SBS 2003 – ISSUES with Group Memberships ? / ERROR WITH “SBS2003 SP1 INSTALL” ( small business server 2003 )

I had a similar problem with verizon sync software.  I had to add the end users domain account to the local administrators group.  I would try putting one the users into the local administrators group (user who wants his email sync'd).

Id also check to make sure active sync can run on windows server.

Huh? Not sure what you are asking me to do? I have not installed ActiveSync 4.2 yet (If do try I will get a promp that SP1 needs to be installed)

I am having issues with the SBS 2003 SP1 install using the server's administrator account. Not sure how this relates to the verison sync software. Are you saying I need to login as another user, say myself, and add me to the groups requested in the error message?

According to microsoft all I need is SP1 (or version R2) installed and all is good to go moble 5.0

well it sounds like a permission issue (duh).  But what account are you logging in under??  If your logging into the machine under a local account (even the local administrator account), then that could cause an issue cause you are not logging into the domain.  Whatever account domain account you are using, make sure it is in the enterprise admins group (as they are the super user of the domain) then give it a shot.

Do you have any additional Servers on your network?  More specifically another Domain Controller?
If so, please see:  http://support.microsoft.com/kb/842694

If not... please confirm that you are using the "BUILT-IN" administrator account, and while you have confirmed that the account is a member of the required groups... you also need to make sure it's NOT a member of groups that may have restricted permissions.  

These are the groups that the built-in administrator is a member of by default:
Administrators
Domain Admins
Domain Users
Enterprise Admins
Group Policy Creators
Mobile Users
Schema Admins

Remove membership from all other groups and try installing again.

Jeff
TechSoEasy

I changed the groups for the administrator to the default. I added two previous groups, though I removed them before I tried the SBS2003 SP1 install again.

The same thing happened. I have glanced throught the article, I will look at it more in depth.

Some time ago we did have a major failure: a guy added a drive to RAID array and basically ended up wiping everything out. Then on the windows backup system state was not checked. So we had to create a new domain. Not fun, it that my problem? stuff from the old domain still lingering around, such as the admin? I will dive into the article though when I did glance through it before I noticed something i had no idea what they where talking about. I may have a few more questions, about the article, to complete this.

Thank you all for the help.

It very could be problems related to how the domain was rebuilt.
That KB article though, should help to find those things out.

Jeff
TechSoEasy

Ok. When I go under "Active Directory Users and Computers > ... > Domain Controllers   it shows the server with SB2003 installed on it, but it also shows another server we use for an accounting database which has Windows Server 2003 standard with SP1. I am assuming that should not be there and should be under computers, like the other storage server (the storage server has Window Storage Server 2003)? is this correct? Any idea how to demote it from a domain controller, is that what I want to do?

There are 3 servers on the network:
SBS 2003 Server
Windows Server 2003, standard, SP1
Windows Storage Server 2003

No, actually nothing should be under "computers".  In a Small Business Server domain, all computers (other than the SBS) should be under Domain.local\MyBusiness\Computers\SBSComputers and all other servers should be under Domain.local\MyBusiness\Computers\SBSServers.

That is unless you've promoted a server to be an additional domain controller on the network.... which you apparently do.  So please follow the KB article as linked above.

Jeff
TechSoEasy

Also, you'll find that complete instructions for deploying SBS SP1 are here:  http://sbsurl.com/sp1

In the article 842694 - "verify that an inbound replication has occurred from replica domain controllers after you start windows small business server"

I do the part to replicate the Domain controllers, but do I really want to run the windows small business server setup? The article seems to lean torward a fresh install, I have existing users, domain, exchange, etc... that i do not want to have an issue with, will I if i run it?

No, the problem is that you apparently have an additional domain controller on your network that has invalid information.  You need to verify that there are no orpan domain controllers on your network as the KB article describes.

Jeff
TechSoEasy

Also, running SBS Setup is a very common thing to do after you've installed your server.  That's how you reinstall any of the components.

