Solved

Adprep /rodc prep will not run on Windows Server 2003

Posted on 2012-03-13
14
796 Views
Last Modified: 2013-04-22
I am adding in a new DC (Windows Server 2008 64 Bit SP1). The current DC (controls everything) is Windows Server 2003 SP2. When I ran adprep and all of the commands worked except adprep /rodcprep. I get errors stating: LDAP 0x0, partition skipped and that the current user needs to be part of the Enterprise Admins Group, which it is. I have already done all of the steps from technet/microsoft/petri; such as removing a bad/old DC through metadata cleanup, cleaning out the DNS records of the server.

Any way to get this to run correctly?
0
Comment
Question by:jlyles13
  • 7
  • 5
14 Comments
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37716876
In order to use a RODC, you need at least 1 writeable W2K8 DC
Check the section "Are there any special considerations?"
http://technet.microsoft.com/en-us/library/cc732801(v=ws.10).aspx
0
 

Author Comment

by:jlyles13
ID: 37720238
The domain function level is set to its highest. How do i make atleast 1 writeable W2K8 DC?
0
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37720247
Install a normal Windows 2008 DC.
0
 

Author Comment

by:jlyles13
ID: 37720306
We already have one 2008 Enterprise 64bit server with all of the roles on it in place and is a DC. The new one we have is currently in place and is 2008 Standard R2 64bit, which is the one not taking rodc since the 2003 server isn't running adprep /rodcprep.
0
 

Author Comment

by:jlyles13
ID: 37721354
THIS IS MY ERROR BELOW WHEN I RUN ADPREP /RODCPREP


2012/03/14:13:17:25.296]
Adprep created the log file ADPrep.log under C:\WINDOWS\debug\adprep\logs\20120314131725 directory.
[2012/03/14:13:17:25.312]
Adprep connected to the domain FSMO: oos-exchange.OOA.Local.com.
[2012/03/14:13:17:25.312]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is (null).
[2012/03/14:13:17:25.312]
LDAP API ldap_search_s() finished, return code is 0x0
[2012/03/14:13:17:25.312]
Adprep successfully retrieved information from the local Active Directory Domain Services.
[2012/03/14:13:17:25.328]
Adprep successfully initialized global variables.

[Status/Consequence]

Adprep is continuing.
[2012/03/14:13:17:25.328]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Partitions,CN=Configuration,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.328]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/14:13:17:25.328]
==============================================================================

Adprep found partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com, and is about to update the permissions.
[2012/03/14:13:17:25.343]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Infrastructure,DC=ForestDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.343]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/14:13:17:25.343]
Adprep could not contact a replica for partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.359]
Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
[2012/03/14:13:17:25.375]
Adprep failed the operation on partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com. Skipping to next partition.

==============================================================================
[2012/03/14:13:17:25.375]
==============================================================================

Adprep found partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com, and is about to update the permissions.
[2012/03/14:13:17:25.390]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Infrastructure,DC=DomainDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.390]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/14:13:17:25.390]
Adprep could not contact a replica for partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.406]
Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
[2012/03/14:13:17:25.406]
Adprep failed the operation on partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com. Skipping to next partition.

==============================================================================
[2012/03/14:13:17:25.421]
Adprep detected the operation on partition DC=OOA,DC=Local,DC=com has been performed. Skipping to next partition.

==============================================================================
[2012/03/14:13:17:25.437]
Adprep completed with errors. Not all partitions are updated. See the ADPrep.log in the C:\WINDOWS\debug\adprep\logs\20120314131725 directory for more information.



To successfully update all partititions, the current logged on user needs to be a member of Enterprise Admins group.  If that is not the case, please correct the problem, and then restart Adprep.
0
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37723544
You always run your ADPREP commands on the DC that holds the FSMO roles.
So run them on the Win2K8 server and see if you get any errors.

If it's in the same domain then you should be seeing the partition on both DC's.
Are your DC's replicating?
Are you running Windows DNS?
Is it AD Integrated?
Can you post the a copy of the adprep.log file mentioned above?
0
Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

 

Author Comment

by:jlyles13
ID: 37724273
Okay, I will run adprep on the Win2k8 server, but should I transfer all FSMO roles to that server first? The 2003 server is currently holding all FMSO roles.
0
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37724497
You need to move the FSMO roles to the Windows 2008 DC as well or you will find that some groups are missing.

Question
Is it ok to have FSMO roles running on a mixture of operating systems? For example, a PDC Emulator on Windows Server 2003 and a Schema Master on Windows Server 2008?

Answer
Yes, it’s generally ok. The main issue people typically run into is that the PDCE is used to create special groups by certain components and if the PDC is not at that component’s OS level, the groups will not be created.

For example, these groups will not get created until the PDCE role moves to a Win2008 or later DC:

http://blogs.technet.com/b/askds/archive/2010/08/13/friday-mail-sack-mostly-edge-case-edition.aspx#fsmo

If these groups are not created properly then you'll not be able to use some of the 2008 specific functionality.

FSMO roles placement recommendation is that the roles are held on the server with the best hard. It's in the link http://support.microsoft.com/kb/223346

I agree with the general rule of splitting FSMO roles, but if you're a small organization then it's not always practical or neccessary. The idea of splitting FSMO roles is to spread the load/amount of work performed by each server. Of the 5 FSMO roles, the PDCe is the most critical.
0
 

Author Comment

by:jlyles13
ID: 37727489
Ok, thank you. I will give this a go as soon as I have the time and let you know how it works out.
0
 

Author Comment

by:jlyles13
ID: 37735720
I moved all FSMO roles to the new server 2008 DC. I had to run dcpromo in order to add some of the roles so when i ran dcpromo i chose to not install rodcprep since what we were working on was running rodcprep in the first place. This was the log I got when i transferred all of the fsmo roles to the new 2008 DC and ran /rodcprep.



[2012/03/18:19:04:44.692]
Adprep created the log file ADPrep.log under C:\Windows\debug\adprep\logs\20120318190444 directory.
[2012/03/18:19:04:44.724]
Adprep connected to the domain FSMO: OOA-Exchange.OOA.Local.com.
[2012/03/18:19:04:44.724]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is (null).
[2012/03/18:19:04:44.724]
LDAP API ldap_search_s() finished, return code is 0x0
[2012/03/18:19:04:44.724]
Adprep successfully retrieved information from the local Active Directory Domain Services.
[2012/03/18:19:04:44.724]
Adprep successfully initialized global variables.

[Status/Consequence]

Adprep is continuing.
[2012/03/18:19:04:44.724]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Partitions,CN=Configuration,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.739]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/18:19:04:44.739]
==============================================================================

Adprep found partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com, and is about to update the permissions.
[2012/03/18:19:04:44.739]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Infrastructure,DC=ForestDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.739]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/18:19:04:44.755]
Adprep could not contact a replica for partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.755]
Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
[2012/03/18:19:04:44.770]
Adprep failed the operation on partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com. Skipping to next partition.

==============================================================================
[2012/03/18:19:04:44.802]
==============================================================================

Adprep found partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com, and is about to update the permissions.
[2012/03/18:19:04:44.802]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Infrastructure,DC=DomainDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.802]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/18:19:04:44.802]
Adprep could not contact a replica for partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.817]
Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
[2012/03/18:19:04:44.833]
Adprep failed the operation on partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com. Skipping to next partition.

==============================================================================
[2012/03/18:19:04:44.833]
Adprep detected the operation on partition DC=OOA,DC=Local,DC=com has been performed. Skipping to next partition.

==============================================================================
[2012/03/18:19:04:44.864]
Adprep completed with errors. Not all partitions are updated. See the ADPrep.log in the C:\Windows\debug\adprep\logs\20120318190444 directory for more information.



To successfully update all partititions, the current logged on user needs to be a member of Enterprise Admins group.  If that is not the case, please correct the problem, and then restart Adprep.
0
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37736437
Are you an Enterprise Admin?
0
 

Author Comment

by:jlyles13
ID: 37739660
Yes, I am logged in as an Enterprise Admin.
0
 
LVL 15

Accepted Solution

by:
GreatVargas earned 500 total points
ID: 37781890
Are you schema admin as well?
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
A safe way to clean winsxs folder from your windows server 2008 R2 editions
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

930 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now