes to the AD schema. therefore the schema master has to be available. i would start at running dcdiag and netdiag to see if your AD is ok.
0
 
CharlesWaltonAuthor Commented:
Every dcdiag test passed. Netdiag only gives me 1 warning which I can't find much information about... The outputs from each test are below - further assistance would be super fantastic.

//DCDIAG
DC Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial non skippeable tests

   Testing server: Default-First-Site-Name\EVE
      Starting test: Connectivity
         ......................... EVE passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\EVE
      Starting test: Replications
         ......................... EVE passed test Replications
      Starting test: NCSecDesc
         ......................... EVE passed test NCSecDesc
      Starting test: NetLogons
         ......................... EVE passed test NetLogons
      Starting test: Advertising
         ......................... EVE passed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... EVE passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... EVE passed test RidManager
      Starting test: MachineAccount
         ......................... EVE passed test MachineAccount
      Starting test: Services
         ......................... EVE passed test Services
      Starting test: ObjectsReplicated
         ......................... EVE passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... EVE passed test frssysvol
      Starting test: kccevent
         ......................... EVE passed test kccevent
      Starting test: systemlog
         ......................... EVE passed test systemlog

   Running enterprise tests on : mcstudios.com
      Starting test: Intersite
         ......................... mcstudios.com passed test Intersite
      Starting test: FsmoCheck
         ......................... mcstudios.com passed test FsmoCheck

//NETDIAG

.........................................

    Computer Name: EVE
    DNS Host Name: eve.mcstudios.com
    System info : Windows 2000 Server (Build 2195)
    Processor : x86 Family 6 Model 8 Stepping 3, GenuineIntel
    List of installed hotfixes :
        KB820888
        KB822831
        KB823182
        KB823559
        KB823980
        KB824105
        KB824141
        KB824146
        KB824151
        KB825119
        KB826232
        KB828028
        KB828035
        KB828741
        KB828749
        KB830352
        KB832359
        KB834707-IE6SP1-20040929.091901
        KB835732
        KB837001
        KB839643
        KB839645
        KB840315
        KB840987
        KB841356
        KB841533
        KB841872
        KB841873
        KB842526
        KB842773
        KB867282-IE6SP1-20050127.163319
        KB870763
        KB871250
        KB873333
        KB873339
        KB883935
        KB885250
        KB885834
        KB885835
        KB885836
        KB888113
        KB889293-IE6SP1-20041111.235619
        KB890047
        KB890175
        KB890859
        KB890923-IE6SP1-20050225.103456
        KB891711
        KB891781
        KB893066
        KB893086
        KB893803
        KB894320
        Q147222
        Q828026


Netcard queries test . . . . . . . : Passed



Per interface results:

    Adapter : {51EA14E3-1767-44C7-A237-107A4565E3C2}

        Netcard queries test . . . : Passed

        Host Name. . . . . . . . . : eve
        IP Address . . . . . . . . : 192.168.110.10
        Subnet Mask. . . . . . . . : 255.255.255.0
        Default Gateway. . . . . . : 192.168.110.2
        Primary WINS Server. . . . : 192.168.110.11
        Dns Servers. . . . . . . . : 192.168.110.10
                                     192.168.110.11
                                     192.168.110.13


        AutoConfiguration results. . . . . . : Passed

        Default gateway test . . . : Passed

        NetBT name test. . . . . . : Passed
        [WARNING] At least one of the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names is missing.

        WINS service test. . . . . : Passed

    Adapter : IPX Internal Interface

        Netcard queries test . . . : Passed

        Ipx configration
            Network Number . . . . : d87820fd
            Node . . . . . . . . . : 000000000001
            Frame type . . . . . . : Ethernet II



    Adapter : IpxLoopbackAdapter

        Netcard queries test . . . : Passed

        Ipx configration
            Network Number . . . . : d87820fd
            Node . . . . . . . . . : 000000000002
            Frame type . . . . . . : 802.2



    Adapter : NDISWANIPX

        Netcard queries test . . . : Passed

        Ipx configration
            Network Number . . . . : 00000000
            Node . . . . . . . . . : 840c20524153
            Frame type . . . . . . : Ethernet II




Global results:


Domain membership test . . . . . . : Passed


NetBT transports test. . . . . . . : Passed
    List of NetBt transports currently configured:
        NetBT_Tcpip_{51EA14E3-1767-44C7-A237-107A4565E3C2}
    1 NetBt transport currently configured.