Jeff
TechSoEasy

I did the items in the atricle other than run the setup to the server 2003 setup wizard.

sbsserver = the server with the sbs 2003 install
server2 = server with windows server 2003 standard

I had no issues other than when I ran the when I ran the dcdiag util
 below are my notes:

** START > RUN > CMD
      DCDIAG /V /A /F:DCDIAG1.TXT
            RAN SUCCESSFUL
      NOTEPAD DCDIAG1.TXT
                     -FAILED
            WARNING: SBSSERVER IS NOT ADVERTISING AS A TIME SERVER
            ....SERVER FAILED TEST ADVERTISING
                     -FAILED
            ISMSERV SERVICE IS STOPPED ON [SERVER]
            W32TIME SERVICE IS STOPPED ON [SERVER]
            ....SBSSERVER FAILED TEST SERVICES
                    -FAILED
            WARNING: SERVER2 IS NOT ADVERTISING AS A TIME SERVER
            ....SERVER2 FAILED TEST ADVERTISING
                    -FAILED
            WARNING: DCGETDCNAME(TIME_SERVER) CALL FAILED, ERROR 1355
            WARNING: DCGETDCNAME(GOOD_TIME_SERVER_PREFERRED) CALL      FAILED, ERORR 1355
            ....LOCALDOMAIN FAILED TEST FSMOCHECK


** START > RUN > SERVICES.MSC
      STARTED W32TIME SERVICE - WINDOWS TIME
           SET WINDOWS TIME TO AUTOMATIC
      STARTED ISMSERV - INTERSITE MESSAGING
           SET INTERSITE MESSAGING TO AUTOMATIC

** START > RUN > CMD
      DCDIAG /V /A /F:DCDIAG2.TXT
            RAN SUCCESSFUL
      NOTEPAD DCDIAG2.TXT
      SEE TXT FILE ERRORS EXISTED
      -FAILED
      AN ERROR EVENT OCCURED. EVENTID: 0X825A0011
      AN ERROR EVENT OCCURED. EVENTID: 0XC25A001D
      AN ERROR EVENT OCCURED. EVENTID: 0X825A0011
      ....SBSSERVER FAILED TEST SYSTEMLOG
      -FAILED
      WARNING: ADV IS NOT ADVERTISING AS A TIME SERVER
      ....SERVER2 FAILED TEST ADVERTISING

** START > RUN > CMD
      DCDIAG /V /A /F:DCDIAG3.TXT
            RAN SUCCESSFUL
      NOTEPAD DCDIAG3.TXT
      SEE TXT FILE ERRORS EXISTED
      -FAILED
      AN ERROR EVENT OCCURED. EVENTID: 0X825A0011
      AN ERROR EVENT OCCURED. EVENTID: 0XC25A001D
      AN ERROR EVENT OCCURED. EVENTID: 0X825A0011
      ....SBSSERVER FAILED TEST SYSTEMLOG
      -FAILED
      WARNING: SERVER2 IS NOT ADVERTISING AS A TIME SERVER
      ....SERVER2 FAILED TEST ADVERTISING      
      
** START > RUN > NET TIME /SETSNTP:NIST.GOV.IN  
      DONE AT SBSSERVER

** START > RUN > NET TIME /SETSNTP:SERVER
      DONE AT SERVER2

** START > RUN > CMD
      DCDIAG /V /A /F:DCDIAG4.TXT
            RAN SUCCESSFUL
      NOTEPAD DCDIAG4.TXT
      SEE TXT FILE ERRORS EXISTED
      -FAILED
      AN ERROR EVENT OCCURED. EVENTID: 0X825A0011
      AN ERROR EVENT OCCURED. EVENTID: 0X825A0011
      ....SBSSERVER FAILED TEST SYSTEMLOG
      
