Unable to modify users from second server in Active Directory

I have a very basic network setup with one 2003 Server running AD and several member servers, one of which is running Exchange 2003.  Until last week I was able to use ADUC to modify and create users from the Exchange server.  Since last week I can only view properties.  It doesn't give me any choice to create users, and all user properties are greyed out.  If I try to do anything it says "you do not have permission to change the [whatever] attribute, changes will not be saved."

I am logged in as administrator, and I rebooted this server this weekend.  I have not rebooted the primary server yet.

Thanks,
Jason
ChiefAutoAsked:
Who is Participating?
 
mcse2007Connect With a Mentor Commented:
ChiefAuto,

If you are accessing your primary  DC from the Exchange server and if your exchange is not a promoted is not secondary AD and you are using an adminpak, why don't you right click the Users and Computers icon on your desktop then select "RUN AS" and put the account that has the rights to create, amend user account etc. ?
0
 
Jay_Jay70Commented:
dcdiag will be the first point to look at
0
 
mcse2007Commented:
From the primary domain controller, are you able to create new user?
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
ChiefAutoAuthor Commented:
jay jay: I ran dcdiag /s:[domain server name] and it came up fine.  When I try dcdiag /a it says "Exchange is not a DC.  Must specify /s:....."

mcse2007: I can create new users from the primary controller just fine.

I just noticed that the exchange server doesn't show up as a domain controller in ADUC.  Shouldn't it have gone there automatically when it was installed?  It worked perfectly for 3 months.

Thanks,
Jason
0
 
Jay_Jay70Commented:
not unless your exchange server is indeed a DC...it may be that you only have the adminpak installed on that exchange box

There is no such thing as a PDC

my guess is that exchange server is just an exchange server and that the adminpak is installed and that the user you have doesnt have enough rights to modify those objects
0
 
ChiefAutoAuthor Commented:
mcse2007,

It works great if I RUN AS my own account, but not as administrator.  Even domain\administrator doesn't work.  The problem I have with it is that you have to run it that way every time.  At least I was able to get done what I needed to get done this way.

Does it make any sense that I have to log on as an administrator but not 'administrator' to you?  It doesn't make much sense to me.
0
 
mcse2007Commented:
The best practice when logging into member server is logon as non administrator account then use ONLY the local administrator account of the server to perform installation or troubleshooting like using the RUN AS this apply to running AD users and computers, Sites and Services etc.,

 


0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.