?
Solved

Error preparing forest domain on lync 2013

Posted on 2014-09-21
1
Medium Priority
?
837 Views
Last Modified: 2014-09-22
I'm getting an error when doing step 3 of active directory prep. Im unsure what I did. I'm not really a windows guru but I have basic knowledge how it works.

Process permissions on "CN=CsPersistentChatAdministrator,CN=Users,DC=ad,DC=Domain, DC=com".   9/21/2014 1:05:43 PM    
     └    Create permissions for CN=RTC Service,CN=Services,CN=Configuration,DC=ad,DC=Domain,DC=com   9/21/2014 1:05:43 PM    
     └    TaskFailed: Task execution failed.   9/21/2014 1:05:44 PM   Error
     └    Error: Length of the access control list exceed the allowed maximum.
► Details
└ Type: OverflowException
└ ► Stack Trace
    └   at System.Security.AccessControl.RawAcl.InsertAce(Int32 index, GenericAce ace)
at System.Security.AccessControl.CommonAcl.AddQualifiedAce(SecurityIdentifier sid, AceQualifier qualifier, Int32 accessMask, AceFlags flags, ObjectAceFlags objectFlags, Guid objectType, Guid inheritedObjectType)
at System.Security.AccessControl.DiscretionaryAcl.AddAccess(AccessControlType accessType, SecurityIdentifier sid, Int32 accessMask, InheritanceFlags inheritanceFlags, PropagationFlags propagationFlags, ObjectAceFlags objectFlags, Guid objectType, Guid inheritedObjectType)
at System.Security.AccessControl.DirectoryObjectSecurity.ModifyAccess(AccessControlModification modification, ObjectAccessRule rule, Boolean& modified)
at System.Security.AccessControl.DirectoryObjectSecurity.AddAccessRule(ObjectAccessRule rule)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ApplyAcesOnAcl(ActiveDirectorySecurity acl, Boolean remove, ActiveDirectoryAccessRule[] aces)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ProcessAcesOnDirectoryObject(ADSession session, ADObjectId id, ActiveDirectoryAccessRule[] aces, EnterprisePrepAceOption aceOption)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ProcessPermissions(DeploymentContext context, String domainFqdn, ADObjectId groupDomainId, String groupDomainController, LcAceTable aceTable, String trusteeGroupName, String groupName, String taskId, String permissionLocation, ADObjectId dirObject)
at Microsoft.Rtc.Management.Deployment.LcForest.ProcessLcsForestPermissions(LcAction eAction, ADObjectId globalContainerId)
at Microsoft.Rtc.Management.Deployment.LcForest.PrepareForest()
 
