Failed DCDiag NCSecDesc test

[RandyH]

During exch2k3 setup running dcdiag i am getting the following error:

Starting test: NCSecDesc
Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
Replicating Directory Changes All access rights for the naming
context:
CN=Schema,CN=Configuration,DC=casey,DC=com Error BUILTIN\Administrators
doesn't have
Replicating Directory Changes All access rights for the naming
context:
CN=Schema,CN=Configuration,DC=casey,DC=com Error NT AUTHORITY\ENTERPRISE
DOMAIN CONTROLLERS doesn't have
Replicating Directory Changes All access rights for the naming
context:
CN=Configuration,DC=casey,DC=com Error BUILTIN\Administrators doesn't
have
Replicating Directory Changes All access rights for the naming
context:
CN=Configuration,DC=casey,DC=com
......................... CASEYPGH failed test NCSecDesc


I have checked in ADUAC, r/c'd on the domain, security tab and those
accounts do have those permissions checked to allow.

Any help much appreciated,
Thanks,
Randy

 

[Ray Lava [MSFT]]

Randy,

I have researched your error and have found some information that I hope explains what you are seeing:


The "Replicating Directory Changes All" permission does not exist in a Windows 2000 Active Directory. It was first introduced in Windows Server 2003.
When the Windows Server 2003 version of DCDiag.exe is run, it checks for these 4 permissions settings regardless of the domain mode. If there are no domain controllers running Windows Server 2003, then this permission does not exist, and DCDiag.exe will report back the failure.

If this is your scenario, then this error message can be safely ignored.



If this is not your situation, then please check the following:

1. Grant the following to the Enterprise Domain Controllers group at DC=casey,DC=com

Replicating Directory Changes

Replication Syncronization

Manage Replication Topology



Hopefully, one of these will resolve your issue.

Best Regards,

Ray Lava
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights