Problem with ADPrep RODCPrep

Posted on 2009-04-09
Last Modified: 2012-05-06
ADPrep RODCPrep gets an error:
Adprep could not contact a replica for partition DC=DomainDnsZones,DC=Domain,DC=com.
Adprep encountered an LDAP error.
Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
Adprep failed the operation on partition DC=DomainDnsZones,DC=Domain,DC=com. Skipping to n
ext partition.
Oringinally the fsmoRoleOwner in:
cn=Infrastructure,dc=domaindnszones,dc=domain,dc=com was pointing to a deleted server.  

I used NTDSutil to check the replicas for the partition ...
domain management
connect to server DcName
list nc replicas "dc=DomainDnsZones,DC=Domain,DC=com"

Then I set the fsmoRoleOwner to a server in the list as follows:
(cut and pasted from the NtDSUtil output).
CN=NTDS Settings,CN=servername,CN=Servers,CN=sitename,CN=Sites,CN=Configuration,DC=rootdomain,DC=local

The above has not corrected the problem.
I looked at the partition with ADSIedit on the DC I pointed it to and it looks valid.

The error is:
Adprep could not contact a replica for partition DC=DomainDnsZones,DC=Domain,DC=com.
Adprep encountered an LDAP error.
Error code: 0x0. Server extended error code: 0x0, Server error message: (null).

Anyone have any ideas what to look at next???
Question by:brhahne
  • 2
LVL 15

Assisted Solution

zelron22 earned 25 total points
Comment Utility
Run a DCDIAG and see if anything errors out.
Is the machine you're running it on pointing to an AD aware DNS server?
How many DC's do you have?

Try running it directly on the schema master.
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 25 total points
Comment Utility
Have you seen this TechNet article

Did you run a  metadata cleanup on that old deleted server?

Accepted Solution

brhahne earned 0 total points
Comment Utility
The server was demoted properly and does not show up in the metadata.

yes I have seen kb article 949257 but since we have a lot of DCs I decided to set it manually.  I did comment the script to see where it would have set the fsmoRoleOwner though.

I had initially set the fsmoRoleOwner to a Windows 2008 DC but changed it to a Windows 2003 DC.  After doing that the RODCPrep completed successfully on the DomainDNSZones partition.

Now I just have to do the ForestDNSZones partition...  All the rest of them have already succeeded.

Author Comment

Comment Utility
ForestDNSZones worked as well.  All issues resolved.

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Active Directory Audit 18 69
Microsoft Lync 2013 4 41
Raid 6 or Raid 10? 19 45
Need help in modifying an existing script 5 9
On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now