Solved

Adprep /rodc prep will not run on Windows Server 2003

Posted on 2012-03-13
14
794 Views
Last Modified: 2013-04-22
I am adding in a new DC (Windows Server 2008 64 Bit SP1). The current DC (controls everything) is Windows Server 2003 SP2. When I ran adprep and all of the commands worked except adprep /rodcprep. I get errors stating: LDAP 0x0, partition skipped and that the current user needs to be part of the Enterprise Admins Group, which it is. I have already done all of the steps from technet/microsoft/petri; such as removing a bad/old DC through metadata cleanup, cleaning out the DNS records of the server.

Any way to get this to run correctly?
0
Comment
Question by:jlyles13
  • 7
  • 5
14 Comments
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37716876
In order to use a RODC, you need at least 1 writeable W2K8 DC
Check the section "Are there any special considerations?"
http://technet.microsoft.com/en-us/library/cc732801(v=ws.10).aspx
0
 

Author Comment

by:jlyles13
ID: 37720238
The domain function level is set to its highest. How do i make atleast 1 writeable W2K8 DC?
0
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37720247
Install a normal Windows 2008 DC.
0
 

Author Comment

by:jlyles13
ID: 37720306
We already have one 2008 Enterprise 64bit server with all of the roles on it in place and is a DC. The new one we have is currently in place and is 2008 Standard R2 64bit, which is the one not taking rodc since the 2003 server isn't running adprep /rodcprep.
0
 

Author Comment

by:jlyles13
ID: 37721354
THIS IS MY ERROR BELOW WHEN I RUN ADPREP /RODCPREP


2012/03/14:13:17:25.296]
Adprep created the log file ADPrep.log under C:\WINDOWS\debug\adprep\logs\20120314131725 directory.
[2012/03/14:13:17:25.312]
Adprep connected to the domain FSMO: oos-exchange.OOA.Local.com.
[2012/03/14:13:17:25.312]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is (null).
[2012/03/14:13:17:25.312]
LDAP API ldap_search_s() finished, return code is 0x0
[2012/03/14:13:17:25.312]
Adprep successfully retrieved information from the local Active Directory Domain Services.
[2012/03/14:13:17:25.328]
Adprep successfully initialized global variables.

[Status/Consequence]

Adprep is continuing.
[2012/03/14:13:17:25.328]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Partitions,CN=Configuration,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.328]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/14:13:17:25.328]
==============================================================================

Adprep found partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com, and is about to update the permissions.
[2012/03/14:13:17:25.343]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Infrastructure,DC=ForestDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.343]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/14:13:17:25.343]
Adprep could not contact a replica for partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.359]
Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
[2012/03/14:13:17:25.375]
Adprep failed the operation on partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com. Skipping to next partition.

==============================================================================
[2012/03/14:13:17:25.375]
==============================================================================

Adprep found partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com, and is about to update the permissions.
[2012/03/14:13:17:25.390]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Infrastructure,DC=DomainDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.390]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/14:13:17:25.390]
Adprep could not contact a replica for partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.406]
Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
[2012/03/14:13:17:25.406]
Adprep failed the operation on partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com. Skipping to next partition.

==============================================================================
[2012/03/14:13:17:25.421]
Adprep detected the operation on partition DC=OOA,DC=Local,DC=com has been performed. Skipping to next partition.

==============================================================================
[2012/03/14:13:17:25.437]
Adprep completed with errors. Not all partitions are updated. See the ADPrep.log in the C:\WINDOWS\debug\adprep\logs\20120314131725 directory for more information.



To successfully update all partititions, the current logged on user needs to be a member of Enterprise Admins group.  If that is not the case, please correct the problem, and then restart Adprep.
0
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37723544
You always run your ADPREP commands on the DC that holds the FSMO roles.
So run them on the Win2K8 server and see if you get any errors.

If it's in the same domain then you should be seeing the partition on both DC's.
Are your DC's replicating?
Are you running Windows DNS?
Is it AD Integrated?
Can you post the a copy of the adprep.log file mentioned above?
0
Do email signature updates give you a headache?

Do you feel like you are constantly making changes to email signatures? Are the images not formatting how you want them to? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today.

 

Author Comment

by:jlyles13
ID: 37724273
Okay, I will run adprep on the Win2k8 server, but should I transfer all FSMO roles to that server first? The 2003 server is currently holding all FMSO roles.
0
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37724497
You need to move the FSMO roles to the Windows 2008 DC as well or you will find that some groups are missing.

Question
Is it ok to have FSMO roles running on a mixture of operating systems? For example, a PDC Emulator on Windows Server 2003 and a Schema Master on Windows Server 2008?

Answer
Yes, it’s generally ok. The main issue people typically run into is that the PDCE is used to create special groups by certain components and if the PDC is not at that component’s OS level, the groups will not be created.

For example, these groups will not get created until the PDCE role moves to a Win2008 or later DC:

http://blogs.technet.com/b/askds/archive/2010/08/13/friday-mail-sack-mostly-edge-case-edition.aspx#fsmo

If these groups are not created properly then you'll not be able to use some of the 2008 specific functionality.

FSMO roles placement recommendation is that the roles are held on the server with the best hard. It's in the link http://support.microsoft.com/kb/223346

I agree with the general rule of splitting FSMO roles, but if you're a small organization then it's not always practical or neccessary. The idea of splitting FSMO roles is to spread the load/amount of work performed by each server. Of the 5 FSMO roles, the PDCe is the most critical.
0
 

Author Comment

by:jlyles13
ID: 37727489
Ok, thank you. I will give this a go as soon as I have the time and let you know how it works out.
0
 

Author Comment

by:jlyles13
ID: 37735720
I moved all FSMO roles to the new server 2008 DC. I had to run dcpromo in order to add some of the roles so when i ran dcpromo i chose to not install rodcprep since what we were working on was running rodcprep in the first place. This was the log I got when i transferred all of the fsmo roles to the new 2008 DC and ran /rodcprep.



[2012/03/18:19:04:44.692]
Adprep created the log file ADPrep.log under C:\Windows\debug\adprep\logs\20120318190444 directory.
[2012/03/18:19:04:44.724]
Adprep connected to the domain FSMO: OOA-Exchange.OOA.Local.com.
[2012/03/18:19:04:44.724]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is (null).
[2012/03/18:19:04:44.724]
LDAP API ldap_search_s() finished, return code is 0x0
[2012/03/18:19:04:44.724]
Adprep successfully retrieved information from the local Active Directory Domain Services.
[2012/03/18:19:04:44.724]
Adprep successfully initialized global variables.

[Status/Consequence]

Adprep is continuing.
[2012/03/18:19:04:44.724]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Partitions,CN=Configuration,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.739]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/18:19:04:44.739]
==============================================================================

Adprep found partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com, and is about to update the permissions.
[2012/03/18:19:04:44.739]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Infrastructure,DC=ForestDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.739]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/18:19:04:44.755]
Adprep could not contact a replica for partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.755]
Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
[2012/03/18:19:04:44.770]
Adprep failed the operation on partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com. Skipping to next partition.

==============================================================================
[2012/03/18:19:04:44.802]
==============================================================================

Adprep found partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com, and is about to update the permissions.
[2012/03/18:19:04:44.802]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Infrastructure,DC=DomainDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.802]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/18:19:04:44.802]
Adprep could not contact a replica for partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.817]
Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
[2012/03/18:19:04:44.833]
Adprep failed the operation on partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com. Skipping to next partition.

==============================================================================
[2012/03/18:19:04:44.833]
Adprep detected the operation on partition DC=OOA,DC=Local,DC=com has been performed. Skipping to next partition.

==============================================================================
[2012/03/18:19:04:44.864]
Adprep completed with errors. Not all partitions are updated. See the ADPrep.log in the C:\Windows\debug\adprep\logs\20120318190444 directory for more information.



To successfully update all partititions, the current logged on user needs to be a member of Enterprise Admins group.  If that is not the case, please correct the problem, and then restart Adprep.
0
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37736437
Are you an Enterprise Admin?
0
 

Author Comment

by:jlyles13
ID: 37739660
Yes, I am logged in as an Enterprise Admin.
0
 
LVL 15

Accepted Solution

by:
GreatVargas earned 500 total points
ID: 37781890
Are you schema admin as well?
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

A quick step-by-step overview of installing and configuring Carbonite Server Backup.
New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now