Link to home
Start Free TrialLog in
Avatar of WindhamSD
WindhamSDFlag for United States of America

asked on

ADPREP /forestprep Fails, x500uniqueIdentifier

Hello,

I have been trying to prep my domain so I can add server 2003 R2 and Server 2008 boxes to the domain. The current domain function level is Windows 2000 Mixed. All of our DC's are now 2003 Service Pack 2. I have a few more servers that I need to join the domain that will be 2003 R2 and possible a 2008 server. So I copied the ADPREP folder from my 2003 R2 disk to the c:/ of the server that holds all of the FSMO roles for the domain. When I run adprep /forestprep I get a failure message..well actually two:

"lDAPDisplayName" attribute value for objects defined in Windows 2000
schema and
 extended schema do not match.


A previous schema extension has defined the attribute value as
"OldunixIDWithDup
OID" for object
"CN=x500uniqueIdentifier,CN=Schema,CN=Configuration,DC=windhamsd
,DC=org" differently than the schema extension needed for Windows 2003
server .
[Status/Consequence]
Adprep cannot extend your existing schema
[User Action]
Contact the vendor of the application that previously extended the schema
to res
olve the inconsistency. Then run adprep again.




=============================================================================
"isSingleValued" attribute value for objects defined in Windows 2000
schema and
extended schema do not match.


A previous schema extension has defined the attribute value as "TRUE" for
object
 "CN=x500uniqueIdentifier,CN=Schema,CN=Configuration,DC=windhamsd,DC=org" differently than the schema extension needed for Windows 2003 server .
[Status/Consequence]
Adprep cannot extend your existing schema
[User Action]
Contact the vendor of the application that previously extended the schema
to res
olve the inconsistency. Then run adprep again.

Now the top one was from earlier attempts at fixing the issue, the bottom was was the origional issue. I saw a post that said to do a regedit then change the value to FALSE but honestly doing ADSI and things of that nature go over my head and I am timid when it comes to setting registry entries on DC's. The regedit being:

HKLM\system\CurrentControlSet\Services\NTDS\Parameters
Value Name: Schema Update Allowed
Value Type: REG_DWORD
Value Data:1

So here is where my question comes in. Does anyone know how to remedy this issue? And what does this really mean?

I really don't want to have to create a whole new domain and start from scratch, that would be miserable. I did try to fix this one time before on EE but I was pulled off the task and the question became stale, but now I have no choice but to fix this issue. I appreciate any help offered.

I attached all the info from my previous post so you know what I have already tried. It is very long (72 pages) but it may help.

Thank You.

adprep-fails.doc
SOLUTION
Avatar of dhruvarajp
dhruvarajp
Flag of India image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Do you have exchange server also & if yes try below link.

http://support.microsoft.com/kb/917385

http://www.petri.co.il/windows_2003_adprep_fix_for_e2k.htm

You need to follow above article.

Please let me know domain & forest functional level of your domain along with Exchange version.

If all the dc is windows 2003 then raise the domain functional level mim to windows 2003 atleast.

Note: member server will work of windows 2000 but windows 2000 server can't be domain controller if you raise the forest domain functional level & it can't be reverted also if raised & it require system state backup if you want to go back to previous domain functional level.
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of WindhamSD

ASKER

Thank You for the responses.

When I go to download the hotfix it only has the ia64 platform and I am running x86..I don't know why this is, considering the document says that there is 32 bit version. If you click on the link for the download you will see what I mean.

I am not running Exchange in the domain, thank god, do you have to restart the DC if you raise the function level? Currently we have no Server 2000 machines anywhere in our district.

Thanks again guys.

No,you don't require reboot.
I am doing a system state backup right now before I raise the function level. Have you guys had this issue before?
No,but its good to take the system state backup.

Please share the other info i asked.
Oh yea,

Also, is there a way to force the change to the other DC's so I don't have to wait for replication?
Sorry about that Awinish the Forest is Windows 2000 and the domain is 2000 mixed. It does say that I cannot raise the forest function level because the domain level is 2000. And no Exchange here.
repadmin /syncall /A/E/P/D


You have to raise domain functional level first then forest functional level.
OK the raise of domain function level was successful is it OK to do the Forest immediately as well...sorry for the play by play response it just makes me more comfortable.
Its not mandatory but you can raise that too.
Thank You,

So I haven't raise the forest just yet..but the domain is up to 2003. What do you suggest I do next?

Thank you for all your time.
Just give a try & make sure its replicated & try to run below solution & see if it works.

http://www-01.ibm.com/support/docview.wss?uid=swg21351171

Did you install any application which modified the schema?


Interesting question Awinish,

This is a new network to me I have only been here for a year. Supposedly they called in Microsoft once to fix an issue, unsure if it's related but it is possible that at one point in time Unix extensions were made or something was installed to get Macs to talk to Active Directory (which we don't use at this current time). So the short answer is that I didn't install an application but it is very possible that something was installed but it probably is not being used now..and if it is I'll deal with that later.
Yes, i have read it somewhere & that is causing the issue to extend the schema & the value has to be removed. Give a try to article i posted & if it doesn't resolve your issue, contact MS coz fiddling with schema is not the way & it might damage AD.
ok.. i am not sure if you will be able to adprep without tha hotfix. you can give it a try
as far i know last time i did this i did not have to raise the functional level. i mean i did not check if i was already raised
as far as i know mixed mode can have from 2000 to 2003R2 dcs.. may be awinish can throw some light on it

if adprep fails
you might want to have a word with microsoft pss if you are unable to  get that hotfix


Good info guys,

I too did see that article Awinish. How do you think they chenged the attribute after when they said this:

"Once we created that, we were able to change the attributes without trouble and run "adprep /forestprep"

Do you think it was ADSI?
Also when I typed in repadmin /syncall /A/E/P/D

I recieved an invalid command line prompt
I did try the KB919938 article before with no luck.
OK so just tried the adprep after replicating and no luck I am currently trying to aquire the hotfix, if that doesn't work I will try the regedit
dhruvarajp:Raising the functional level has no affect on error since there is no windows 2000 so i thought raising it to get the added atleast feature of windows 2003.
Secondly if there is any stale dc of windows 2000(which is not removed properly) will give error while raising the domain functional level.

The KB posted by dhruvarajp: will not help as it is for windows 2003 Sp1 & author has SP2.

The problem is the schema extension which is caused by linux & that attribute is not able to modified so i don't know how it was done,so i asked for MS help on this as they have specialist who do schema modification but WindhamSD:give a try to article i posted in last & i think will make it work.


Check the link & i think its same where schema extension has been performed for linux.

http://www.winserverkb.com/Uwe/Forum.aspx/windows-server-ad/16033/Ntdsutil-to-remove-AD-attribute
hotfix is the recomended ans supported way.. you know..
you can always go back to microsoft and ask them to fix the bug if they have.. if we do not supported things they politely say "this scenario is not supported"

and they really allow less space when it comes things like Schema modifications

But since its MS concept & product they do it.

it has to be resolved if it can be & i think if they have done schema extension for linux then they have to resolve the issue.
Time to leave..Bye
Good info! So I added the Regedit:

In HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters, create the following value:
Value name: Allow System Only Change
Data type: REG_DWORD
Value data: 1

Then ran adprep /forestprep

It gave me the same error. I have a feeling that they did something before running adprep because of this line in the article:

Once we created that, we were able to change the attributes without trouble and run "adprep /forestprep" successfully.

The key words being "we were able to change the attricbutes without trouble AND run". I kind of think they made some change manually here...

Maybe I should call MS I'll have to contact my superior to see if that's a viable option.

Thanks again guys I will keep everyone posted and if you come up with any other ideas feel free to drop a line or two.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thank You cocroftc

I am using the standard Administrator user and I double checked that I am in the Schema Admins group but no success....Do I need to reboot after the regedit?
Avatar of cocroftc
cocroftc

Yes, reboot but first.... (Honestly, it is probably not necessary but is it Windows....)
Also make sure you are in the Enterprise Administrators Group as well and register the Schema managment DLL... (You do have to reboot or at least log off and back in for permissions changes to be appied)
By default the Schema Master MMC is disabled. One has to register the SCHMMGMT.DLL before the Schema can be moved, transferred or managed in any way.

