ADPrep /RODCPrep – Failed
Rob | May 10, 2012Having resolved the replication issues with the Active Directory Forest, the next step was to bring things up-to-date by moving to Server 2008 R2 for the Domain Controllers and raising the Forest Functional Level. To that end, this week I completed the ForestPrep and DomainPrep on the four domains in the forest without issue.
The problems came with the RODCPrep, after running the command I encountered an error with two of the application partitions, namely the ForestDNSZones and DomainDNSZones of the forest root domain, the errors were:
Adprep could not contact a replica for the partition DC=ForestDnsZones,DC=Domain,DC=com.
Adprep encountered an LDAP error
Error code: 0x0. Server extended error code:0x0, Server error message:(null)Adprep failed the operation on the partition DC=ForestDnsZones,DC,Domain,DC=com
Adprep could not contact a replica for the partition DC=DomainDnsZones,DC=Domain,DC=com.
Adprep encountered an LDAP error
Error code: 0x0. Server extended error code:0x0, Server error message:(null)Adprep failed the operation on the partition DC=DomainDnsZones,DC,Domain,DC=com
I had checked that the Infrastructure Master was available and I had the relevant permissions. So I checked the partitions in question and found that the fSMORoleOwner attribute in CN=Infrastructure,DC=ForestDNSZones,DC=Domain,DC=com and CN=Infrastructure,DC=DomainDNSZones,DC=Domain,DC=com had a strange value which made reference to a Domain Controller that had been removed from the forest some time ago, it looked something like this:
CN=NTDS Settings\0ADEL:7336dccf-9ddd-45c2-b3a1-42c72e17742c,CN=Server01\0ADEL:fe4f0c94-2ba5-4f28-945a-f225d3e4bd2a,CN=Servers,CN=Site,CN=Sites,CN=Configuration,DC=Domain,DC=com
A search on the web revealed an article from Microsoft (http://support.microsoft.com/kb/949257) which provided a script to change this to the correct value. Once changed (and given some time to replicate) I ran the ADPrep /RODCPrep again, which worked this time.
Some further reading by a colleague of mine brought him to an article by Ulf B. Simon-Weidner’s (http://msmvps.com/blogs/ulfbsimonweidner/archive/2008/07/31/how-many-infrastructure-masters-do-you-have.aspx) which revealed an interesting fact:
If you move your Infrastructure Master using the MMC or NTDSUtil, the fSMORoleOwner attribute is not updated automatically in your application partitions. Handy to know and thanks to Ulf for documenting this.