Solved

Adprep /rodc prep will not run on Windows Server 2003

Posted on 2012-03-13
14
805 Views
Last Modified: 2013-04-22
I am adding in a new DC (Windows Server 2008 64 Bit SP1). The current DC (controls everything) is Windows Server 2003 SP2. When I ran adprep and all of the commands worked except adprep /rodcprep. I get errors stating: LDAP 0x0, partition skipped and that the current user needs to be part of the Enterprise Admins Group, which it is. I have already done all of the steps from technet/microsoft/petri; such as removing a bad/old DC through metadata cleanup, cleaning out the DNS records of the server.

Any way to get this to run correctly?
0
Comment
Question by:jlyles13
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 5
14 Comments
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37716876
In order to use a RODC, you need at least 1 writeable W2K8 DC
Check the section "Are there any special considerations?"
http://technet.microsoft.com/en-us/library/cc732801(v=ws.10).aspx
0
 

Author Comment

by:jlyles13
ID: 37720238
The domain function level is set to its highest. How do i make atleast 1 writeable W2K8 DC?
0
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37720247
Install a normal Windows 2008 DC.
0
NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

 

Author Comment

by:jlyles13
ID: 37720306
We already have one 2008 Enterprise 64bit server with all of the roles on it in place and is a DC. The new one we have is currently in place and is 2008 Standard R2 64bit, which is the one not taking rodc since the 2003 server isn't running adprep /rodcprep.
0
 

Author Comment

by:jlyles13
ID: 37721354
THIS IS MY ERROR BELOW WHEN I RUN ADPREP /RODCPREP


2012/03/14:13:17:25.296]
Adprep created the log file ADPrep.log under C:\WINDOWS\debug\adprep\logs\20120314131725 directory.
[2012/03/14:13:17:25.312]
Adprep connected to the domain FSMO: oos-exchange.OOA.Local.com.
[2012/03/14:13:17:25.312]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is (null).
[2012/03/14:13:17:25.312]
LDAP API ldap_search_s() finished, return code is 0x0
[2012/03/14:13:17:25.312]
Adprep successfully retrieved information from the local Active Directory Domain Services.
[2012/03/14:13:17:25.328]
Adprep successfully initialized global variables.

[Status/Consequence]

Adprep is continuing.
[2012/03/14:13:17:25.328]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Partitions,CN=Configuration,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.328]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/14:13:17:25.328]
==============================================================================

Adprep found partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com, and is about to update the permissions.
[2012/03/14:13:17:25.343]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Infrastructure,DC=ForestDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.343]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/14:13:17:25.343]
Adprep could not contact a replica for partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.359]
Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
[2012/03/14:13:17:25.375]
Adprep failed the operation on partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com. Skipping to next partition.

==============================================================================
[2012/03/14:13:17:25.375]
==============================================================================

Adprep found partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com, and is about to update the permissions.
[2012/03/14:13:17:25.390]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Infrastructure,DC=DomainDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.390]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/14:13:17:25.390]
Adprep could not contact a replica for partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/14:13:17:25.406]
Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
[2012/03/14:13:17:25.406]
Adprep failed the operation on partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com. Skipping to next partition.

==============================================================================
[2012/03/14:13:17:25.421]
Adprep detected the operation on partition DC=OOA,DC=Local,DC=com has been performed. Skipping to next partition.

==============================================================================
[2012/03/14:13:17:25.437]
Adprep completed with errors. Not all partitions are updated. See the ADPrep.log in the C:\WINDOWS\debug\adprep\logs\20120314131725 directory for more information.



To successfully update all partititions, the current logged on user needs to be a member of Enterprise Admins group.  If that is not the case, please correct the problem, and then restart Adprep.
0
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37723544
You always run your ADPREP commands on the DC that holds the FSMO roles.
So run them on the Win2K8 server and see if you get any errors.

If it's in the same domain then you should be seeing the partition on both DC's.
Are your DC's replicating?
Are you running Windows DNS?
Is it AD Integrated?
Can you post the a copy of the adprep.log file mentioned above?
0
 

Author Comment

by:jlyles13
ID: 37724273
Okay, I will run adprep on the Win2k8 server, but should I transfer all FSMO roles to that server first? The 2003 server is currently holding all FMSO roles.
0
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37724497
You need to move the FSMO roles to the Windows 2008 DC as well or you will find that some groups are missing.

