Solved

Error preparing forest domain on lync 2013

Posted on 2014-09-21
1
676 Views
Last Modified: 2014-09-22
I'm getting an error when doing step 3 of active directory prep. Im unsure what I did. I'm not really a windows guru but I have basic knowledge how it works.

Process permissions on "CN=CsPersistentChatAdministrator,CN=Users,DC=ad,DC=Domain, DC=com".   9/21/2014 1:05:43 PM    
     └    Create permissions for CN=RTC Service,CN=Services,CN=Configuration,DC=ad,DC=Domain,DC=com   9/21/2014 1:05:43 PM    
     └    TaskFailed: Task execution failed.   9/21/2014 1:05:44 PM   Error
     └    Error: Length of the access control list exceed the allowed maximum.
► Details
└ Type: OverflowException
└ ► Stack Trace
    └   at System.Security.AccessControl.RawAcl.InsertAce(Int32 index, GenericAce ace)
at System.Security.AccessControl.CommonAcl.AddQualifiedAce(SecurityIdentifier sid, AceQualifier qualifier, Int32 accessMask, AceFlags flags, ObjectAceFlags objectFlags, Guid objectType, Guid inheritedObjectType)
at System.Security.AccessControl.DiscretionaryAcl.AddAccess(AccessControlType accessType, SecurityIdentifier sid, Int32 accessMask, InheritanceFlags inheritanceFlags, PropagationFlags propagationFlags, ObjectAceFlags objectFlags, Guid objectType, Guid inheritedObjectType)
at System.Security.AccessControl.DirectoryObjectSecurity.ModifyAccess(AccessControlModification modification, ObjectAccessRule rule, Boolean& modified)
at System.Security.AccessControl.DirectoryObjectSecurity.AddAccessRule(ObjectAccessRule rule)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ApplyAcesOnAcl(ActiveDirectorySecurity acl, Boolean remove, ActiveDirectoryAccessRule[] aces)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ProcessAcesOnDirectoryObject(ADSession session, ADObjectId id, ActiveDirectoryAccessRule[] aces, EnterprisePrepAceOption aceOption)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ProcessPermissions(DeploymentContext context, String domainFqdn, ADObjectId groupDomainId, String groupDomainController, LcAceTable aceTable, String trusteeGroupName, String groupName, String taskId, String permissionLocation, ADObjectId dirObject)
at Microsoft.Rtc.Management.Deployment.LcForest.ProcessLcsForestPermissions(LcAction eAction, ADObjectId globalContainerId)
at Microsoft.Rtc.Management.Deployment.LcForest.PrepareForest()
 
