We have a client with a very old active directory environment on Windows Server 2008 R2. We are going to replace it with a new server and would like to upgrade the existing server to keep all of the permissions and profiles in place. We realize we will need to do it in a couple steps. We created a Hyper-V server to test the upgrade. During the initial attempt to upgrade to 2012 R2 we received an error indicating Forestprep and Domainprep need to be run. The Forestprep completed successfully but Domainprep had issues with replication. Long ago there was another server but it was decommissioned before we got the client so we don't have access to it. I was able to manually remove the old server in sites and services to effectively disable replication. Now I am getting a permissions error creating CN=TPM Devices,DC=CVV,DC=local in Active Directory Domain Services. See log excerpt below:
[Status/Consequence]
The operation has not run or is not currently running. It will be run next.
[2024/02/13:16:51:53.609]
Adprep was about to call the following LDAP API. ldap_add_s(). The entry to add is CN=TPM Devices,DC=CVV,DC=local.
[2024/02/13:16:51:53.610]
LDAP API ldap_add_s() finished, return code is 0x10
[2024/02/13:16:51:53.617]
Adprep was unable to create the object CN=TPM Devices,DC=CVV,DC=local in Active Directory Domain Services.
[Status/Consequence]
This Adprep operation failed.
[User Action]
Check the log file ADPrep.log in the C:\Windows\debug\adprep\logs\20240213165153 directory for more information. Restart Adprep.
[2024/02/13:16:51:53.621]
Adprep encountered an LDAP error.
Error code: 0x10. Server extended error code: 0x57, Server error message: 00000057: LdapErr: DSID-0C090CB7, comment: Error in attribute conversion operation, data 0, v1db1
DSID Info:
DSID: 0x1811100d
ldap error = 0x10
NT BUILD: 9600
NT BUILD: 16384
[2024/02/13:16:51:53.628]
Adprep was unable to update domain information.
[Status/Consequence]
Adprep requires access to existing domain-wide information from the infrastructure master in order to complete this operation.
[User Action]
Check the log file, ADPrep.log, in the C:\Windows\debug\adprep\logs\20240213165153 directory for more information.
D:\support\adprep>netdom query fsmo
Schema master Culinary01.CVV.local
Domain naming master Culinary01.CVV.local
PDC Culinary01.CVV.local
RID pool manager Culinary01.CVV.local
Infrastructure master Culinary01.CVV.local
The command completed successfully.
I ran adprep /domainprep using an elevated command prompt logged in with an admin account belonging to Domain Admins and Enterprise Admins. Anyone have an idea how to fix this error?
Additional command results requested by joeqwerty:
PS C:\Users\cvvadmin> echo $host
Name : ConsoleHost
Version : 3.0
InstanceId : 9b5b8e7f-85bd-40c3-ba0b-b32a0f87f133
UI : System.Management.Automation.Internal.Host.InternalHostUserInterface
CurrentCulture : en-US
CurrentUICulture : en-US
PrivateData : Microsoft.PowerShell.ConsoleHost+ConsoleColorProxy
IsRunspacePushed : False
Runspace : System.Management.Automation.Runspaces.LocalRunspace
PS C:\Users\cvvadmin> Get-ADObject (Get-ADRootDSE).schemaNamingContext -Property objectVersion
DistinguishedName : CN=Schema,CN=Configuration,DC=CVV,DC=local
Name : Schema
ObjectClass : dMD
ObjectGUID : f91149b0-619b-4ee8-90f1-3aa164846200
objectVersion : 69
PS C:\Users\cvvadmin> Get-ADForest | fl Name,ForestMode
Name : CVV.local
ForestMode : Windows2000Forest
PS C:\Users\cvvadmin> Get-ADDomain | fl Name,DomainMode
Name : CVV
DomainMode : Windows2000Domain
PS outputs and domainprep log:
PS C:\Users\cvvadmin> Get-ADObject (Get-ADRootDSE).schemaNamingContext -Property objectVersion
DistinguishedName : CN=Schema,CN=Configuration,DC=CVV,DC=local
Name : Schema
ObjectClass : dMD
ObjectGUID : f91149b0-619b-4ee8-90f1-3aa164846200
objectVersion : 69
PS C:\Users\cvvadmin> Get-ADForest | fl Name,ForestMode
Name : CVV.local
ForestMode : Windows2008R2Forest
PS C:\Users\cvvadmin> Get-ADDomain | fl Name,DomainMode
Name : CVV
DomainMode : Windows2008R2Domain
PS C:\Users\cvvadmin> Dfsrmig /getmigrationstate
Unable to create DFSR Migration log file. Error 1307
All Domain Controllers have migrated successfully to Global state ('Eliminated').
Migration has reached a consistent state on all Domain Controllers.
Succeeded.
Domainprep log:
[Status/Consequence]
The operation has not run or is not currently running. It will be run next.
[2024/02/14:13:29:33.022]
Adprep was about to call the following LDAP API. ldap_add_s(). The entry to add is CN=TPM Devices,DC=CVV,DC=local.
[2024/02/14:13:29:33.025]
LDAP API ldap_add_s() finished, return code is 0x10
[2024/02/14:13:29:33.033]
Adprep was unable to create the object CN=TPM Devices,DC=CVV,DC=local in Active Directory Domain Services.
[Status/Consequence]
This Adprep operation failed.
[User Action]
Check the log file ADPrep.log in the C:\Windows\debug\adprep\logs\20240214132932 directory for more information. Restart Adprep.
[2024/02/14:13:29:33.039]
Adprep encountered an LDAP error.
Error code: 0x10. Server extended error code: 0x57, Server error message: 00000057: LdapErr: DSID-0C090CB7, comment: Error in attribute conversion operation, data 0, v1db1
DSID Info:
DSID: 0x1811100d
ldap error = 0x10
NT BUILD: 9600
NT BUILD: 16384
[2024/02/14:13:29:33.048]
Adprep was unable to update domain information.
[Status/Consequence]
Adprep requires access to existing domain-wide information from the infrastructure master in order to complete this operation.
[User Action]
Check the log file, ADPrep.log, in the C:\Windows\debug\adprep\logs\20240214132932 directory for more information.
Run the following commands from Powershell and post the output in your question:
Then run the following command (where domain.tld is your AD name):
Then from a command prompt work through these commands until the state is Eliminated:
Then run forestprep/adprep from the Windows Server install media. Then proceed with the upgrade.
Then for good measure, run the following command from Powershell (where domain.tld is your AD name):
And finally... when the upgrades are done run the following command from Powershell (where domain.tld is your AD name):
The domain ans forest functional level looks like Windows Server 2000. Windows Server 2016 is not supported in that level.
So you need add a domain controller with a operating systems version which supports Windows Server 2000. And then upgrade the functional levels.
Windows 2000 functional levels Supported domain controller operating systems:
Windows Server 2008 R2 Windows Server 2008 Windows Server 2003 Windows 2000
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels#windows-server-2008-r2-functional-levels
Another option would be to setup a new domain with a higher functional level and migrate everything over using ADMT
Edit
So for some reason adprep is not able to reach the infrastructure master Culinary01.CVV.local
Please test connectivity with
Test-NetConnection -ComputerName Culinary01.CVV.local -Port 389, 636And make sure that is your dns server in the network adapter settingsAlso run dcdiag from a domain controller to verify if your domain is healthy