Upgrading 2000 AD to 2003...ADPREP /FORESTPREP error...

[Kent Rubin]

Anyone seen this before? I run adprep /forestprep on a single server test
environment server. Here's my adprep.log file:

Adprep created the log file ADPrep.log under
C:\WINNT\system32\debug\adprep\logs\20031228092104 directory.
Adprep copied file D:\I386\schema.ini from installation point to local
machine under directory C:\WINNT.
Adprep copied file D:\I386\sch18.ldf from installation point to local
machine under directory C:\WINNT\system32.
Adprep copied file D:\I386\sch19.ldf from installation point to local
machine under directory C:\WINNT\system32.
Adprep copied file D:\I386\sch20.ldf from installation point to local
machine under directory C:\WINNT\system32.
Adprep copied file D:\I386\sch21.ldf from installation point to local
machine under directory C:\WINNT\system32.
Adprep copied file D:\I386\sch22.ldf from installation point to local
machine under directory C:\WINNT\system32.
Adprep copied file D:\I386\sch23.ldf from installation point to local
machine under directory C:\WINNT\system32.
Adprep copied file D:\I386\sch24.ldf from installation point to local
machine under directory C:\WINNT\system32.
Adprep copied file D:\I386\sch25.ldf from installation point to local
machine under directory C:\WINNT\system32.
Adprep copied file D:\I386\sch26.ldf from installation point to local
machine under directory C:\WINNT\system32.
Adprep copied file D:\I386\sch27.ldf from installation point to local
machine under directory C:\WINNT\system32.
Adprep copied file D:\I386\sch28.ldf from installation point to local
machine under directory C:\WINNT\system32.
Adprep copied file D:\I386\sch29.ldf from installation point to local
machine under directory C:\WINNT\system32.
Adprep copied file D:\I386\sch30.ldf from installation point to local
machine under directory C:\WINNT\system32.
Adprep copied file D:\I386\dcpromo.cs_ from installation point to local
machine under directory C:\WINNT\system32\debug\adprep\data.
Adprep copied file D:\I386\409.cs_ from installation point to local machine
under directory C:\WINNT\system32\debug\adprep\data.
Adprep successfully made the LDAP connection to the local domain controller
RUBIN1.
Adprep was about to call the following LDAP API. ldap_search_s(). The base
entry to start the search is (null).
LDAP API ldap_search_s() finished, return code is 0x0
Adprep successfully retrieved information from the local directory service.
Adprep successfully initialized global variables.
[Status/Consequence]
Adprep is continuing.
ADPREP WARNING:
Before running adprep, all Windows 2000 domain controllers in the forest
should be upgraded to Windows 2000 Service Pack 1 (SP1) with QFE 265089, or
to Windows 2000 SP2 (or later).
QFE 265089 (included in Windows 2000 SP2 and later) is required to prevent
potential domain controller corruption.
For more information about preparing your forest and domain see KB article
Q331161 at http://support.microsoft.com.
[User Action]
If ALL your existing Windows 2000 domain controllers meet this requirement,
type C and then press ENTER to continue. Otherwise, type any other key and
press ENTER to quit.
Adprep was about to call the following LDAP API. ldap_search_s(). The base
entry to start the search is
CN=UID,CN=Schema,CN=Configuration,DC=domain,DC=com.
LDAP API ldap_search_s() finished, return code is 0x0
Adprep successfully determined whether Microsoft Windows Services for UNIX
(SFU) is installed or not. If adprep detected SFU, adprep also verified that
Microsoft hotfix Q293783 for SFU has been applied.
Adprep was unable to upgrade the schema on the schema master.
[Status/Consequence]
The schema will not be restored to its original state.
[User Action]
Check the Ldif.err log file in the
C:\WINNT\system32\debug\adprep\logs\20031228092104 directory for detailed
information.
Adprep set the value of registry key
System\CurrentControlSet\Services\NTDS\Parameters\Schema Update Allowed to 1
Adprep was unable to update forest-wide information.
[Status/Consequence]
Adprep requires access to existing forest-wide information from the schema
master in order to complete this operation.
[User Action]
Check the log file, Adprep.log, in the
C:\WINNT\system32\debug\adprep\logs\20031228092104 directory for more
information.

The LDIF.ERR files says the following:
Entry DN: CN=User,CN=Schema,CN=Configuration,DC=rubins,DC=org
Add error on line 418: Unwilling To Perform
The server side error is "Schema update failed: attribute in may-contain
does not exist."
An error has occurred in the program

I don't get it...Everything looks good AD-wise. Any ideas?

 

[Michael Holzemer]

Kent Rubin wrote:

Adprep was unable to upgrade the schema on the schema master.
[Status/Consequence]
The schema will not be restored to its original state.
[User Action]
Check the Ldif.err log file in the
C:\WINNT\system32\debug\adprep\logs\20031228092104 directory for
detailed information.
Adprep set the value of registry key
System\CurrentControlSet\Services\NTDS\Parameters\Schema Update
Allowed to 1 Adprep was unable to update forest-wide information.
[Status/Consequence]
Adprep requires access to existing forest-wide information from the
schema master in order to complete this operation.

I don't get it...Everything looks good AD-wise. Any ideas?

Based on this I would say you are not a schema administrator, therefore you
cannot change the AD schema.

--
Regards,

Michael Holzemer
No email replies please - reply in newsgroup

Learn script faster by searching here
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/scriptcenter/default.asp

 

[Kent Rubin]

I'm logged in as domain administrator and checked to verify that I'm in the
schema admins group.

Any other suggestions would be very much appreciated. I don't mind trying
anything out...
===========================

 

[Michael Holzemer]

I'm logged in as domain administrator and checked to verify that I'm
in the schema admins group.

Any other suggestions would be very much appreciated. I don't mind
trying anything out...
===========================

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/scriptcenter/default.asp

You did not say where you ran this. You ran it on your schema master
correct?

--
Regards,

Michael Holzemer
No email replies please - reply in newsgroup

Learn script faster by searching here
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/scriptcenter/default.asp

 

[Kent Rubin]

It's a single server domain (test environment-1 server, 3 test workstations)
So, yes, I ran this on the PDC (rubin1) which has the only copy of the ad
ldap info whilest logged in as administrator.
=============================

 

[Michael Holzemer]

It's a single server domain (test environment-1 server, 3 test
workstations) So, yes, I ran this on the PDC (rubin1) which has the
only copy of the ad ldap info whilest logged in as administrator.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;325379

Instead of me asking a bunch more questions, have you followed all the
directions in this article? This will tell us where we stand in terms of the
next step to take.
--
Regards,

Michael Holzemer
No email replies please - reply in newsgroup

Learn script faster by searching here
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/scriptcenter/default.asp