Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a newly installed TFS 2012 server set up and I am having problems with the synchronisation of Windows Groups (AD Groups).

My domain is called DOMAINA and my service account for TFSAgentJob is DOMAINA\TFS-Service. I have verified with dsquery that the service account can access the Active Directory. The Active Directory Server is Windows Active Directory Server 2000

When I add a domain user to a project collection then the user recieve the proper permissions, but when I add a domain group that the user is a member of then the permissions are not set. When I manage the group from the web interface I can see that no users has been synchronized to this group.

I have enabled logging of the TFSJobAgent as described in and here is an excerpt of the log:

The error that is thrown is: "Exception Message: The server does not support the requested critical extension."

I have also removed the BUILTIN\Administrators group, but this did not happen.

I have run out of troubleshooting options, can anyone help me identify the error?

What is the "requested critical extension" that the server doesn't support?

share|improve this question
What is the Domain/Forest funtional level of your Windows 2000 AD domain? Is it mixed mode or native? – MDMarra Nov 29 '12 at 14:10
It is running in native. – Mårten Palm Dec 3 '12 at 13:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.