• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 901
  • Last Modified:

Adprep /rodc prep will not run on Windows Server 2003

I am adding in a new DC (Windows Server 2008 64 Bit SP1). The current DC (controls everything) is Windows Server 2003 SP2. When I ran adprep and all of the commands worked except adprep /rodcprep. I get errors stating: LDAP 0x0, partition skipped and that the current user needs to be part of the Enterprise Admins Group, which it is. I have already done all of the steps from technet/microsoft/petri; such as removing a bad/old DC through metadata cleanup, cleaning out the DNS records of the server.

Any way to get this to run correctly?
0
jlyles13
Asked:
jlyles13
  • 7
  • 5
1 Solution
 
Leon FesterSenior Solutions ArchitectCommented:
In order to use a RODC, you need at least 1 writeable W2K8 DC
Check the section "Are there any special considerations?"
http://technet.microsoft.com/en-us/library/cc732801(v=ws.10).aspx
0
 
jlyles13Author Commented:
The domain function level is set to its highest. How do i make atleast 1 writeable W2K8 DC?
0
 
Leon FesterSenior Solutions ArchitectCommented:
Install a normal Windows 2008 DC.
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
jlyles13Author Commented:
We already have one 2008 Enterprise 64bit server with all of the roles on it in place and is a DC. The new one we have is currently in place and is 2008 Standard R2 64bit, which is the one not taking rodc since the 2003 server isn't running adprep /rodcprep.
0
 
jlyles13Author Commented:
THIS IS MY ERROR BELOW WHEN I RUN ADPREP /RODCPREP


2012/03/14:13:17:25.296]
Adprep created the log file ADPrep.log under C:\WINDOWS\debug\adprep\logs\20120314131725 directory.
[2012/03/14:13:17:25.312]
Adprep connected to the domain FSMO: oos-exchange.OOA.Local.com.
[2012/03/14:13:17:25.312]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is (null).
[2012/03/14:13:17:25.312]
LDAP API ldap_search_s() finished, return code is 0x0
[2012/03/14:13:17:25.312]
Adprep successfully retrieved information from the local Active Directory Domain Services.
[2012/03/14:13:17:25.328]
Adprep successfully initialized global variables.

[Status/Consequence]

Adprep is continuing.
[2012/03/14:13:17:25.328]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Partitions,CN=Configuration,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.328]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/14:13:17:25.328]
==============================================================================

Adprep found partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com, and is about to update the permissions.
[2012/03/14:13:17:25.343]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Infrastructure,DC=ForestDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.343]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/14:13:17:25.343]
Adprep could not contact a replica for partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.359]
Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
[2012/03/14:13:17:25.375]
Adprep failed the operation on partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com. Skipping to next partition.

==============================================================================
[2012/03/14:13:17:25.375]
==============================================================================

Adprep found partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com, and is about to update the permissions.
[2012/03/14:13:17:25.390]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Infrastructure,DC=DomainDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.390]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/14:13:17:25.390]
Adprep could not contact a replica for partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.406]
Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
[2012/03/14:13:17:25.406]
Adprep failed the operation on partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com. Skipping to next partition.

==============================================================================
[2012/03/14:13:17:25.421]
Adprep detected the operation on partition DC=OOA,DC=Local,DC=com has been performed. Skipping to next partition.

==============================================================================
[2012/03/14:13:17:25.437]
Adprep completed with errors. Not all partitions are updated. See the ADPrep.log in the C:\WINDOWS\debug\adprep\logs\20120314131725 directory for more information.



To successfully update all partititions, the current logged on user needs to be a member of Enterprise Admins group.  If that is not the case, please correct the problem, and then restart Adprep.
0
 
Leon FesterSenior Solutions ArchitectCommented:
You always run your ADPREP commands on the DC that holds the FSMO roles.
So run them on the Win2K8 server and see if you get any errors.

If it's in the same domain then you should be seeing the partition on both DC's.
Are your DC's replicating?
Are you running Windows DNS?
Is it AD Integrated?
Can you post the a copy of the adprep.log file mentioned above?
0
 
jlyles13Author Commented:
Okay, I will run adprep on the Win2k8 server, but should I transfer all FSMO roles to that server first? The 2003 server is currently holding all FMSO roles.
0
 
Leon FesterSenior Solutions ArchitectCommented:
You need to move the FSMO roles to the Windows 2008 DC as well or you will find that some groups are missing.