** START > RUN > NET TIME /SETSNTP:SBSSERVER
      DONE AT SERVER

** START > RUN > CMD
      DCDIAG /V /A /F:DCDIAG5.TXT
            RAN SUCCESSFUL
      NOTEPAD DCDIAG5.TXT
      SEE TXT FILE ERRORS EXISTED
      -FAILED
      AN ERROR EVENT OCCURED. EVENTID: 0X825A0011
      AN ERROR EVENT OCCURED. EVENTID: 0X825A0011
      ....SBSSERVER FAILED TEST SYSTEMLOG
      -FAILED
      AN EVENT ERROR OCCURED. EVENTID: 0XC0001F60
      ....SERVER2 FAILED TEST SYSTEMLOG

** RESTART SERVER2

** START > RUN > CMD
      DCDIAG /V /A /F:DCDIAG6.TXT
            RAN SUCCESSFUL
      NOTEPAD DCDIAG6.TXT
      SEE TXT FILE ERRORS EXISTED
      -FAILED
      AN ERROR EVENT OCCURED. EVENTID: 0X825A0011
      AN ERROR EVENT OCCURED. EVENTID: 0X825A0011
      ....SBSSERVER FAILED TEST SYSTEMLOG
      -FAILED
      AN EVENT ERROR OCCURED. EVENTID: 0XC0001F60
      ....SERVER2 FAILED TEST SYSTEMLOG

%% THOUGHT I WOULD RUN THE SP1 AND SEE WHAT HAPPENS

** RUN C:\SP1\WINDOS SMALL BUSINESS SERVER 2003 SERVICE PACK 1 - PART 5 OF 5.EXE
      -WIZARD > NEXT
      -AGREE TO EULA
      -RUNNING PROCESSES BEFORE INSTALL
      -INSTALLING WINDOWS SMALL BUSINESS SERVER 2003 SERVICE PACK 1
      
      ____________________________________________________________________________
      ERROR: WINDOWS SMALL BUSINESS SERVER 2003 SERVICE PACK 1
      WINDOWS SMALL BUSINESS SERVER SERVICE PACK 1 SETUP HAS ENCOUNTERED AN
      ERROR. FOR MORE INFORMATION, REVIEW THE MOST RECENT ENTRY IN THE SETUP
      ERROR LOG IN C:\PROGRAM FILES\MICROSOFT INTERGRATION\WINDOWS SMALL BUSINESS
      SERVER 2003\LOGS\SETUP.LOG. THEN CORRECT THE ERROR AND RUN THE SERVICE PACK
      1 SETUP AGAIN.

      DO YOU WANT TO VIEW THE ERROR LOG NOW?
            YES            NO
      _________________________________________________________________________
when I look at the log nothing new is there. I also checke the event viewer and nothing real new is there either.

I do not get the domain admin members error anymore but I am getting the error above. I had an issue a while back about the time. i was having issues with the client not being able to connect due to a date/time issue. I noticed the sbsserver and the server2 where not the same time, they where about 14 minutes apart. I do not want user connecting to server2.

I do not have any reason for server2 being a domain controller. How do i demote there server correctlly? maybe that will solve all of the probems since there are only the 2 DC in the domain?
any sugestions.

I think server was added as a domain controller when the sbsserver was reformatted and we where trying to save the existing domain, active directory, and exchnage mailboxes. Microsoft was even involved remotely (what they did was is a mystery to me since it did not work), though nothing worked and we had to create a new domain and had to add each user to the new domain. We where able to migrate the mailboxes to the users, that was a nightmare.

What do you suggest? Why would I want to keep server2 as a DC?

Demoting Server2 from being a DC would be a good idea.  I generally don't recommend having a second DC on an SBS network unless the second DC is in a separate location such as a branch office.  

To demote it, just run DCPROMO at a command prompt on Server2 and follow the instructions.

