I have a single domain server running Server 2003 running a 2003 functional level domain. I am trying to add a server 2008 R2 machine to be another domain controller, with the intention of promoting it to be the primary, and taking off the server 2003 machine.

I am required to run adprep /forestprep on the Server 2003 machine. When I run it, it fails with the following errors:

Adprep failed to verify whether schema master has completed a replication cycle after last reboot.
The schema is not upgraded.
[User Action]  
Check the log file ADPrep.log in the C:\WINDOWS\debug\adprep\logs\20101109153331 directory for possible cause of failure.

Adprep encountered an LDAP error. 
Error code: 0x32. Server extended error code: 0x2098, Server error message: 00002098: SecErr: DSID-03151D7D, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

I have confirmed that the user account I am using to run ADPREP, mydomain\administrator, is in the Schema Admins, Enterprise Admins, and Domain admins group.

Attempting to figure out what is with the replication, running repadmin /showrepl

repadmin running command /showrepl against server localhost

DC Options: IS_GC
Site Options: (none)
DC object GUID: 0657168e-d854-48d8-a40a-dea3e41e6e87
DC invocationID: 0657168e-d854-48d8-a40a-dea3e41e6e87

Anyone know how to fix this error? Would raising the domain and forest to a 2003 functional level have any likelihood of working? While just making a new domain from scratch and typing in all the user names and stuff again isn't a deal breaker because we only have about 15 users, it would still be a big pain.


  • Do you have any w2k DCs? – Ablue Nov 9 '10 at 22:42
  • @Matthew: No I do not. If I don't find a solution in the meantime, I will try raising it, but I will wait until later tonight when no one is using it in case it blows up. – whatsisname Nov 9 '10 at 22:44
  • Did you verify the health of AD first by running a DCDIAG (I usually use the /e /c /v switches) and correcting any issues it finds? – Multiverse IT Nov 9 '10 at 22:59
  • @Multiverse IT: All tests passed – whatsisname Nov 9 '10 at 23:28
  • Domain and forest are now at 2003 functional levels – whatsisname Nov 10 '10 at 0:02

The adprep error mentions ldap access rights...

The problem was that local administrators of that child domain did not have any permissions on Group Policy object of the domain controller. By default they should have Full Control. (Admins of root domain did have this permission.) So when local "domain admins" were added in the Security tab of Group Policy, ADPrep /domainprep could run without a problem.

Lifted from here.

  • I found that link earlier, and Domain admins have full control of the Default Domain Policy GPO. – whatsisname Nov 9 '10 at 23:12
  • I have looked for a bit. There doesn't appear to be any more information on that error. All I can think is that the schema is too difference for the 2k8 adprep to work properly. Maybe raising the functional level may help. – Ablue Nov 10 '10 at 1:11
  • For me it was adding my user to group membership for Owners and Creators of GPO (translated from Polish). – MadBoy Mar 27 '13 at 17:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.