4

I want to add an additional domain controller to our existing domain. Right now we have only have one domain controller running on Windows Server 2003. I tried to promote a Windows Server 2012 to be another domain controller for our domain. Unfortunately the prerequisites check fails with the message:

Verification of prerequisites for Active Directory preparation failed. A previous schema extension has defined some attribute value differently than the schema extension needed for this version of Windows Server.

Is there a possibility to check, what's wrong here and how to fix this? I found the log file and it complains about quite some attribute values:

=============================================================================

"attributeId" attribute value for objects defined in Windows 2000 schema and extended schema do not match. [2013/01/14:10:50:39.622] A previous schema extension has defined the attribute value as "1.2.840.113556.1.4.7000.187.70" for object "CN=uidNumber,CN=Schema,CN=Configuration,DC=xxx,DC=de" differently than the schema extension needed for Windows Server 2008 R2.

[Status/Consequence] Adprep cannot extend your existing schema
[User Action] Contact the vendor of the application that previously extended the schema to resolve the inconsistency. Then run adprep again. [2013/01/14:10:50:39.627]

============================================================================= "attributeId" attribute value for objects defined in Windows 2000 schema and extended schema do not match. [2013/01/14:10:50:39.627] A previous schema extension has defined the attribute value as "1.2.840.113556.1.4.7000.187.71" for object "CN=gidNumber,CN=Schema,CN=Configuration,DC=xxx,DC=de" differently than the schema extension needed for Windows Server 2008 R2.

[Status/Consequence] Adprep cannot extend your existing schema
[User Action] Contact the vendor of the application that previously extended the schema to resolve the inconsistency. Then run adprep again. [2013/01/14:10:50:39.628]

and some more...

I found out that the active directory schema was updated by an (unfinished) lync installation 2 yeas ago. Maybe this has caused the problems now.

I don't know if there was initially a Windows 2000 DC installed.

Lars
  • 181
  • 1
  • 8
  • 1. What is the Forest and Domain Functional Level? 2. Are you using an account that is Enterprise Administrator? – Mathias R. Jessen Jan 14 '13 at 10:27
  • also check %WINDIR%\system32\debug\adprep\logs for a log file with events from the `adprep /forestprep` operation which is going to contain the exact error message and post an excerpt into your question. – the-wabbit Jan 14 '13 at 10:42
  • Ah, a log file might help. Thanks for the pointer to it. At my installation it was located in "C:\Windows\debug\adprep\logs\" – Lars Jan 14 '13 at 10:50

3 Answers3

4

The Microsoft Support Team finally found a solution to this problem. The real underlying problem is: Microsoft Windows Services for UNIX 2.0 is installed in the Windows Server 2003 forest or in the Windows 2000 forest. If you try to prepare the Windows Server 2003 forest for Windows Server 2003 R2 (or higher) you receive the following error message:

Error message when you try to prepare the Active Directory directory service for Windows Server 2003 R2: "Attribute value for objects defined in Windows 2000 schema and extended schema do not match"

To fix this behavior there is a hot fix: http://support.microsoft.com/kb/919938. After installing the fix I was able to promote the Windows Server 2012 as domain controller next to a Windows Server 2003 domain controller.

I want to say thank you to all of you here for your support in this question. The answers and comments gave valuable hints to head towards the right direction.

Lars
  • 181
  • 1
  • 8
1

Call MS PSS and open a ticket. Either someone Extended AD in a stupid way and now you are stuck, o there are some steps to help getting this going. Whatever it is, you WANT someone from Microsoft at the other end of the line. If for anything becasue they have the Tools to help you, can Access the developers and this is too tricky to post Schema dumps on a public board, and AD operations like that can be really nasty iif you make them wrong.

This really stinks - I am not sure what happened here, but as the error says, there is an incompatible Extension in the Schema. This should not happen unless someone was too stupid to get a proper randomized ID for a new Attribute, was terribly unlucky or just did not use his brain when doing a Schema Extension OR - which is also a possibility - you have a complex step of Upgrades to do to get things into an upgradable state. There is a Price for being years behind the world, and that is that you may just miss a lot of Interim updates and one may cause this (as it may have changed the Attribute). YOu may have to go 2008 first, with Upgrades on all DC.

TomTom
  • 51,649
  • 7
  • 54
  • 136
  • I opened a case at MS PSS. I'll add the solution here as soon as I have one. – Lars Jan 14 '13 at 15:10
  • MS is still working on this problem... – Lars Jan 21 '13 at 15:41
  • Well, makes it lclear my advice was Sound. Not a stupid oversight, but a real Problem. Great ;) THanks for the upate. – TomTom Jan 21 '13 at 15:58
  • 1
    Thank you TomTom for the hint to contact MS. They were able to fix it. Unfortunately it took a while to get through to the right expert of the support team. An Active Directory Support Specialist solved it in a couple of hours after all. – Lars Jan 22 '13 at 07:57
0

You should upgrade the Domain and Forest Functional levels to Native Server 2003; Server 2012 is likely incompatible with a Windows 2000 PDC.

http://support.microsoft.com/kb/322692 details the procedure.

If the domain was previously upgraded from an earlier version of Windows Server, perhaps you need to first install a Server 2008 DC, move all FSMO roles over to it, and then upgrade to Server 2012.

adaptr
  • 16,576
  • 23
  • 34
  • Sounds good but querying with lpd produces: 1> domainFunctionality: 2 = ( DS_BEHAVIOR_WIN2003 ); 1> forestFunctionality: 2 = ( DS_BEHAVIOR_WIN2003 ); 1> domainControllerFunctionality: 2 = ( DS_BEHAVIOR_WIN2003 ); – Lars Jan 14 '13 at 11:25
  • Was this domain ever upgraded from a previous version of Windows Server ? You may have to install a Server 2008 DC and move the FSMO roles there, then upgrade to 2012. – adaptr Jan 14 '13 at 11:35
  • @adaptr Make that an answer. That seems to be the problem here. – Tonny Jan 14 '13 at 11:42