Then, the fact that the Windows Time Service was not running is a problem that needs to be resolved.  It still looks as though it's misconfigured.  Your command of "NET TIME /SETSNTP:NIST.GOV.IN" is certainly not valid.  If you are in North America, then the commands that you need to run to properly set SBS to sync with an authoritative external time server are as follows:

w32tm /configure /manualpeerlist:"0.pool.ntp.org,0x8 1.pool.ntp.org,0x8 2.pool.ntp.org,0x8" /syncfromflags:MANUAL

net stop w32time

net start w32time

w32tm /resync /nowait

(It's now recommended to use pool.ntp.org as a more reliable time server source)


Once that's done, you should run the following commands at each workstation:

net time /setsntp:sbsserver

w32tm /resync

(if you have a lot of workstations, just add these two lines to the SBS_LOGIN_SCRIPT.bat file found in the \NETLOGON share of the server -- place them below the first line which should read "\\SBSServer\Clients\Setup\setup.exe /s SBSServer" -- leave the bat file that way untill all workstations have been logged out and in again and then you can REM out or delete the lines).

Just FYI, not having a single, reliable time source for your network will definitely cause lots of authentication errors because Kerberos authentication (which is what is primarily used in an SBS network) requires the time of an authenticating client to be within 5 minutes of the Domain Controller it authenticates to.  Obviously then, having two DC's that were 14 minutes apart is problematic... and once you remove the second DC and reset time authentication, you should see most of your error messages disappear.

Then, you can reapply SBS SP1... but please note that if you still get the error, “Windows small business server service pack 1 setup has encountered an error" you can safely ignore it if you have not installed the Microsoft Office Outlook 2003 component for Client Deployment on your server.  However, you definitely should not get the "member of..." error.

Reference:  http://download.microsoft.com/download/d/5/b/d5be2c2c-b1cb-47f8-9235-8cf89820139e/Readme_std.htm

Jeff
TechSoEasy

I will do this tonight. Thanks for your help.

I am now getting the following error in the DCDIAG UTILITY:

Starting test: systemlog
         * The System Event log test
         An Error Event occured.  EventID: 0x825A0011
            Time Generated: 05/12/2007   18:16:43
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC25A001D
            Time Generated: 05/12/2007   18:16:43
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x825A0011
            Time Generated: 05/12/2007   18:19:15
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x825A0011
            Time Generated: 05/12/2007   18:29:59
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC25A001D
            Time Generated: 05/12/2007   18:29:59
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x825A0011
            Time Generated: 05/12/2007   18:30:51
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x825A0011
            Time Generated: 05/12/2007   18:45:53
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x825A0011
            Time Generated: 05/12/2007   18:46:40
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC25A001D
            Time Generated: 05/12/2007   18:46:40
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x825A0011
            Time Generated: 05/12/2007   18:56:28
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC25A001D
            Time Generated: 05/12/2007   18:56:28
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x825A0011
            Time Generated: 05/12/2007   18:57:15
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x825A0011
            Time Generated: 05/12/2007   19:07:25
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x825A0011
            Time Generated: 05/12/2007   19:07:42
            (Event String could not be retrieved)
         ......................... SERVER1 failed test systemlog

The SP1 install fails with the same generic error? I am lost. What a pain this SP1.

Any Ideas?

Either Server2 is still being seen as a DC (is it still in the Domain Controller's OU?) or you have a misconfiguration of your NIC's settings.

Please post a COMPLETE ipconfig /all from the SBS.

Thanks.

Jeff
TechSoEasy

START > RUN > CMD
C:\DOCUMENTS AND SETTINGS\ADMINITSRATORIPCONFIG /ALL

Windows IP Configuration
   Host Name .................... : server1
   Primary Dns Suffix ....... : domain.local
   Node Type .................... : Unknown
   IP Routing Enabled......... : Yes
   WINS Proxy Enabled..... : Yes
   DNS Suffix Search List..: domain.local
PPP adapter RAS Server <Dial In> Interface:
   Connection-Specific DNS Suffix . :
   Descritpion................................... : WAN <PPP/SLIP> Interface
   Physical Address........................ : 00-53-45-00-00-00
   DHCP Enabled............................. : No
   IP Adress.................................... : 10.0.0.20
   Subnet Mask............................... : 255.255.255.255
  Default Gatway........................... :