 
   9/21/2014 1:05:44 PM   Error
     └    TaskFailed: Prepare Forest Active Directory settings execution failed on an unrecoverable error.   9/21/2014 1:05:44 PM    
     └    TaskFailedResolution: Consult exception information and previous errors for more information on how to resolve this error.   9/21/2014 1:05:44 PM    
     └    Rollback Groups   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalGlobalReadOnlyGroup".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalGlobalWriteGroup".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalServerReadOnlyGroup".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalUserReadOnlyGroup".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCHSUniversalServices".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCComponentUniversalServices".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCProxyUniversalServices".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalServerAdmins".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalUserAdmins".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalReadOnlyAdmins".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalConfigReplicator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalSBATechnicians".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCSBAUniversalServices".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSVoiceAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSUserAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSResponseGroupAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSResponseGroupManager".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSLocationAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSArchivingAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSServerAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSViewOnlyAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSHelpDesk".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CsPersistentChatAdministrator".   9/21/2014 1:05:44 PM    
     └    Rollback object "RTCUserProvisioningPropertySet".   9/21/2014 1:05:44 PM    
     └    Rollback object "RTCUserSearchPropertySet".   9/21/2014 1:05:44 PM    
     └    Rollback object "RTCPropertySet".   9/21/2014 1:05:44 PM    
     └    Rollback object "ApplicationContacts".   9/21/2014 1:05:44 PM    
     └    Rollback object "GlobalSettings".   9/21/2014 1:05:44 PM    
     └    Rollback object "TopologySettings".   9/21/2014 1:05:44 PM    
     └    Rollback object "Pools".   9/21/2014 1:05:44 PM    
     └    Rollback object "Trusted Services".   9/21/2014 1:05:44 PM    
     └    Rollback object "Trusted MCUs".   9/21/2014 1:05:44 PM    
     └    Rollback object "Trusted WebComponentsServers".   9/21/2014 1:05:44 PM    
     └    Rollback object "Conference Directories".   9/21/2014 1:05:44 PM    
     └    Error: Length of the access control list exceed the allowed maximum.
► Details
└ Type: OverflowException
└ ► Stack Trace
    └   at System.Security.AccessControl.RawAcl.InsertAce(Int32 index, GenericAce ace)
at System.Security.AccessControl.CommonAcl.AddQualifiedAce(SecurityIdentifier sid, AceQualifier qualifier, Int32 accessMask, AceFlags flags, ObjectAceFlags objectFlags, Guid objectType, Guid inheritedObjectType)
at System.Security.AccessControl.DiscretionaryAcl.AddAccess(AccessControlType accessType, SecurityIdentifier sid, Int32 accessMask, InheritanceFlags inheritanceFlags, PropagationFlags propagationFlags, ObjectAceFlags objectFlags, Guid objectType, Guid inheritedObjectType)
at System.Security.AccessControl.DirectoryObjectSecurity.ModifyAccess(AccessControlModification modification, ObjectAccessRule rule, Boolean& modified)
at System.Security.AccessControl.DirectoryObjectSecurity.AddAccessRule(ObjectAccessRule rule)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ApplyAcesOnAcl(ActiveDirectorySecurity acl, Boolean remove, ActiveDirectoryAccessRule[] aces)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ProcessAcesOnDirectoryObject(ADSession session, ADObjectId id, ActiveDirectoryAccessRule[] aces, EnterprisePrepAceOption aceOption)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ProcessPermissions(DeploymentContext context, String domainFqdn, ADObjectId groupDomainId, String groupDomainController, LcAceTable aceTable, String trusteeGroupName, String groupName, String taskId, String permissionLocation, ADObjectId dirObject)
at Microsoft.Rtc.Management.Deployment.LcForest.ProcessLcsForestPermissions(LcAction eAction, ADObjectId globalContainerId)
at Microsoft.Rtc.Management.Deployment.LcForest.PrepareForest()
at Microsoft.Rtc.Management.Deployment.Tasks.ForestPrepareTask.Action()
at Microsoft.Rtc.Management.Internal.Utilities.LogWriter.InvokeAndLog(Action action)
 
 
   9/21/2014 1:05:44 PM   Error

 └    Error: An error occurred: "System.OverflowException" "Length of the access control list exceed the allowed maximum."   9/21/2014 1:05:44 PM   Error
0
Comment
Question by:SuperRoot
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 1

Accepted Solution

by:
SuperRoot earned 0 total points
ID: 40337209
Fixed the error by doing step 2 on the link below:
http://blog.armgasys.com/?p=320

Step 2:
1. Open ADSI Edit
New to ADSI? See this link: http://technet.microsoft.com/en-us/library/cc773354
2. Open the Naming Context Configuration for the domain being cleaned
Drill down to the following path:
CN=Configuration[ your domain] CN=Services
3. Delete the CN=RTC Service entry
clip_image003
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Popular third-party chat platforms like Slack, Discord, and Telegram are just a few of the many new productivity applications that are being hijacked by cybercriminals to create command-and-control (C&C) communications infrastructures for their malw…
Active Directory can easily get cluttered with unused service, user and computer accounts. In this article, I will show you the way I like to implement ADCleanup..
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
The goal of the tutorial is to teach the user how to instant message and make a video call in Skype.
Suggested Courses

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question