Solved

Cannot seize RID Operations Master role - NTDSUtil gives access denied - Insufficient rights.  Forest does not see child domain users to add account to Enterprise Admins.

Posted on 2006-06-21
4
1,231 Views
Last Modified: 2008-02-20
Here is the history of this situation.  Sorry for the length but I want to give as many details as possible up front.

Our "live" network is Windows 2003 AD mixed-mode with Exchange 5.5 running on NT4.  I have a server running the forest.  Let's call the forest, forest.local.  I have another server running a child to that called, child.local.  I want to create a test environment emulating the live network so I can test Exchange 2003 with our custom application that currently requires Exchange 5.5 for custom reports.  So, what I do is make a ghost copy of the forest and restore it on an identical server and put it on a stand alone test network.  I created an additional AD server with the Global Catalog and with DNS.  I ghost this server as well and put it on the test network.  I make a ghost image of the exhange 5.5 server and restore it on a server on the test network as well.  

I am now on the test network.  I know that none of the FSMO roles are on this server so I need to sezie them.  I go to the Operations Master tab with a right click on child.local.  I seized the PDC and Infrastructure Operations Master roles with no problem.  The RID Operations Master will not let me seize it.  I then try the following steps.
To seize the relative ID master role

Click Start, click Run, and then type cmd.
At the command prompt, type ntdsutil.
At the ntdsutil prompt, type roles.
At the fsmo maintenance prompt, type connections.
At the server connections prompt, type connect to server, followed by the fully qualified domain name.
At the server connections prompt, type quit.
At the fsmo maintenance prompt, type seize RID master.
At the fsmo maintenance prompt, type quit.
At the ntdsutil prompt, type quit.

to
That works fine until I get to seize RID master where the server says Insufficient rights.  I understand that I should be an Enterprise admin to do this.  But, when I try to go to the Forest to add my account as Enterprise Admin, the Forest cannot see the accounts on the child.local domain.  I checked the live network and it doesn't see the accounts on the child domain either from the add members to Enterprise admin tab.  This will probably be a multi-step fix.  Please let me know where to start.

Thanks for the help in advance
0
Comment
Question by:Airlogix
4 Comments
 
LVL 7

Accepted Solution

by:
CharliePete00 earned 250 total points
ID: 16955207
You need FSMO roles in both domains.

Starting with the parent domain (in order):

PDC Emulator
Schema Master
Domain Naming Master
Infrastructure Master
RID Master

Child domain:

PDC Emulator
Infrastructure Master
RID Master

This may not fix your problem.  You may need to reestablish the trust relationships between the parent and child domains.  Let's see if this works first.

See http://technet2.microsoft.com/WindowsServer/en/Library/6a773f69-e153-4460-9a9b-014e98110bab1033.mspx?mfr=true on placement of FSMO roles

0
 
LVL 48

Assisted Solution

by:Jay_Jay70
Jay_Jay70 earned 250 total points
ID: 16955861
your problem here is that you have ghosted your setup and expect it to work as it does in a live environment....this is a no go, what you should be doing, is having clean servers in your test environment, then, performing a system state backup on your live system and loading it onto your new clean servers...child domains should be created manually or using an authorative restore of the the system state backup

http://support.microsoft.com/?id=263532

http://support.microsoft.com/default.aspx?scid=kb;en-us;241594&sd=tech

http://technet2.microsoft.com/windowsserver/en/library//690730c7-83ce-4475-b9b4-46f76c9c7c901033.mspx

at the moment, you have all sorts of ID issues that i don't think you will be able to fix due to imaging
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
AD Migration / Upgrade 4 54
Windows 2008/12 :  When/Why we need  to configure multiple  Interface 2 69
AD user acount change history 4 68
SBS 2003 RWW Login 3 36
Many of us need to configure DHCP server(s) in their environment. We can do that simply via DHCP console on server or using MMC snap-in on each computer with Administrative Tools installed in a network. But what if we have to configure many DHCP ser…
On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question