 
   9/21/2014 1:05:44 PM   Error
     └    TaskFailed: Prepare Forest Active Directory settings execution failed on an unrecoverable error.   9/21/2014 1:05:44 PM    
     └    TaskFailedResolution: Consult exception information and previous errors for more information on how to resolve this error.   9/21/2014 1:05:44 PM    
     └    Rollback Groups   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalGlobalReadOnlyGroup".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalGlobalWriteGroup".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalServerReadOnlyGroup".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalUserReadOnlyGroup".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCHSUniversalServices".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCComponentUniversalServices".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCProxyUniversalServices".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalServerAdmins".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalUserAdmins".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalReadOnlyAdmins".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalConfigReplicator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalSBATechnicians".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCSBAUniversalServices".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSVoiceAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSUserAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSResponseGroupAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSResponseGroupManager".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSLocationAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSArchivingAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSServerAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSViewOnlyAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSHelpDesk".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CsPersistentChatAdministrator".   9/21/2014 1:05:44 PM    
     └    Rollback object "RTCUserProvisioningPropertySet".   9/21/2014 1:05:44 PM    
     └    Rollback object "RTCUserSearchPropertySet".   9/21/2014 1:05:44 PM    
     └    Rollback object "RTCPropertySet".   9/21/2014 1:05:44 PM    
     └    Rollback object "ApplicationContacts".   9/21/2014 1:05:44 PM    
     └    Rollback object "GlobalSettings".   9/21/2014 1:05:44 PM    
     └    Rollback object "TopologySettings".   9/21/2014 1:05:44 PM    
     └    Rollback object "Pools".   9/21/2014 1:05:44 PM    
     └    Rollback object "Trusted Services".   9/21/2014 1:05:44 PM    
     └    Rollback object "Trusted MCUs".   9/21/2014 1:05:44 PM    
     └    Rollback object "Trusted WebComponentsServers".   9/21/2014 1:05:44 PM    
     └    Rollback object "Conference Directories".   9/21/2014 1:05:44 PM    
     └    Error: Length of the access control list exceed the allowed maximum.
► Details
└ Type: OverflowException
└ ► Stack Trace
    └   at System.Security.AccessControl.RawAcl.InsertAce(Int32 index, GenericAce ace)
at System.Security.AccessControl.CommonAcl.AddQualifiedAce(SecurityIdentifier sid, AceQualifier qualifier, Int32 accessMask, AceFlags flags, ObjectAceFlags objectFlags, Guid objectType, Guid inheritedObjectType)
at System.Security.AccessControl.DiscretionaryAcl.AddAccess(AccessControlType accessType, SecurityIdentifier sid, Int32 accessMask, InheritanceFlags inheritanceFlags, PropagationFlags propagationFlags, ObjectAceFlags objectFlags, Guid objectType, Guid inheritedObjectType)
at System.Security.AccessControl.DirectoryObjectSecurity.ModifyAccess(AccessControlModification modification, ObjectAccessRule rule, Boolean& modified)
at System.Security.AccessControl.DirectoryObjectSecurity.AddAccessRule(ObjectAccessRule rule)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ApplyAcesOnAcl(ActiveDirectorySecurity acl, Boolean remove, ActiveDirectoryAccessRule[] aces)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ProcessAcesOnDirectoryObject(ADSession session, ADObjectId id, ActiveDirectoryAccessRule[] aces, EnterprisePrepAceOption aceOption)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ProcessPermissions(DeploymentContext context, String domainFqdn, ADObjectId groupDomainId, String groupDomainController, LcAceTable aceTable, String trusteeGroupName, String groupName, String taskId, String permissionLocation, ADObjectId dirObject)
at Microsoft.Rtc.Management.Deployment.LcForest.ProcessLcsForestPermissions(LcAction eAction, ADObjectId globalContainerId)
at Microsoft.Rtc.Management.Deployment.LcForest.PrepareForest()
at Microsoft.Rtc.Management.Deployment.Tasks.ForestPrepareTask.Action()
at Microsoft.Rtc.Management.Internal.Utilities.LogWriter.InvokeAndLog(Action action)
 
 
   9/21/2014 1:05:44 PM   Error

 └    Error: An error occurred: "System.OverflowException" "Length of the access control list exceed the allowed maximum."   9/21/2014 1:05:44 PM   Error
0
Comment
Question by:SuperRoot
1 Comment
 
LVL 1

Accepted Solution

by:
SuperRoot earned 0 total points
ID: 40337209
Fixed the error by doing step 2 on the link below:
http://blog.armgasys.com/?p=320

Step 2:
1. Open ADSI Edit
New to ADSI? See this link: http://technet.microsoft.com/en-us/library/cc773354
2. Open the Naming Context Configuration for the domain being cleaned
Drill down to the following path:
CN=Configuration[ your domain] CN=Services
3. Delete the CN=RTC Service entry
clip_image003
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Ever notice how you can't use a new drive in Windows without having Windows assigning a Disk Signature?  Ever have a signature collision problem (especially with Virtual Machines?)  This article is intended to help you understand what's going on and…
Let Bitmoji into your life. Now is the time to learn a new language of smartphone messaging with this brief introduction.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now