Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am unable to promote my newly installed Windows Server 2012 machine to a domain controller. I have two existing domain controllers. The primary is at Windows Server 2003 level, and is running W2003Server, and the secondary is running Windows Server 2003 R2. (Update: Originally this question asked about the non-fatal warning message about a domain controller-could-not-be-located, which is normal when upgrading from Windows Server 2003, as it's impossible to create a Read-only domain controller when the active directory forest is at the 2003 functional level, so in my opinion that warning should be quashed. After continuing through several more similarly scary looking errors, I finally got to the real error which is an AdPrep related error.)

On the new Win2012 server box, joining the domain as a server that is a member of the domain worked fine. But the AD DS Cfg Wiz freezes for about 100 seconds, it goes from page 1 of the wizard to page 2 (which shows site name combo box and two password entry edit boxes for DSRM password) then I get this error in Active Directory Domain Services Configuration wizard.

At first I thought this was the real error. But it's just a roadblock in my way that I continue past:

Domain Controller Options

A domain controller running Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012 could not be located in this domain. To install a read-only domain controller, the domain must have a domain controller running Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012.

[OK]

Next I get a few more similar "You can't check this checkbox so we've grayed it out for you" messages that you can continue past.

Next this one:

Error determining whether the target environment requires adprep: Validation error: 
Validation error: Unable to check forest upgrade status for server 
SERVERNAME.localdomain.local.
Exception: The specified server cannot perform the requested operation 
Details:Test.VerifyForestUpgradeStatus.ADPrep.Win32Exception.-2147467259 

[ OK  ]

Has anyone gotten a Domain at 2003 level up to 2012?

Update Turns out I had no active schema master on the domain.

Update2 For make benefit of Future Users with this error, I've shown the screenshot with the errors I saw:

enter image description here

share|improve this question
1  
"A domain controller running ....." what? Please post the full error message you're getting. –  Massimo Oct 9 '12 at 18:36
    
Full error message now on there. –  Warren P Oct 9 '12 at 19:02
3  
That message should only be relevant to the installation of an RODC, which presumably you're not doing. Does the wizard let you continue from that message? –  joeqwerty Oct 9 '12 at 19:09
    
Yes. And then there were a bunch more. The final blocking error is now on here. –  Warren P Oct 16 '12 at 12:19
add comment

4 Answers

up vote 3 down vote accepted

It turns out I had no active Schema Master on my domain. I asked here about how to get the active schema owner. The name was valid but the machine name was a name that had long since been powered down and decommissioned, but nobody transferred the schema master role before it died.

Here is what I had to do:

  1. While windows server 2012 tries to save you from running adprep, it can't do it in some cases. In my case, someone had created a domain controller and transferred the PDC role to a server but not the schema master role, then retired the schema master server without transferring the schema master role normally. Diagnosing issues like this, when moving up from a 9 year old version of windows to the latest version, is hard because in Windows Server 2012, you get Win32 errors and these errors are just large negative integer values as shown in my question. But even attempts to upgrade from 2003 to 2008 R2 were similarly blocked, and no helpful error messages were displayed. Of course that's typical for ActiveDirectory issues. Reading logs and running command line diagnostic utilities is part of the standard "flow chart for troubleshooting" if you go look on TechNet. It's a giant tar-pit of accidental complexity.

  2. In cases like the above, you only get useful errors when you run AdPrep in standalone mode. Sadly, only 64 bit adprep comes with windows server 2012. use 2008 r2 install dvd to get 32 bit adprep32.exe.

  3. Researching the errors from running the Windows 2008 R2 version of AdPrep in standalone commandline mode I found it came down to the fact that I had to make sure a domain controller machine with the Schema Master role even exists, and is live on the network. Note that the version of AdPrep that is on the Windows Server 2012 is designed to run from your 2012 server, not on your role master machines, as has previously been the case for AdPrep usage. If you try to run the AdPrep tool on a 32 bit Windows Server 2003 machine you'll get stuck because AdPrep.exe won't even run and print any error message out, on your 32 bit machine. In my case, none existed and I had to use this link to "seize" the Schema Master role using the NTDSUTIL main help:

    http://technet.microsoft.com/en-us/library/cc976711.aspx

Specific help for seizing the schema master:

http://technet.microsoft.com/en-us/library/cc783650(v=ws.10).aspx

As I said in step 1, most people won't have this problem, but the confusion in amateur-IT circles may lead others to having similar problems.

