We help IT Professionals succeed at work.

ADPREP /forestprep Fails, x500uniqueIdentifier

953 Views
Last Modified: 2013-12-24
Hello,

I have been trying to prep my domain so I can add server 2003 R2 and Server 2008 boxes to the domain. The current domain function level is Windows 2000 Mixed. All of our DC's are now 2003 Service Pack 2. I have a few more servers that I need to join the domain that will be 2003 R2 and possible a 2008 server. So I copied the ADPREP folder from my 2003 R2 disk to the c:/ of the server that holds all of the FSMO roles for the domain. When I run adprep /forestprep I get a failure message..well actually two:

"lDAPDisplayName" attribute value for objects defined in Windows 2000
schema and
 extended schema do not match.


A previous schema extension has defined the attribute value as
"OldunixIDWithDup
OID" for object
"CN=x500uniqueIdentifier,CN=Schema,CN=Configuration,DC=windhamsd
,DC=org" differently than the schema extension needed for Windows 2003
server .
[Status/Consequence]
Adprep cannot extend your existing schema
[User Action]
Contact the vendor of the application that previously extended the schema
to res
olve the inconsistency. Then run adprep again.




=============================================================================
"isSingleValued" attribute value for objects defined in Windows 2000
schema and
extended schema do not match.


A previous schema extension has defined the attribute value as "TRUE" for
object
 "CN=x500uniqueIdentifier,CN=Schema,CN=Configuration,DC=windhamsd,DC=org" differently than the schema extension needed for Windows 2003 server .
[Status/Consequence]
Adprep cannot extend your existing schema
[User Action]
Contact the vendor of the application that previously extended the schema
to res
olve the inconsistency. Then run adprep again.

Now the top one was from earlier attempts at fixing the issue, the bottom was was the origional issue. I saw a post that said to do a regedit then change the value to FALSE but honestly doing ADSI and things of that nature go over my head and I am timid when it comes to setting registry entries on DC's. The regedit being:

HKLM\system\CurrentControlSet\Services\NTDS\Parameters
Value Name: Schema Update Allowed
Value Type: REG_DWORD
Value Data:1

So here is where my question comes in. Does anyone know how to remedy this issue? And what does this really mean?

I really don't want to have to create a whole new domain and start from scratch, that would be miserable. I did try to fix this one time before on EE but I was pulled off the task and the question became stale, but now I have no choice but to fix this issue. I appreciate any help offered.

I attached all the info from my previous post so you know what I have already tried. It is very long (72 pages) but it may help.

Thank You.

adprep-fails.doc
Comment
Watch Question

This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION
AwinishSenior Solution Architect

Commented:
Do you have exchange server also & if yes try below link.

http://support.microsoft.com/kb/917385

http://www.petri.co.il/windows_2003_adprep_fix_for_e2k.htm

You need to follow above article.

Please let me know domain & forest functional level of your domain along with Exchange version.

If all the dc is windows 2003 then raise the domain functional level mim to windows 2003 atleast.

Note: member server will work of windows 2000 but windows 2000 server can't be domain controller if you raise the forest domain functional level & it can't be reverted also if raised & it require system state backup if you want to go back to previous domain functional level.
Senior Solution Architect
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Author

Commented:
Thank You for the responses.

When I go to download the hotfix it only has the ia64 platform and I am running x86..I don't know why this is, considering the document says that there is 32 bit version. If you click on the link for the download you will see what I mean.

I am not running Exchange in the domain, thank god, do you have to restart the DC if you raise the function level? Currently we have no Server 2000 machines anywhere in our district.

Thanks again guys.

AwinishSenior Solution Architect

Commented:
No,you don't require reboot.

Author

Commented:
I am doing a system state backup right now before I raise the function level. Have you guys had this issue before?
AwinishSenior Solution Architect

Commented:
No,but its good to take the system state backup.

Please share the other info i asked.

Author

Commented:
Oh yea,

Also, is there a way to force the change to the other DC's so I don't have to wait for replication?

Author

Commented:
Sorry about that Awinish the Forest is Windows 2000 and the domain is 2000 mixed. It does say that I cannot raise the forest function level because the domain level is 2000. And no Exchange here.
AwinishSenior Solution Architect

Commented:
repadmin /syncall /A/E/P/D


AwinishSenior Solution Architect

Commented:
You have to raise domain functional level first then forest functional level.

