Support Documentation
Thursday, June 10, 2010
10:15 AM
Prepare a Windows 2000 or Windows Server 2003 Forest Schema for a Domain Controller That Runs Windows Server 2008 or Windows Server 2008 R2
Updated: March 11, 2010
Applies To: Windows Server 2008, Windows Server 2008 R2
Before you can add a domain controller that is running Windows Server 2008 or Windows Server 2008 R2 to an Active Directory environment running Windows 2000 Server or Windows Server 2003, you must update the Active Directory schema. To update the schema, you must run Adprep.exe from the Windows Server 2008 or Windows Server 2008 R2 installation DVD on your existing domain controller that hosts the schema operations master role. In Windows Server 2008, Adprep.exe is located in the /Sources/adprep folder of the operating system installation DVD. In Windows Server 2008 R2, adprep.exe is located in the /Support/adprep folder.
Review the list of operations that are performed by Adprep.exe, and test the schema updates in a lab environment to ensure that they will not conflict with any applications that run in your environment. There should not be any conflicts if your applications use Request for Comments (RFC)–compliant object and attribute definitions. For a list of specific operations that are performed when you update the Active Directory schema, see Windows Server 2008: Appendix of Changes to Adprep.exe to Support AD DS and Windows Server 2008 R2: Appendix of Changes to Adprep.exe to Support AD DS.
After you prepare the forest, prepare any domain where you plan to install a domain controller that runs Windows Server 2008 or Windows Server 2008 R2. For more information, see Prepare a Windows 2000 or Windows Server 2003 Domain for a Domain Controller That Runs Windows Server 2008 or Windows Server 2008 R2.
If you are creating a new forest, you do not have to prepare the schema or any of the domains in the forest.
Use the following procedure to update the Windows Server 2003 or Windows 2000 Server Active Directory schema for Windows Server 2008 or Windows Server 2008 R2.
Administrative credentials
To perform this procedure, you must use an account that has membership in all of the following groups:
- Enterprise Admins
- Schema Admins
- Domain Admins for the domain that contains the schema master
To prepare the forest schema for Windows Server 2008 or Windows Server 2008 R2
- Log on to the schema master as a member of the Enterprise Admins, Schema Admins, and Domain Admins groups.
|
Note |
| If you are unsure which domain controller hosts the schema master role, you can run netdom query fsmo on any domain controller. |
- Insert the Windows Server 2008 or Windows Server 2008 R2 DVD into the CD or DVD drive.
- Click Start, click All Programs, click Accessories, right-click Command prompt, and then click Run as administrator.
- If you are using the Windows Server 2008 DVD, type the following command, and then press ENTER:
D:\sources\adprep\adprep /forestprep
If you are using the Windows Server 2008 R2 DVD, type the following command, and then press ENTER:
|
Important |
| Windows Server 2008 R2 includes a 32-bit and 64-bit version of Adprep.exe. The 64-bit version runs by default. If you want to run one of the Adprep.exe commands on a 32-bit computer, use the 32-bit version of Adprep.exe (Adprep32.exe). |
D:\support\adprep\adprep /forestprep
- Allow the operation to complete, and then allow the changes to replicate throughout the forest before you prepare any domains for a domain controller that runs Windows Server 2008 or Windows Server 2008 R2. For more information about running adprep /domainprep, see Prepare a Windows 2000 or Windows Server 2003 Domain for a Domain Controller That Runs Windows Server 2008 or Windows Server 2008 R2.
|
Note |
| If you plan to add a read-only domain controller (RODC) to the forest, you can run adprep /rodcprep right after you run adprep /forestprep and then verify that both operations have replicated throughout the forest. Both commands require Enterprise Admin credentials; therefore, you might prefer to |
Windows Server 2008 R2: Forest-Wide Updates
Updated: July 22, 2009
Applies To: Windows 7, Windows Server 2008, Windows Server 2008 R2
You can review the following list of changes to help understand the schema updates that are performed by adprep /forestprep in Windows Server 2008 R2 and prepare for them. The adprep /forestprep command must be completed and the changes must replicate throughout the forest before you can add domain controllers that run Windows Server 2008 R2. For more information about how to run adprep /forestprep, see Prepare a Windows 2000 or Windows Server 2003 Forest Schema for a Domain Controller That Runs Windows Server 2008 or Windows Server 2008 R2. To determine if adprep /forestprep completed successfully, you can use ADSIEdit to verify the value of the Revision attribute of the ActiveDirectoryUpdate container. If all the operations that are performed by the adprep /forestprep command in Windows Server 2008 R2 (79, 80, 81, 82, and 83) complete successfully, the Revision attribute for the CN=ActiveDirectoryUpdate,CN=ForestUpdates,CN=Configuration,DC=ForestRootDomain object is set to 5:
Operation 79: {21ae657c-6649-43c4-bb-b3-7f-18-4f-df-58-c1}
Add an access control entry (ACE) to the object CN=Partitions in the Configuration directory partition.
Permissions:
- Add (OA;;RP;5706aeaf-b940-4fb2-bcfc-5268683ad9fe;;AU)
Operation 80:{dca8f425-baae-47cd-b4-24-e3-f6-c7-6e-d0-8b}
Update display specifier for contact-Display object to set attribute treatAsLeaf default value to TRUE.
Operation 81: {a662b036-dbbe-4166-b4ba-21abea17f9cc}
Update display specifiers.
Operation 82: {9d17b863-18c3-497d-9bde-45ddb95fcb65}
Add an ACE to the object CN=Sites in the Configuration directory partition.
