FSMO role (schema) transfer error

I am trying to transfer all roles from our 2003 DC to the new 2008 DC because the 2003 AD seems to lock up once every month and no one can log on to the domain. I got all roles transferred except the Schema master. I keep getting a permission error.

- I am logged in as the administrator built in.
- I am a member of both enterprise admins and schema admin groups.

no one else seems to have any ideas of what is going wrong.

here is the error:

C:\Documents and Settings\Administrator>ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server server2
Binding to server2 ...
Connected to server2 using credentials of locally logged on user.
server connections: q
fsmo maintenance: transfer schema master
ldap_modify_sW error 0x32(50 (Insufficient Rights).
Ldap extended error message is 00002098: SecErr: DSID-0315211E, problem 4003 (IN
SUFF_ACCESS_RIGHTS), data 0

Win32 error returned is 0x2098(Insufficient access rights to perform the operati
on.)
)
Depending on the error code this may indicate a connection,
ldap, or role transfer error.
Server "server2" knows about 5 roles
Schema - CN=NTDS Settings,CN=SERVER1,CN=Servers,CN=Default-First-Site-Na
me,CN=Sites,CN=Configuration,DC=domain,DC=local
Domain - CN=NTDS Settings,CN=SERVER2,CN=Servers,CN=Default-First-Site-Na
me,CN=Sites,CN=Configuration,DC=domain,DC=local
PDC - CN=NTDS Settings,CN=SERVER2,CN=Servers,CN=Default-First-Site-Name,
CN=Sites,CN=Configuration,DC=domain,DC=local
RID - CN=NTDS Settings,CN=SERVER2,CN=Servers,CN=Default-First-Site-Name,
CN=Sites,CN=Configuration,DC=domain,DC=local
Infrastructure - CN=NTDS Settings,CN=SERVER2,CN=Servers,CN=Default-First
-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=local
fsmo maintenance:
raffie613Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Joe JenkinsCommented:
Try this:

From the 2008 DC:

- Run ntdsutil from a command prompt
- Type ROLES and then enter
- Type CO and then enter
- Type CO TO SERVER <your2008dcname> and then enter
- Type Q and then enter
- Type TRANS SC MA and then enter
- On the box asking you whether you want to transfer the schema FSMO to that DC, - click Yes
- Q and then enter
- Q and then enter

You can also do it from the GUI:
This article does a good job of showing you with images how to get this done.  Scroll down to where it says "Schema Master":
http://kpytko.pl/2011/08/26/transferring-fsmo-roles-from-gui/

I used this method recently and all went well.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
raffie613Author Commented:
I tried both these methods to transfer and got the results i posted initially. I am not aware of any other two methods to transfer the roles. Except i used the full words instead of CO and SC MA. Never got to the point of entering in Q afterwards.
0
raffie613Author Commented:
ok well even after i got those errors, about 10 hours later seems the change went though anyway. strange but now server 2 is showing up as schema master on both DC now.
Thanks
0
Joe JenkinsCommented:
Hmm. I was going to ask if the user you were using the utility as was part of the Schema Admins AD security group. That would yield that error.

Before you decommission that server make sure you run dcdiag and everything looks good. Just to be safe!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.