I'm am using the instructions here to upgrade my Windows Server 2012 AD Controller to Windows Server 2019. This server is a isolated AD controller that has no other server/clients connected to it in any way.

When I run the following on this server:

./adprep.exe /forestprep /forest Dev

I am presented with the following error:

Adprep could not contact the Schema FSMO STORMDEMO.DEV.EBM.COM. The Schema FSMO must be reachable for this operation to proceed. [Status/Consequence] The Active Directory Domain Services schema is not upgraded. [User Action] Check the log file ADPrep.log in the C:\Windows\debug\adprep\logs\20220119160049 directory for possible cause of failure .

Adprep encountered a Win32 error. Error code: 0x2095 Error message: A directory service error has occurred.

Adprep was unable to check the specified user's group membership. [Status/Consequence] Adprep has stopped without making changes. [User Action] Verify the specified user is a member of Enterprise Admins group and Schema Admins group if /forestprep is specified, or is a member of Domain Admins group if /domainprep is specified, or is a member of Enterprise Admins group if /rodcprep is specified .

Adprep encountered a Win32 error. Error code: 0x2095 Error message: A directory service error has occurred.

This error is preventing me with proceeding with my windows upgrade process. I've checked my user account running this and attempted to run it with a elevated and under the "Administrator" account but am always presented with the same error message. My user account and the "Administrator" user account are members of the mentioned groups above.

Googling the specific error message(0x2095 Error message: A directory service error has occurred.) only leads me to vague posts related to other operations without clear solutions.

Does anyone understand what causes this issue, and/or have a resolution to this issue?

Update 1

Both answers we're useful, I followed the suggestions and figured out that there was some confusion around the FSMO roles, the server name is "EBM-TFS" and when I ran "netdom query FSMO" I got the following:

Schema master               STORMDEMO.DEV.EBM.COM
Domain naming master        STORMDEMO.DEV.EBM.COM
PDC                         EBM-TFS.DEV.EBM.COM
RID pool manager            EBM-TFS.DEV.EBM.COM
Infrastructure master       EBM-TFS.DEV.EBM.COM

I was able to seize the "Schema Master" role using powershell(First I run Ntdsutil, which fails, then I run Move-ADDirectoryServerOperationMasterRole -Identity "EBM-TFS" -OperationMasterRole schemaMaster), however I wasn't able to seize the "Domain naming master" role with either that or "ntdsutil":

Move-ADDirectoryServerOperationMasterRole : The directory service is unavailable At line:1 char:1

• Move-ADDirectoryServerOperationMasterRole -Identity "EBM-TFS" -OperationMasterRo ...

ntdsutil:

fsmo maintenance: transfer naming master ldap_modify_sW error 0x34(52 (Unavailable). Ldap extended error message is 000020AF: SvcErr: DSID-0321041F, problem 5002 (UN AVAILABLE), data -2146893022

Win32 error returned is 0x20af(The requested FSMO operation failed. The current FSMO holder could not be contacted.) )

Didn't matter though as I was able to run suggestion three(Rerun adprep /forestprep without /forest Dev) by @joeqwerty and this was successful, and I was able to proceed with the windows upgrade process.

Active Directory, OpenLDAP or Apple's Open Directory have different schemas for holding user info and group membership. Having a Open Directory here I can say for example that user's Distinguished Name is attribute dn, while it seems to be distinguishedName for AD.

Is there a site that references how the main DS hold the info, and if not why not start to list them here? I searched for it but couldn't find it.

I'm looking for the following:

• User
  • distinguished name
  • email address
  • username (aka login)
  • real name (aka full name)
• Group
  • member list

An LDAP server on another is reporting an unusually large number of attempts to read the LDAP directory and attempting a number of users, all of which look like hacking attempts to read user/password information. These happen every minute. It reports that the originating IP is a Mac OS X 10.4 Tiger Server which is a file server on the network for iMacs.