Autonet address test . . . . . . . : Passed


IP loopback ping test. . . . . . . : Passed


Default gateway test . . . . . . . : Passed


NetBT name test. . . . . . . . . . : Passed
    [WARNING] You don't have a single interface with the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names defined.


Winsock test . . . . . . . . . . . : Passed


DNS test . . . . . . . . . . . . . : Passed
    PASS - All the DNS entries for DC are registered on DNS server '192.168.110.10' and other DCs also have some of the names registered.
    PASS - All the DNS entries for DC are registered on DNS server '192.168.110.11' and other DCs also have some of the names registered.
    PASS - All the DNS entries for DC are registered on DNS server '192.168.110.13' and other DCs also have some of the names registered.


Redir and Browser test . . . . . . : Passed
    List of NetBt transports currently bound to the Redir
        NetBT_Tcpip_{51EA14E3-1767-44C7-A237-107A4565E3C2}
    The redir is bound to 1 NetBt transport.

    List of NetBt transports currently bound to the browser
        NetBT_Tcpip_{51EA14E3-1767-44C7-A237-107A4565E3C2}
    The browser is bound to 1 NetBt transport.


DC discovery test. . . . . . . . . : Passed


DC list test . . . . . . . . . . . : Passed


Trust relationship test. . . . . . : Skipped


Kerberos test. . . . . . . . . . . : Passed


LDAP test. . . . . . . . . . . . . : Passed


Bindings test. . . . . . . . . . . : Passed


WAN configuration test . . . . . . : Skipped
    No active remote access connections.


Modem diagnostics test . . . . . . : Passed


Netware configuration
    You are not logged in to your preferred server .
    Netware User Name. . . . . . . :
    Netware Server Name. . . . . . :
    Netware Tree Name. . . . . . . :
    Netware Workstation Context. . :

IP Security test . . . . . . . . . : Passed
    IPSec policy service is active, but no policy is assigned.


The command completed successfully
0
 
Leandro IaconoCommented:
Try this out:

Check out Schema Permissions:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/c93eb971-63e9-45da-aaa8-e18653e02fa2.mspx

And make sure your not just allowed View. You should be allowed the write/modify permission also ... You would in theory check this out by accessing the advanced permissions tab ....

You would then have a detailed list of the permissions you are allowed.

It would be something like what is exaplained here:
http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/prdd_sec_letd.asp?frame=true

For example, you could have "allowed" checked, but when going through the advanced permissions tab, you could only have enabled the READ. The write could be disabled ... which doesn't mean denied.

Thats what I would check out first ...

I am guessing this could be the cause, becuase I really do not have much experience on modifying the schema.

Installing AD Schema Snap-in which I guess you already did .. but just in case ... :
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/8c76ff67-9e9d-4fc7-bfac-ffedee8a04d4.mspx
0
Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

 
CharlesWaltonAuthor Commented:
UICE: I tried checking these properties from both DCs. Unfortunately, this doesn't seem to be the problem. Everything looks as it should (full control, read/write all, etc are all granted/allowed).

However, I tried using the schema snap-in on a Win2003 machine in my domain that is not a DC. I don't get the "You can only view..." message, and I can edit permissions which are then reflected on both DCs...

What could possibly be going on?
0
 
Leandro IaconoCommented:
"Everything looks as it should (full control, read/write all, etc are all granted/allowed)."

Could you be a bit more specific.... as in who is allowed Full control ... etc ...
And please post all users/groups which are allowed permissions, and if possible the level of permissions they have ...

As for  "I don't get the "You can only view..." message, and I can edit permissions which are then reflected on both DCs..." ...

