Temos um cliente com um ambiente de diretório ativo muito antigo no Windows Server 2008 R2. Vamos substituí-lo por um novo servidor e gostaríamos de atualizar o servidor existente para manter todas as permissões e perfis em vigor. Percebemos que precisaremos fazer isso em algumas etapas. Criamos um servidor Hyper-V para testar a atualização. Durante a tentativa inicial de atualização para 2012 R2, recebemos um erro indicando que Forestprep e Domainprep precisam ser executados. O Forestprep foi concluído com êxito, mas o Domainprep teve problemas com a replicação. Há muito tempo, havia outro servidor, mas ele foi desativado antes de conseguirmos o cliente, por isso não temos acesso a ele. Consegui remover manualmente o servidor antigo em sites e serviços para desabilitar efetivamente a replicação. Agora estou recebendo um erro de permissão ao criar CN=TPM Devices,DC=CVV, DC=local nos Serviços de Domínio Active Directory. Veja o trecho do log abaixo:
[Status/Consequence]
The operation has not run or is not currently running. It will be run next.
[2024/02/13:16:51:53.609]
Adprep was about to call the following LDAP API. ldap_add_s(). The entry to add is CN=TPM Devices,DC=CVV,DC=local.
[2024/02/13:16:51:53.610]
LDAP API ldap_add_s() finished, return code is 0x10
[2024/02/13:16:51:53.617]
Adprep was unable to create the object CN=TPM Devices,DC=CVV,DC=local in Active Directory Domain Services.
[Status/Consequence]
This Adprep operation failed.
[User Action]
Check the log file ADPrep.log in the C:\Windows\debug\adprep\logs\20240213165153 directory for more information. Restart Adprep.
[2024/02/13:16:51:53.621]
Adprep encountered an LDAP error.
Error code: 0x10. Server extended error code: 0x57, Server error message: 00000057: LdapErr: DSID-0C090CB7, comment: Error in attribute conversion operation, data 0, v1db1
DSID Info:
DSID: 0x1811100d
ldap error = 0x10
NT BUILD: 9600
NT BUILD: 16384
[2024/02/13:16:51:53.628]
Adprep was unable to update domain information.
[Status/Consequence]
Adprep requires access to existing domain-wide information from the infrastructure master in order to complete this operation.
[User Action]
Check the log file, ADPrep.log, in the C:\Windows\debug\adprep\logs\20240213165153 directory for more information.
D:\support\adprep>netdom query fsmo
Schema master Culinary01.CVV.local
Domain naming master Culinary01.CVV.local
PDC Culinary01.CVV.local
RID pool manager Culinary01.CVV.local
Infrastructure master Culinary01.CVV.local
The command completed successfully.
Executei adprep /domainprep usando um prompt de comando elevado conectado com uma conta de administrador pertencente a administradores de domínio e administradores corporativos. Alguém tem uma ideia de como corrigir esse erro?
Resultados adicionais do comando solicitados por joeqwerty:
PS C:\Users\cvvadmin> echo $host
Name : ConsoleHost
Version : 3.0
InstanceId : 9b5b8e7f-85bd-40c3-ba0b-b32a0f87f133
UI : System.Management.Automation.Internal.Host.InternalHostUserInterface
CurrentCulture : en-US
CurrentUICulture : en-US
PrivateData : Microsoft.PowerShell.ConsoleHost+ConsoleColorProxy
IsRunspacePushed : False
Runspace : System.Management.Automation.Runspaces.LocalRunspace
PS C:\Users\cvvadmin> Get-ADObject (Get-ADRootDSE).schemaNamingContext -Property objectVersion
DistinguishedName : CN=Schema,CN=Configuration,DC=CVV,DC=local
Name : Schema
ObjectClass : dMD
ObjectGUID : f91149b0-619b-4ee8-90f1-3aa164846200
objectVersion : 69
PS C:\Users\cvvadmin> Get-ADForest | fl Name,ForestMode
Name : CVV.local
ForestMode : Windows2000Forest
PS C:\Users\cvvadmin> Get-ADDomain | fl Name,DomainMode
Name : CVV
DomainMode : Windows2000Domain
Saídas PS e log de preparação de domínio:
PS C:\Users\cvvadmin> Get-ADObject (Get-ADRootDSE).schemaNamingContext -Property objectVersion
DistinguishedName : CN=Schema,CN=Configuration,DC=CVV,DC=local
Name : Schema
ObjectClass : dMD
ObjectGUID : f91149b0-619b-4ee8-90f1-3aa164846200
objectVersion : 69
PS C:\Users\cvvadmin> Get-ADForest | fl Name,ForestMode
Name : CVV.local
ForestMode : Windows2008R2Forest
PS C:\Users\cvvadmin> Get-ADDomain | fl Name,DomainMode
Name : CVV
DomainMode : Windows2008R2Domain
PS C:\Users\cvvadmin> Dfsrmig /getmigrationstate
Unable to create DFSR Migration log file. Error 1307
All Domain Controllers have migrated successfully to Global state ('Eliminated').
Migration has reached a consistent state on all Domain Controllers.
Succeeded.
Domainprep log:
[Status/Consequence]
The operation has not run or is not currently running. It will be run next.
[2024/02/14:13:29:33.022]
Adprep was about to call the following LDAP API. ldap_add_s(). The entry to add is CN=TPM Devices,DC=CVV,DC=local.
[2024/02/14:13:29:33.025]
LDAP API ldap_add_s() finished, return code is 0x10
[2024/02/14:13:29:33.033]
Adprep was unable to create the object CN=TPM Devices,DC=CVV,DC=local in Active Directory Domain Services.
[Status/Consequence]
This Adprep operation failed.
[User Action]
Check the log file ADPrep.log in the C:\Windows\debug\adprep\logs\20240214132932 directory for more information. Restart Adprep.
[2024/02/14:13:29:33.039]
Adprep encountered an LDAP error.
Error code: 0x10. Server extended error code: 0x57, Server error message: 00000057: LdapErr: DSID-0C090CB7, comment: Error in attribute conversion operation, data 0, v1db1
DSID Info:
DSID: 0x1811100d
ldap error = 0x10
NT BUILD: 9600
NT BUILD: 16384
[2024/02/14:13:29:33.048]
Adprep was unable to update domain information.
[Status/Consequence]
Adprep requires access to existing domain-wide information from the infrastructure master in order to complete this operation.
[User Action]
Check the log file, ADPrep.log, in the C:\Windows\debug\adprep\logs\20240214132932 directory for more information.