I have also asked how to identify the active schema master name, from the command line in the linked question and this command works to find out who the schema master is:

      netdom query fsmo

Then I ran ntdsutil as detailed in point #3 above, seized the Schema Master role to repair the domain, and after that, I could run adprep normally:

       adprep /forestPrep
       ...  <takes about 10 minutes and outputs several screens of info>
       adprep /domainPrep
       ...  <takes about 1 second and outputs about 15 lines>

And then adprep works. Note that you're still not done. The Windows Server 2012 domain controller setup will still fail on any of hundreds of other problems, too many to list here. Other things I had to do to get it to work:

  1. Remove Symantec Endpoint Protection and Disable Windows Firewall, so that WMI works over the network, which is required for the new domain controller talking to the old domain controller.

  2. Repair a few DNS configuration errors and then run ipconfig /flushdns, including removing decomissioned servers that had not been properly decomissioned which means basically going to the AD management screen and deleting those servers. Other DNS errors might include lack of reverse-DNS records, etc.

  3. Ensure that if you get errors communicating via WMI/DCOM that you repair the service permissions or other errors that can block WMI and DCOM from working.

share|improve this answer
add comment

If all your domain controllers are at least Windows Server 2003 and both your domain and forest functional levels are set to at least Windows Server 2003, adding a Windows Server 2012 DC should work fine:

http://technet.microsoft.com/en-us/library/hh994618.aspx#BKMK_FunctionalLevels

The only situation where you'll need at least a Windows Server 2008 DC is if you're adding a read-only domain controller.


Edit:

If the message you are getting is the one shown here, then it's only a warning (as should be clear from the yellow exclamation point icon); it will not stop you from continuing, unless you're actually trying to install a RODC.

share|improve this answer
    
Thank you! This answer is correct for my original question (pre-edits, about the first "warning" that I thought was a "fatal error" and wasn't). I should have ignored it and continued, and that was very helpful. However future readers will think this is non-applicable since it only mentions the first error. My apologies for asking a confused question. –  Warren P Oct 16 '12 at 13:52
add comment

Is your forest/domain functional level at 2003? You should be able to add a 2012 domain controller into a 2003 forest - provided the forest is at the 2003 functional level.

edit: Also, check your DNS settings and make sure they are correct and that you can resolve the proper srv records to locate the domain controllers

edit2: If you are trying to install a RODC, you will need to have a 2008 writable DC to install a read-only DC.

share|improve this answer
    
I did that. And the domain is at the 2003 level. I thought there was a DNS problem, but it seems that my two domain controllers (both running server 2003) are both reachable and the DNS seems fine, but I'm still blocked. –  Warren P Oct 9 '12 at 18:53
add comment

You need to run the requisite adprep /forestprep and adprep /domainprep commands from the 2012 DVD.

share|improve this answer
    
Not correct, these steps are integrated in the promotion wizard in Windows Server 2012 (although they can still be run manually if desired). –  Massimo Oct 9 '12 at 18:39
1  
That should go without saying.. technically, the adprep pieces are all integrated now though. They can still be run manually though. –  Rex Oct 9 '12 at 18:39
1  
According to this article, forestprep and domainprep will be run during the AD DS configuration wizard and no longer need to be run from the relevant FSMO role holder: blogs.technet.com/b/askpfeplat/archive/2012/09/03/… –  joeqwerty Oct 9 '12 at 18:39
1  
@joeqwerty You can still run these commands manually in 2012 and you run it from a 2012 server as a member of the Enterprise Admin group. All you need is connectivity from this server to the Schema Master and Infrastructure Master. –  MDMarra Oct 9 '12 at 20:07
1  
@WarrenP In the case of 2012, you run it from the 2012 server, which is x64 only. This isn't an issue. I suggest you read through the documentation thoroughly before continuing. –  MDMarra Oct 16 '12 at 14:06
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.