START > RUN > CMD
C:\DOCUMENTS AND SETTINGS\ADMINITSRATORIPCONFIG /ALL

Windows IP Configuration
   Host Name .................... : server1
   Primary Dns Suffix ....... : domain.local
   Node Type .................... : Unknown
   IP Routing Enabled......... : Yes
   WINS Proxy Enabled..... : Yes
   DNS Suffix Search List..: domain.local
PPP adapter RAS Server <Dial In> Interface:
   Connection-Specific DNS Suffix . :
   Descritpion................................... : WAN <PPP/SLIP> Interface
   Physical Address........................ : 00-53-45-00-00-00
   DHCP Enabled............................. : No
   IP Adress.................................... : 10.0.0.20
   Subnet Mask............................... : 255.255.255.255
  Default Gatway........................... :
  NetBOIS over TCIP...................... : Disabled
Ethernet adapter Server Local Area Connection:
   Connection-specific DNS Suffix.....:
   Description..................................... : Intel<R> PRO/1000 MT Network Connection
   Physical Address.......................... : 00-04-23-88-14-97
   DHCP Enabled............................... : No
   IP Address.................................... : 10.0.0.2
   Subnet Mask................................. : 255.255.255.0
   Default Gatway............................ : 10.0.0.3
   DNS Servers................................ : 10.0.0.2
   Primary WINS Server................... : 10.0.0.2

I think the DHCP should be enabled? Not sure what is running it then, it is also disabled at the gateway router.

If I go to Active Directory Sites and Services:
Sites > Default-First-Site-Name > Servers
               - Server2 (There are no items to show in this view, in the view window)
               - SBSServer (NTDS Settings, if expanded.)
                       -NTDS Settings (There are no items to show in this view, in the view window)

If I go to Active Directory Users and Computers:
domain.local > Domain Controllers
     Only the SBS server is shown in the viewing window.

I also recieve a message to send a report that the  "Small Business Server Setup Executable" enconterd a problem and needed to close, when the server restart after failing to install SBS2003 SP1.  I sent the report to MS.

(Sorry about the half post I just sent, I got submit happy)

What happens if I do not install the SBS2003 SP1, since the other 4 parts have been ran and installed fine?

DHCP should NOT be enabled on the NIC, but it SHOULD be running as a service on your SBS.  

Make sure that it's running in the Services MMC.  If it's not there, please follow the instructions located at the bottom of http://sbsurl.com/dhcp entitiled:  
"Moving the DHCP Server Service to the Computer Running Windows Small Business Server 2003"

Then... if you still see Server2 in ADSS you should DELETE it from there.  While you're there, open up the NIDS Settings Properties (right click > properties) and note the DNS Alias listed for your SBSServer.  

Then, go to your DNS Management Console and Expand SBSSERVER > Forward Lookup Zones > _msdcs.domain.local
Within that folder there may possibly be an extra Alias (CNAME) entry for the domain which does NOT match the alias you noted in the NIDS properties.  If there is, delete the incorrect alias record.  Then, restart the DNS Service.

"What happens if I do not install the SBS2003 SP1, since the other 4 parts have been ran and installed fine?"

Umm... what happens if you don't install the 4th wheel on your car even though the other three spin just fine when the car is up on the rack?  Hopefully you get my point.

Jeff
TechSoEasy

I get the point about the wheel thing, thought I would just ask knowing it would be an odd question.

Below is what I have done. I did not see any extra alias(CNAME) in the DNSMGMT console, though there is an extra NS belonging to server2, should that be there? See below. Also, the alaisas matched as indicated to check in the previous post. I also deleted the server2 from the ADSS.