Question
Is it ok to have FSMO roles running on a mixture of operating systems? For example, a PDC Emulator on Windows Server 2003 and a Schema Master on Windows Server 2008?

Answer
Yes, it’s generally ok. The main issue people typically run into is that the PDCE is used to create special groups by certain components and if the PDC is not at that component’s OS level, the groups will not be created.

For example, these groups will not get created until the PDCE role moves to a Win2008 or later DC:

http://blogs.technet.com/b/askds/archive/2010/08/13/friday-mail-sack-mostly-edge-case-edition.aspx#fsmo

If these groups are not created properly then you'll not be able to use some of the 2008 specific functionality.

FSMO roles placement recommendation is that the roles are held on the server with the best hard. It's in the link http://support.microsoft.com/kb/223346

I agree with the general rule of splitting FSMO roles, but if you're a small organization then it's not always practical or neccessary. The idea of splitting FSMO roles is to spread the load/amount of work performed by each server. Of the 5 FSMO roles, the PDCe is the most critical.
0
 

Author Comment

by:jlyles13
ID: 37727489
Ok, thank you. I will give this a go as soon as I have the time and let you know how it works out.
0
 

Author Comment

by:jlyles13
ID: 37735720
I moved all FSMO roles to the new server 2008 DC. I had to run dcpromo in order to add some of the roles so when i ran dcpromo i chose to not install rodcprep since what we were working on was running rodcprep in the first place. This was the log I got when i transferred all of the fsmo roles to the new 2008 DC and ran /rodcprep.



[2012/03/18:19:04:44.692]
Adprep created the log file ADPrep.log under C:\Windows\debug\adprep\logs\20120318190444 directory.
[2012/03/18:19:04:44.724]
Adprep connected to the domain FSMO: OOA-Exchange.OOA.Local.com.
[2012/03/18:19:04:44.724]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is (null).
[2012/03/18:19:04:44.724]
LDAP API ldap_search_s() finished, return code is 0x0
[2012/03/18:19:04:44.724]
Adprep successfully retrieved information from the local Active Directory Domain Services.
[2012/03/18:19:04:44.724]
Adprep successfully initialized global variables.

[Status/Consequence]

Adprep is continuing.
[2012/03/18:19:04:44.724]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Partitions,CN=Configuration,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.739]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/18:19:04:44.739]
==============================================================================

Adprep found partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com, and is about to update the permissions.
[2012/03/18:19:04:44.739]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Infrastructure,DC=ForestDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.739]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/18:19:04:44.755]
Adprep could not contact a replica for partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.755]
Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
[2012/03/18:19:04:44.770]
Adprep failed the operation on partition DC=ForestDnsZones,DC=OOA,DC=Local,DC=com. Skipping to next partition.

==============================================================================
[2012/03/18:19:04:44.802]
==============================================================================

Adprep found partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com, and is about to update the permissions.
[2012/03/18:19:04:44.802]
Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=Infrastructure,DC=DomainDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.802]
LDAP API ldap_search_s finished, return code is 0x0
[2012/03/18:19:04:44.802]
Adprep could not contact a replica for partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com.
[2012/03/18:19:04:44.817]
Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).
[2012/03/18:19:04:44.833]
Adprep failed the operation on partition DC=DomainDnsZones,DC=OOA,DC=Local,DC=com. Skipping to next partition.

==============================================================================
[2012/03/18:19:04:44.833]
Adprep detected the operation on partition DC=OOA,DC=Local,DC=com has been performed. Skipping to next partition.

==============================================================================
[2012/03/18:19:04:44.864]
Adprep completed with errors. Not all partitions are updated. See the ADPrep.log in the C:\Windows\debug\adprep\logs\20120318190444 directory for more information.



To successfully update all partititions, the current logged on user needs to be a member of Enterprise Admins group.  If that is not the case, please correct the problem, and then restart Adprep.
0
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37736437
Are you an Enterprise Admin?
0
 

Author Comment

by:jlyles13
ID: 37739660
Yes, I am logged in as an Enterprise Admin.
0
 
LVL 15

Accepted Solution

by:
GreatVargas earned 500 total points
ID: 37781890
Are you schema admin as well?
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Background Information Recently I have fixed file server permission issues for one of my client. The client has 1800 users and one Windows Server 2008 R2 domain joined file server with 12 TB of data, 250+ shared folders and the folder structure i…
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question