I really don't know where your going there .. what do you mean?
0
 
theruckCommented:
check the domain controllers OU permissions in AD Users & Computers
0
 
Seelan NaidooMicrosoft Systems AdminCommented:
Logon as a different user, must be a member of Exchange Schema Admins, and Enterprise Admins, you might have restricted security rights somewhere along the chain, so logging in as a Schema Admin will not any any real restrcitions and therefore the installation of Exchange 2003 will now proceed.
0
 
CharlesWaltonAuthor Commented:
UICE: Perhaps I misspoke last night... Looking at it again this morning, I see this:
--Permissions for Schema
---Administrators -> All Allow/Deny boxes greyed out, no checkmarks
---Authenticated Users -> All Allow/Deny boxes greyed out, no checkmarks
---Enterprise Admins -> All Allow/Deny boxes greyed out, no checkmarks
---ENTERPRISE DOMAIN CONTROLLERS -> All Allow/Deny boxes greyed out, no checkmarks
---Schema Admins -> All Allow/Deny boxes greyed out, no checkmarks
---SYSTEM
----Advanced
-----Allow | Administrators (DOMAIN\Administrators) | Full Control | This object and all child objects
-----Allow | Authenticated Users | Full Control | This object and all child objects
-----Allow | Enterprise Admins (DOMAIN\Enterprise Administrators) | Full Control | This object only
-----Allow | ENTERPRISE DOMAIN CONTROLLERS | Full Control | This object only
-----Allow | Schema Admins (DOMAIN\Schema Admins) | Full Control | This object and all child objects
-----Allow | SYSTEM | Full Control | This object and all child objects
----Owner
-----Schema Admins (MCSTUDIOS\Schema Admins)

What I meant about the other server is that I can open the schema snap-in and view/change all the permissions. The above "Permissions for Schema" Allow/Deny checkboxes are NOT greyed out on the Win2003 system when it's connected to the actual schema master.

SeanUK777: I made a separate account to test what you've mentioned. Said account is a member of Schema, Enterprise and Domain Admins. I got the same results, even if I tried with an account that belongs only to the schema/enterprise admins groups.
0
 
CharlesWaltonAuthor Commented:
Update:

It would appear that I can view/edit schema permissions from any machine *except* the DCs. This, however, doesn't have any effect on whether exchange can be installed.

Should I just start over? I really appreciate everyone's comments, it's just I don't understand what's going on at all...
0
 
Leandro IaconoCommented:
---Enterprise Admins -> All Allow/Deny boxes greyed out, no checkmarks
---ENTERPRISE DOMAIN CONTROLLERS -> All Allow/Deny boxes greyed out, no checkmarks
---Schema Admins -> All Allow/Deny boxes greyed out, no checkmarks

I would say those are incorrect ... totally. You need to have allow at least on schema admins. Enterprise admins should be a inside schema admins group, but that really depends. What I mean by this is that you can state who exactly is part of that group.

Now, why is it grayed out? You should be able to set the permissions to allow. If you can't its becuase you are not logged into AD with an Enterprise Admins user.

You should be able to set permissions, and schema admins group has to have full control over the schema, which you set using the directions I gave you above.

Cheers!
0
 
Leandro IaconoCommented:
And this ....

"---SYSTEM
----Advanced
-----Allow | Administrators (DOMAIN\Administrators) | Full Control | This object and all child objects
-----Allow | Authenticated Users | Full Control | This object and all child objects
-----Allow | Enterprise Admins (DOMAIN\Enterprise Administrators) | Full Control | This object only
-----Allow | ENTERPRISE DOMAIN CONTROLLERS | Full Control | This object only
-----Allow | Schema Admins (DOMAIN\Schema Admins) | Full Control | This object and all child objects
-----Allow | SYSTEM | Full Control | This object and all child objects
----Owner
-----Schema Admins (MCSTUDIOS\Schema Admins)"

I don't understand any of that ... could you be a bit more clear twords who is what?

I would be specially interested in this: Schema Admins (MCSTUDIOS\Schema Admins)
0
 
Mercury161Commented:
Charles - came across this problem myself this afternoon - not sure if this the same as your problem but here you go - the answer was staring me in the face.

I presume you have got access to the mmc snap in for AD Schema.

Expand the tree and right click on "Active Directory Schema" on the right side of the window.

Click Operations Master.  Window pops up called "Change Schema Master"

Tick the box that says "The schema may be modified ...etc."

This did it for me.

Ross.

0

Featured Post

Vote for the Most Valuable Expert

It’s time to recognize experts that go above and beyond with helpful solutions and engagement on site. Choose from the top experts in the Hall of Fame or on the right rail of your favorite topic page. Look for the blue “Nominate” button on their profile to vote.

  • 4
  • 4
  • 2
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now