Author

Commented:
OK the raise of domain function level was successful is it OK to do the Forest immediately as well...sorry for the play by play response it just makes me more comfortable.
AwinishSenior Solution Architect

Commented:
Its not mandatory but you can raise that too.

Author

Commented:
Thank You,

So I haven't raise the forest just yet..but the domain is up to 2003. What do you suggest I do next?

Thank you for all your time.
AwinishSenior Solution Architect

Commented:
Just give a try & make sure its replicated & try to run below solution & see if it works.

http://www-01.ibm.com/support/docview.wss?uid=swg21351171

Did you install any application which modified the schema?


AwinishSenior Solution Architect

Commented:
Check below KB too.

http://support.microsoft.com/kb/919938
AwinishSenior Solution Architect

Commented:

Author

Commented:
Interesting question Awinish,

This is a new network to me I have only been here for a year. Supposedly they called in Microsoft once to fix an issue, unsure if it's related but it is possible that at one point in time Unix extensions were made or something was installed to get Macs to talk to Active Directory (which we don't use at this current time). So the short answer is that I didn't install an application but it is very possible that something was installed but it probably is not being used now..and if it is I'll deal with that later.
AwinishSenior Solution Architect

Commented:
Yes, i have read it somewhere & that is causing the issue to extend the schema & the value has to be removed. Give a try to article i posted & if it doesn't resolve your issue, contact MS coz fiddling with schema is not the way & it might damage AD.
ok.. i am not sure if you will be able to adprep without tha hotfix. you can give it a try
as far i know last time i did this i did not have to raise the functional level. i mean i did not check if i was already raised
as far as i know mixed mode can have from 2000 to 2003R2 dcs.. may be awinish can throw some light on it

if adprep fails
you might want to have a word with microsoft pss if you are unable to  get that hotfix


Author

Commented:
Good info guys,

I too did see that article Awinish. How do you think they chenged the attribute after when they said this:

"Once we created that, we were able to change the attributes without trouble and run "adprep /forestprep"

Do you think it was ADSI?

Author

Commented:
Also when I typed in repadmin /syncall /A/E/P/D

I recieved an invalid command line prompt

Author

Commented:
I did try the KB919938 article before with no luck.

Author

Commented:
OK so just tried the adprep after replicating and no luck I am currently trying to aquire the hotfix, if that doesn't work I will try the regedit
AwinishSenior Solution Architect

Commented:
dhruvarajp:Raising the functional level has no affect on error since there is no windows 2000 so i thought raising it to get the added atleast feature of windows 2003.
Secondly if there is any stale dc of windows 2000(which is not removed properly) will give error while raising the domain functional level.

The KB posted by dhruvarajp: will not help as it is for windows 2003 Sp1 & author has SP2.

The problem is the schema extension which is caused by linux & that attribute is not able to modified so i don't know how it was done,so i asked for MS help on this as they have specialist who do schema modification but WindhamSD:give a try to article i posted in last & i think will make it work.


AwinishSenior Solution Architect

Commented:
Check the link & i think its same where schema extension has been performed for linux.

http://www.winserverkb.com/Uwe/Forum.aspx/windows-server-ad/16033/Ntdsutil-to-remove-AD-attribute
hotfix is the recomended ans supported way.. you know..
you can always go back to microsoft and ask them to fix the bug if they have.. if we do not supported things they politely say "this scenario is not supported"

and they really allow less space when it comes things like Schema modifications

AwinishSenior Solution Architect

Commented:
But since its MS concept & product they do it.

it has to be resolved if it can be & i think if they have done schema extension for linux then they have to resolve the issue.
AwinishSenior Solution Architect

Commented:
Time to leave..Bye

Author

Commented:
Good info! So I added the Regedit:

In HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters, create the following value:
Value name: Allow System Only Change
Data type: REG_DWORD
Value data: 1

Then ran adprep /forestprep

It gave me the same error. I have a feeling that they did something before running adprep because of this line in the article:

Once we created that, we were able to change the attributes without trouble and run "adprep /forestprep" successfully.

The key words being "we were able to change the attricbutes without trouble AND run". I kind of think they made some change manually here...

Maybe I should call MS I'll have to contact my superior to see if that's a viable option.

Thanks again guys I will keep everyone posted and if you come up with any other ideas feel free to drop a line or two.
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Author

Commented:
Thank You cocroftc

I am using the standard Administrator user and I double checked that I am in the Schema Admins group but no success....Do I need to reboot after the regedit?