**START > ADMINISTRATIVE TOOLS > ACTIVE DIRECTORY SITES AND SERVICES
Active Directory Sites and Services:
Sites > Default-First-Site-Name > Servers
  -sbsSERVER
     -NTDS SETTINGS
      RIGHT CLICK > PROPERTIES
         DNS ALIAS: ################._msdcs.domain.local          

**START > ADMINISTRATIVE TOOLS > DNS
DNSMGMT - [DNS\SERVER\FORWARD LOOKUP ZONES\_MSDC.domain.LOCAL]
-sbsSERVER
 -FORWARD LOOKUP ZONES
  -_MSDCS.domain.LOCAL
   +DC
   +DOMAINS
   +GC
   +PDC
   (SAME AS PARENT FOLDER)              SOA              [104],sbsSERVER.domain.LOCAL.,HOSTMASTER
   (SAME AS PARENT FOLDER)      NS      server2.domain.LOCAL
   (SAME AS PARENT FOLDER)      NS      sbsSERVER.domain.LOCAL
   ################                             CNAME      sbsSERVER.domain.LOCAL

I ran the DCDIAG and all items passed this time. I will rerun the SBS2003 SP1 install tonight. Hope it runs. I will keep you posted.  Thanks for all the help up to this point.
 

I ran the SBS2003 SP1 and recieved the same error (not the . Though after I click to review the log, which nothing different, I closed the log and the display and the wizard window displayed the following information:
___________________________________
Completing the Windows Small
Business Server 2003 Service
Pack 1 Installation Wizard

You have successfully completed the KB885918 Setup Wizard.

To apply the changes, the wizard has to restart Windows. To restart Windows automatically,
click Finish. If you want to restart later, select the Do not restart now check box, and then click Finish.
_________________________________________________

So, I click finish. then the server restarts and I recieve notification it encountered an error and to send a report. Is this the client deplyment error, Windows XP SP2 for Client Deployment - Part 4 of 5 (or in MS terms SBS2003-KB891193-X86-ENU.EXE, which was installed fine) in the SP1 installs? (See below from your previous post)

****Then, you can reapply SBS SP1... but please note that if you still get the error, “Windows small business server service pack 1 setup has encountered an error" you can safely ignore it if you have not installed the Microsoft Office Outlook 2003 component for Client Deployment on your server.  However, you definitely should not get the "member of..." error.*****

I have not installed MS Office Outlook 2003 component for Client Deployment, as far as aI am aware of.

How do I know if it really installed correctly? I did not notice anything in the Event Log.

The errorr during the install was:
      ERROR: WINDOWS SMALL BUSINESS SERVER 2003 SERVICE PACK 1
      WINDOWS SMALL BUSINESS SERVER SERVICE PACK 1 SETUP HAS ENCOUNTERED AN
      ERROR. FOR MORE INFORMATION, REVIEW THE MOST RECENT ENTRY IN THE SETUP
      ERROR LOG IN C:\PROGRAM FILES\MICROSOFT INTERGRATION\WINDOWS SMALL BUSINESS
      SERVER 2003\LOGS\SETUP.LOG. THEN CORRECT THE ERROR AND RUN THE SERVICE PACK
      1 SETUP AGAIN.
      DO YOU WANT TO VIEW THE ERROR LOG NOW?
            YES           NO

Then I said YES and it did not chnage the log. And then it showed me that was was good. Then after it restarted I got a message that the SP1 execuatable encountered and error would I like to send a report?

I did notice that when it was installing it never said rolling back as it did in the past after the error.

I check SYSTEMINFO and both SP1-SP and KB889101-Service Pack where there.

I removed the server2 as a in the _msdcs.domain.local  by just removing it in the properties. I hope that was the correct way. Please let me know if there is a better way. I have learned a ton from you, thanks.

I will install ActveSync tonight and the Moble 5.0, If all goes well I will Accept the solutions. You have been a life saver!!!

There where alot of questions awnsered in this post. Thanks a ton, ActiveSync 4.2 Installed with no errors. I am able to continue the Moble 5.0 for Small Business Server 2003 Configure Instructions.