To register SCHMMGMT.DLL…
1.      Start a command prompt. (Start, Run, type CMD, press ENTER)
2.      Change prompt to C: by typing C: and pressing enter. (Command should be run from root of C:)
3.      Type this command
 “REGSVR32.EXE WINNT\SYSTEM32\SCHMMGMT.DLL”
without the quotes, then press enter.
4.      You will get a dialog box indicating success. Click OK. If not, verify syntax of command & try again.
5.      Exit the command prompt window.
Go here and check thos out....

http://support.microsoft.com/?id=293783

Go here and check THIS out....

http://support.microsoft.com/?id=293783
Thanks cocroftc. I tried that hotfix earlier with no luck. I will have to wait a little while until I can reboot this server but I will get right back to this post once I am able to. Thank you!
Try running that hotfix again after registering DLL, making REG change, etc.  Until these steps are completed the Schema is locked down so the hotfix may not have been effective...
OK still no luck guys, I called Microsoft in and am currently waiting for a call back when/if the issue is resolved I will post the solution. I appreciate everyone's help.
Update:

They have tried a few things with no luck, later on today we are doing a System State Restore then trying again...well...I'm not doing much, they are but you get the point.

What they tried to do is go in and manually change Schema attributes. They went into a few different screens that I haven't seen or heard of before (ldp.exe and ldifde).

They did add a regedit, but it was the same one cocroftc suggested.

I'll keep everyone updated. This might help someone else one of these days.
Great WindhamSD: & its appreciated who cares for others learning & believe in sharing the knowledge..Great man.
You guys are doing the same! Thank You.
OK, problem has been solved, I am waiting for an email from Microsoft describing the issue before I respond with what solved it in case I miss anything.
Good for you.  Looking forward to your answer.  I have a great interest in this as we are soon to extend our Schema for a third party app and also soon to extend Schema to deploy Server2008 in our Active Directory Domain/Forest. Not real keen on extending Schema for a third party app but I have no choice...
OK here you go guys-


PROBLEM   when doing adprep forest prep, it continually fails
 
RESOLUTION:  
 
+we had an issue where we were unable to run adprep and extend the schema.

+ tried to install hotfix http://support.microsoft.com/kb/919938 , it did not help , still got the same error while running adprep.

+ We tried to restore a previous system state backup
+ Authoritative restore of schema was also done and with disabled .
+ We found that  it was failing for the same error
+ Checked the schema and found that "x500uniqueIdentifier"  is listed in schema
+ Tried to match the attribute once more but it failed for attributeid
+ We found that Domain Functional level is  still mixed 2000
+ we tried to raise it to windows 2003 but it failed with error that server is busy
+  we enabled the outbound replication but again it failed with same error
+ later  we enabled both inbound and outbound replication .
+  After enabling we found that domain functional level got raised to windows 2003 automatically
+  we checked the schema attribute and found that CN=OldunixIDWithDupOID  came back in schema
+ isdefunct was set to true as we did in last troubleshooting before restore .
+ Changed it to false and tried to changed the Attributeid and ldapdisplayname  but it failed to modify
+ We tried to match all the attribute as Schema level 18
+ Later we used modifydn instead using modify and modified the DN of the attribute CN=OldunixIDWithDupOID to CN=x500uniqueIdentifier.
+ After this all attribute were checked and were verified as they should be in schema 18
+ Adprep was tried and succeeded  
+ helped you in promotion of new windows 2003 r2 server as DC and it went smoothly.
+ you the replication and reported no error
+ issue was resolved.
Based on our last conversation, I am closing your case 110071446893273.
 
If your issue has recurred or you are not satisfied with any aspect of this case, please let me know as soon as possible.  
 
Thank you for choosing Microsoft
 
 
Related Articles
 
technet.microsoft.com/en-us/library/cc782481(WS.10).aspx

Thanks again for all your help.