Solved

Error preparing forest domain on lync 2013

Posted on 2014-09-21
1
805 Views
Last Modified: 2014-09-22
I'm getting an error when doing step 3 of active directory prep. Im unsure what I did. I'm not really a windows guru but I have basic knowledge how it works.

Process permissions on "CN=CsPersistentChatAdministrator,CN=Users,DC=ad,DC=Domain, DC=com".   9/21/2014 1:05:43 PM    
     └    Create permissions for CN=RTC Service,CN=Services,CN=Configuration,DC=ad,DC=Domain,DC=com   9/21/2014 1:05:43 PM    
     └    TaskFailed: Task execution failed.   9/21/2014 1:05:44 PM   Error
     └    Error: Length of the access control list exceed the allowed maximum.
► Details
└ Type: OverflowException
└ ► Stack Trace
    └   at System.Security.AccessControl.RawAcl.InsertAce(Int32 index, GenericAce ace)
at System.Security.AccessControl.CommonAcl.AddQualifiedAce(SecurityIdentifier sid, AceQualifier qualifier, Int32 accessMask, AceFlags flags, ObjectAceFlags objectFlags, Guid objectType, Guid inheritedObjectType)
at System.Security.AccessControl.DiscretionaryAcl.AddAccess(AccessControlType accessType, SecurityIdentifier sid, Int32 accessMask, InheritanceFlags inheritanceFlags, PropagationFlags propagationFlags, ObjectAceFlags objectFlags, Guid objectType, Guid inheritedObjectType)
at System.Security.AccessControl.DirectoryObjectSecurity.ModifyAccess(AccessControlModification modification, ObjectAccessRule rule, Boolean& modified)
at System.Security.AccessControl.DirectoryObjectSecurity.AddAccessRule(ObjectAccessRule rule)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ApplyAcesOnAcl(ActiveDirectorySecurity acl, Boolean remove, ActiveDirectoryAccessRule[] aces)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ProcessAcesOnDirectoryObject(ADSession session, ADObjectId id, ActiveDirectoryAccessRule[] aces, EnterprisePrepAceOption aceOption)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ProcessPermissions(DeploymentContext context, String domainFqdn, ADObjectId groupDomainId, String groupDomainController, LcAceTable aceTable, String trusteeGroupName, String groupName, String taskId, String permissionLocation, ADObjectId dirObject)
at Microsoft.Rtc.Management.Deployment.LcForest.ProcessLcsForestPermissions(LcAction eAction, ADObjectId globalContainerId)
at Microsoft.Rtc.Management.Deployment.LcForest.PrepareForest()
 