Commented:
Yes, reboot but first.... (Honestly, it is probably not necessary but is it Windows....)
Also make sure you are in the Enterprise Administrators Group as well and register the Schema managment DLL... (You do have to reboot or at least log off and back in for permissions changes to be appied)
By default the Schema Master MMC is disabled. One has to register the SCHMMGMT.DLL before the Schema can be moved, transferred or managed in any way.

To register SCHMMGMT.DLL…
1.      Start a command prompt. (Start, Run, type CMD, press ENTER)
2.      Change prompt to C: by typing C: and pressing enter. (Command should be run from root of C:)
3.      Type this command
 “REGSVR32.EXE WINNT\SYSTEM32\SCHMMGMT.DLL”
without the quotes, then press enter.
4.      You will get a dialog box indicating success. Click OK. If not, verify syntax of command & try again.
5.      Exit the command prompt window.

Commented:
Go here and check thos out....

http://support.microsoft.com/?id=293783

Commented:
Go here and check THIS out....

http://support.microsoft.com/?id=293783

Author

Commented:
Thanks cocroftc. I tried that hotfix earlier with no luck. I will have to wait a little while until I can reboot this server but I will get right back to this post once I am able to. Thank you!

Commented:
Try running that hotfix again after registering DLL, making REG change, etc.  Until these steps are completed the Schema is locked down so the hotfix may not have been effective...

Author

Commented:
OK still no luck guys, I called Microsoft in and am currently waiting for a call back when/if the issue is resolved I will post the solution. I appreciate everyone's help.

Author

Commented:
Update:

They have tried a few things with no luck, later on today we are doing a System State Restore then trying again...well...I'm not doing much, they are but you get the point.

What they tried to do is go in and manually change Schema attributes. They went into a few different screens that I haven't seen or heard of before (ldp.exe and ldifde).

They did add a regedit, but it was the same one cocroftc suggested.

I'll keep everyone updated. This might help someone else one of these days.
AwinishSenior Solution Architect

Commented:
Great WindhamSD: & its appreciated who cares for others learning & believe in sharing the knowledge..Great man.

Author

Commented:
You guys are doing the same! Thank You.

Author

Commented:
OK, problem has been solved, I am waiting for an email from Microsoft describing the issue before I respond with what solved it in case I miss anything.

Commented:
Good for you.  Looking forward to your answer.  I have a great interest in this as we are soon to extend our Schema for a third party app and also soon to extend Schema to deploy Server2008 in our Active Directory Domain/Forest. Not real keen on extending Schema for a third party app but I have no choice...

Author

Commented:
OK here you go guys-


PROBLEM   when doing adprep forest prep, it continually fails
 
RESOLUTION:  
 
+we had an issue where we were unable to run adprep and extend the schema.

+ tried to install hotfix http://support.microsoft.com/kb/919938 , it did not help , still got the same error while running adprep.

+ We tried to restore a previous system state backup
+ Authoritative restore of schema was also done and with disabled .
+ We found that  it was failing for the same error
+ Checked the schema and found that "x500uniqueIdentifier"  is listed in schema
+ Tried to match the attribute once more but it failed for attributeid
+ We found that Domain Functional level is  still mixed 2000
+ we tried to raise it to windows 2003 but it failed with error that server is busy
+  we enabled the outbound replication but again it failed with same error
+ later  we enabled both inbound and outbound replication .
+  After enabling we found that domain functional level got raised to windows 2003 automatically
+  we checked the schema attribute and found that CN=OldunixIDWithDupOID  came back in schema
+ isdefunct was set to true as we did in last troubleshooting before restore .
+ Changed it to false and tried to changed the Attributeid and ldapdisplayname  but it failed to modify
+ We tried to match all the attribute as Schema level 18
+ Later we used modifydn instead using modify and modified the DN of the attribute CN=OldunixIDWithDupOID to CN=x500uniqueIdentifier.
+ After this all attribute were checked and were verified as they should be in schema 18
+ Adprep was tried and succeeded  
+ helped you in promotion of new windows 2003 r2 server as DC and it went smoothly.
+ you the replication and reported no error
+ issue was resolved.
Based on our last conversation, I am closing your case 110071446893273.
 
If your issue has recurred or you are not satisfied with any aspect of this case, please let me know as soon as possible.  
 
Thank you for choosing Microsoft
 
 
Related Articles
 
technet.microsoft.com/en-us/library/cc782481(WS.10).aspx

Thanks again for all your help.

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.