When I run lsof -i:ldap +c 0 on the Mac server, it returns

COMMAND          PID USER   FD   TYPE    DEVICE SIZE/OFF NODE NAME
DirectoryService  60 root   11u  IPv4 0x38de228      0t0  TCP mymacserver.com:50106->myldapserver.com:ldap (ESTABLISHED)

Running ps -Aj gives

USER PID PPID PGID    SESS JOBC STAT TT     TIME COMMAND
[...]
root  60    1   60 290c7e4    0 Ss   ??  0:19.00 /usr/sbin/DirectoryService

Running cat /Library/Logs/DirectoryService/DirectoryService.server.log gives

2012-02-15 15:01:29 EST - DirectoryService 2.1 (v353.6) starting up...
2012-02-15 15:01:29 EST - Initializing TCP ...
2012-02-15 15:01:29 EST - Plugin <Configure>, Version <1.7>, processed successfully.
2012-02-15 15:01:29 EST - Plugin <NetInfo>, Version <1.7.4>, processed successfully.
2012-02-15 15:01:29 EST - Plugin <LDAPv3>, Version <1.7.4>, processed successfully.
2012-02-15 15:01:29 EST - Plugin <Search>, Version <1.7>, processed successfully.
2012-02-15 15:01:29 EST - Plugin "Active Directory", Version "1.5.8", is set to load lazily.
2012-02-15 15:01:29 EST - Plugin "AppleTalk", Version "1.3", is set to load lazily.
2012-02-15 15:01:29 EST - Plugin "Bonjour", Version "1.3", loaded successfully.
2012-02-15 15:01:29 EST - Plugin "BSD", Version "1.2.2", is set to load lazily.
2012-02-15 15:01:29 EST - Plugin "PasswordServer", Version "3.1.2", is set to load lazily.
2012-02-15 15:01:29 EST - Plugin "SLP", Version "1.3.1", is set to load lazily.
2012-02-15 15:01:29 EST - Plugin "SMB", Version "1.3", is set to load lazily.
2012-02-15 15:01:29 EST - Registered node /Configure
2012-02-15 15:01:29 EST - Registered node /Search
2012-02-15 15:01:29 EST - Plug-in Configure state is now active.
2012-02-15 15:01:29 EST - Registered node /Search/Contacts
2012-02-15 15:01:29 EST - Registered node /Search/Network
2012-02-15 15:01:29 EST - Plug-in Bonjour state is now active.
2012-02-15 15:01:29 EST - Plug-in Search state is now active.
2012-02-15 15:01:29 EST - Plug-in LDAPv3 state is now active.
2012-02-15 15:01:29 EST - Registered node /NetInfo/DefaultLocalNode
2012-02-15 15:01:29 EST - Plug-in NetInfo state is now active.
2012-02-15 15:01:32 EST - Network transition occurred.
2012-02-15 15:01:35 EST - Registered Locally Hosted Node /NetInfo/DefaultLocalNode
2012-02-15 15:01:41 EST - Network transition occurred.
2012-02-15 15:01:41 EST - Network transition occurred.
2012-02-15 15:01:41 EST - Network transition occurred.

(The time is when the server was rebooted several hours ago.) This has been going on for several days.

Is there a way to see what is calling the DirectoryService every minute?

I cannot use netstat -p, since Mac OS X 10.4 Tiger does not support the -p option.

I need to disable this malicious script, but I cannot disable the LDAP client completely, as users rely on this server for file storage and user ids.

EDIT:

I ran sudo killall -USR1 DirectoryService to enable to debug log, and it seems that memberd and lookupd are calling DirectoryService.

I'm trying to manually install a daemon (Oracle Grid Engine) on my machine, and I would like it to run under an isolated account. What is the preferred way, using Directory Services, to add a "system" account to the local machine on OS X? Plenty of them exist in /etc/passwd (_www, _dovecot, etc.), but comments at the top of that file say that it isn't used except in single-user mode.

I'm running on 10.6, and do not require any special networked account management. I'm hoping for something simple--the equivalent of useradd on nearly every other Unix-like OS.

We've had a child DC fail on us, and can't get into Windows on it as Directory Services is failing. A restore of the backed-up active directory hasn't worked due to a corruption, and so we've decided to demote the child DC and - for now - run AD from the PDC only.

However, dcpromo /demote doesn't work from Safe Mode or Directory Services Restore Mode.

We don't want to do a complete reinstall, as we have Exchange running on the child DC.

Anyone know how (if?) we can demote the DC within safe mode or otherwise get into windows?

Thanks