Question
Is it ok to have FSMO roles running on a mixture of operating systems? For example, a PDC Emulator on Windows Server 2003 and a Schema Master on Windows Server 2008?

Answer
Yes, it’s generally ok. The main issue people typically run into is that the PDCE is used to create special groups by certain components and if the PDC is not at that component’s OS level, the groups will not be created.

For example, these groups will not get created until the PDCE role moves to a Win2008 or later DC:

http://blogs.technet.com/b/askds/archive/2010/08/13/friday-mail-sack-mostly-edge-case-edition.aspx#fsmo

If these groups are not created properly then you'll not be able to use some of the 2008 specific functionality.

FSMO roles placement recommendation is that the roles are held on the server with the best hard. It's in the link http://support.microsoft.com/kb/223346

I agree with the general rule of splitting FSMO roles, but if you're a small organization then it's not always practical or neccessary. The idea of splitting FSMO roles is to spread the load/amount of work performed by each server. Of the 5 FSMO roles, the PDCe is the most critical.
0
 
jlyles13Author Commented:
Ok, thank you. I will give this a go as soon as I have the time and let you know how it works out.
0
 
jlyles13Author Commented:
I moved all FSMO roles to the new server 2008 DC. I had to run dcpromo in order to add some of the roles so when i ran dcpromo i chose to not install rodcprep since what we were working on was running rodcprep in the first place. This was the log I got when i transferred all of the fsmo roles to the new 2008 DC and ran /rodcprep.



[2012/03/18:19:04:44.692]
Adprep created the log file ADPrep.log under C:\Windows\debug\adprep\logs\20120318190444 directory.
[2012/03/18:19:04:44.724]
Adprep connected to the domain FSMO: OOA-Exchange.OOA.Local.com.
[2012/03/18:19:04:44.724]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is (null).
[2012/03/18:19:04:44.724]
LDAP API ldap_search_s() finished, return code is 0x0
[2012/03/18:19:04:44.724]
Adprep successfully retrieved information from the local Active Directory Domain Services.
[2012/03/18:19:04:44.724]
Adprep successfully initialized global variables.

[Status/Consequence]

Adprep is continuing.
[2012/03/18:19:04:44.724]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Partitions,CN=Configuration,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.739]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/18:19:04:44.739]
==============================================================================

Adprep found partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com, and is about to update the permissions.
[2012/03/18:19:04:44.739]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Infrastructure,DC=ForestDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.739]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/18:19:04:44.755]
Adprep could not contact a replica for partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.755]
Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
[2012/03/18:19:04:44.770]
Adprep failed the operation on partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com. Skipping to next partition.

==============================================================================
[2012/03/18:19:04:44.802]
==============================================================================

Adprep found partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com, and is about to update the permissions.
[2012/03/18:19:04:44.802]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Infrastructure,DC=DomainDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.802]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/18:19:04:44.802]
Adprep could not contact a replica for partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.817]
Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
[2012/03/18:19:04:44.833]
Adprep failed the operation on partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com. Skipping to next partition.

==============================================================================
[2012/03/18:19:04:44.833]
Adprep detected the operation on partition DC=OOA,DC=Local,DC=com has been performed. Skipping to next partition.

==============================================================================
[2012/03/18:19:04:44.864]
Adprep completed with errors. Not all partitions are updated. See the ADPrep.log in the C:\Windows\debug\adprep\logs\20120318190444 directory for more information.



To successfully update all partititions, the current logged on user needs to be a member of Enterprise Admins group.  If that is not the case, please correct the problem, and then restart Adprep.
0
 
Leon FesterSenior Solutions ArchitectCommented:
Are you an Enterprise Admin?
0
 
jlyles13Author Commented:
Yes, I am logged in as an Enterprise Admin.
0
 
Antonio VargasMicrosoft Senior Cloud ConsultantCommented:
Are you schema admin as well?
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: Ruby Fundamentals

This course will introduce you to Ruby, as well as teach you about classes, methods, variables, data structures, loops, enumerable methods, and finishing touches.

  • 7
  • 5
Tackle projects and never again get stuck behind a technical roadblock.
Join Now