 
   9/21/2014 1:05:44 PM   Error
     └    TaskFailed: Prepare Forest Active Directory settings execution failed on an unrecoverable error.   9/21/2014 1:05:44 PM    
     └    TaskFailedResolution: Consult exception information and previous errors for more information on how to resolve this error.   9/21/2014 1:05:44 PM    
     └    Rollback Groups   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalGlobalReadOnlyGroup".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalGlobalWriteGroup".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalServerReadOnlyGroup".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalUserReadOnlyGroup".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCHSUniversalServices".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCComponentUniversalServices".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCProxyUniversalServices".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalServerAdmins".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalUserAdmins".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalReadOnlyAdmins".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalConfigReplicator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCUniversalSBATechnicians".   9/21/2014 1:05:44 PM    
     └    Remove universal group "RTCSBAUniversalServices".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSVoiceAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSUserAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSResponseGroupAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSResponseGroupManager".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSLocationAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSArchivingAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSServerAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSViewOnlyAdministrator".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CSHelpDesk".   9/21/2014 1:05:44 PM    
     └    Remove universal group "CsPersistentChatAdministrator".   9/21/2014 1:05:44 PM    
     └    Rollback object "RTCUserProvisioningPropertySet".   9/21/2014 1:05:44 PM    
     └    Rollback object "RTCUserSearchPropertySet".   9/21/2014 1:05:44 PM    
     └    Rollback object "RTCPropertySet".   9/21/2014 1:05:44 PM    
     └    Rollback object "ApplicationContacts".   9/21/2014 1:05:44 PM    
     └    Rollback object "GlobalSettings".   9/21/2014 1:05:44 PM    
     └    Rollback object "TopologySettings".   9/21/2014 1:05:44 PM    
     └    Rollback object "Pools".   9/21/2014 1:05:44 PM    
     └    Rollback object "Trusted Services".   9/21/2014 1:05:44 PM    
     └    Rollback object "Trusted MCUs".   9/21/2014 1:05:44 PM    
     └    Rollback object "Trusted WebComponentsServers".   9/21/2014 1:05:44 PM    
     └    Rollback object "Conference Directories".   9/21/2014 1:05:44 PM    
     └    Error: Length of the access control list exceed the allowed maximum.
► Details
└ Type: OverflowException
└ ► Stack Trace
    └   at System.Security.AccessControl.RawAcl.InsertAce(Int32 index, GenericAce ace)
at System.Security.AccessControl.CommonAcl.AddQualifiedAce(SecurityIdentifier sid, AceQualifier qualifier, Int32 accessMask, AceFlags flags, ObjectAceFlags objectFlags, Guid objectType, Guid inheritedObjectType)
at System.Security.AccessControl.DiscretionaryAcl.AddAccess(AccessControlType accessType, SecurityIdentifier sid, Int32 accessMask, InheritanceFlags inheritanceFlags, PropagationFlags propagationFlags, ObjectAceFlags objectFlags, Guid objectType, Guid inheritedObjectType)
at System.Security.AccessControl.DirectoryObjectSecurity.ModifyAccess(AccessControlModification modification, ObjectAccessRule rule, Boolean& modified)
at System.Security.AccessControl.DirectoryObjectSecurity.AddAccessRule(ObjectAccessRule rule)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ApplyAcesOnAcl(ActiveDirectorySecurity acl, Boolean remove, ActiveDirectoryAccessRule[] aces)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ProcessAcesOnDirectoryObject(ADSession session, ADObjectId id, ActiveDirectoryAccessRule[] aces, EnterprisePrepAceOption aceOption)
at Microsoft.Rtc.Management.Deployment.Core.DirectoryCommon.ProcessPermissions(DeploymentContext context, String domainFqdn, ADObjectId groupDomainId, String groupDomainController, LcAceTable aceTable, String trusteeGroupName, String groupName, String taskId, String permissionLocation, ADObjectId dirObject)
at Microsoft.Rtc.Management.Deployment.LcForest.ProcessLcsForestPermissions(LcAction eAction, ADObjectId globalContainerId)
at Microsoft.Rtc.Management.Deployment.LcForest.PrepareForest()
at Microsoft.Rtc.Management.Deployment.Tasks.ForestPrepareTask.Action()
at Microsoft.Rtc.Management.Internal.Utilities.LogWriter.InvokeAndLog(Action action)
 
 
   9/21/2014 1:05:44 PM   Error

 └    Error: An error occurred: "System.OverflowException" "Length of the access control list exceed the allowed maximum."   9/21/2014 1:05:44 PM   Error
0
Comment
Question by:SuperRoot
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 1

Accepted Solution

by:
SuperRoot earned 0 total points
ID: 40337209
Fixed the error by doing step 2 on the link below:
http://blog.armgasys.com/?p=320

Step 2:
1. Open ADSI Edit
New to ADSI? See this link: http://technet.microsoft.com/en-us/library/cc773354
2. Open the Naming Context Configuration for the domain being cleaned
Drill down to the following path:
CN=Configuration[ your domain] CN=Services
3. Delete the CN=RTC Service entry
clip_image003
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, Microsoft released a best-practice guide for securing Active Directory. It's a whopping 300+ pages long. Those of us tasked with securing our company’s databases and systems would, ideally, have time to devote to learning the ins and outs…
Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question