Permissions:
- Add {OA;CIIO;SW;d31a8757-2447-4545-8081-3bb610cacbf2;f0f8ffab-1191-11d0-a060-00aa006c33ed;RO}
Operation 83: {11c39bed-4bee-45f5-b195-8da0e05b573a}
Add an ACE to the object CN=ms-DS-Managed-Service-Account in the Schema directory partition.
Permissions:
- Add {OA;;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;;ED}
Prepare a Forest for a Read-Only Domain Controller
Updated: January 5, 2009
Applies To: Windows Server 2008, Windows Server 2008 R2
Before you can install a read-only domain controller (RODC) in a Windows Server 2003 forest or in a forest in which you have upgraded the domain controller to Windows Server 2008 or Windows Server 2008 R2, you must prepare the forest by running the adprep /rodcprep command. You can run adprep /rodcprep from the installation DVD on any computer in the forest. In Windows Server 2008, Adprep.exe is located in the /Sources/adprep folder of the operating system installation DVD. In Windows Server 2008 R2, Adprep.exe is located in the /Support/adprep folder.
This operation runs remotely. It contacts the infrastructure master for each domain and for each application directory partition to update the permissions. This includes the infrastructure master for the two default Domain Name System (DNS) application directory partitions (ForestDNSZones and DomainDNSZones) that are created in an Active Directory–integrated DNS environment. For a list of specific operations that are performed when you prepare a forest for an RODC, see Windows Server 2008: Read-Only Domain Controller Updates.
If you are attempting to run adprep /rodcprep in an isolated environment, the infrastructure master for each domain and for each application directory partition must be available within the environment for the operation to succeed. This requirement can cause adprep to generate an error if, for example, the infrastructure master for an application directory partition is offline or if it has been forcefully removed from a domain without metadata cleanup being performed. For more information about how to resolve such errors, see article 949257 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=114419).
You have to run this command only once in the forest. However, you can rerun this command any time if it fails to complete successfully because an infrastructure master is not available.
Use the following procedure to prepare a forest for an RODC.
Administrative credentials
To perform this procedure, you must be a member of the Enterprise Admins group.
To prepare a forest for an RODC
- Log on to any computer in the forest as a member of the Enterprise Admins group.
- Insert the Windows Server 2008 or Windows Server 2008 R2 DVD into the CD or DVD drive.
- Click Start, right-click Command prompt, and then click Run as administrator.
- If you are using the Windows Server 2008 DVD, type the following command, and then press ENTER:
D:\sources\adprep\adprep /rodcprep
If you are using the Windows Server 2008 R2 DVD, type the following command, and then press ENTER:
|
Important |
| Windows Server 2008 R2 includes 32-bit and 64-bit versions of Adprep.exe. The 64-bit version runs by default. If you want to run one of the Adprep.exe commands on a 32-bit computer, use the 32-bit version of Adprep.exe (Adprep32.exe). |
D:\support\adprep\adprep /rodcprep
Where D: is the drive letter of your CD or DVD drive.
- Allow the operation to complete, and then allow the changes to replicate throughout the forest before you try to install an RODC.
Prepare a Windows 2000 or Windows Server 2003 Domain for a Domain Controller That Runs Windows Server 2008 or Windows Server 2008 R2
Updated: January 5, 2009
Applies To: Windows Server 2008, Windows Server 2008 R2
Use the following procedure to prepare a Windows 2000 or Windows Server 2003 domain for domain controllers that run Windows Server 2008 or Windows Server 2008 R2. To prepare the domain, run Adprep.exe from the installation DVD on your existing domain controller that hosts the infrastructure master role. In Windows Server 2008, Adprep.exe is located in the /Sources/adprep folder of the operating system installation DVD. In Windows Server 2008 R2, Adprep.exe is located in the /Support/adprep folder.
Review the list of operations that are performed by Adprep.exe and test the updates in a lab environment to ensure that they will not conflict with any applications that run in your environment. For a list of specific operations that are performed when you update the Active Directory domain, see Windows Server 2008: Domain-Wide Updates and Windows Server 2008 R2: Domain-Wide Updates.
Administrative credentials
To perform this procedure, you must be a member of the Domain Admins group. Membership in the Enterprise Admins group is not sufficient to perform this procedure.
To prepare a domain for Windows Server 2008 or Windows Server 2008 R2
- Identify the domain infrastructure operations master (also known as flexible single master operations or FSMO) role holder as follows:
- In the Active Directory Users and Computers snap-in, right-click the domain object, click Operations Masters, and then click Infrastructure.
- Log on to the infrastructure master as a member of the Domain Admins group.
- Insert the Windows Server 2008 or Windows Server 2008 R2 DVD into the CD or DVD drive.
- Click Start, click All Programs, click Accessories, right click Command prompt, and then click Run as administrator.
10. If you are using the Windows Server 2008 DVD, type the following command, and then press ENTER:
D:\sources\adprep\adprep /domainprep /gpprep
Where D: is the drive letter of your CD or DVD drive.
If you are using the Windows Server 2008 R2 DVD, type the following command, and then press ENTER:
|
Important |
| Windows Server 2008 R2 includes 32-bit and 64-bit versions of Adprep.exe. The 64-bit version runs by default. If you want to run one of the Adprep.exe commands on a 32-bit computer, use the 32-bit version of Adprep.exe (Adprep32.exe). |
D:\support\adprep\adprep
11. Allow the operation to complete, and then allow the changes to replicate throughout the forest before you install a domain controller that runs Windows Server 2008 or Windows Server 2008 R2.
Windows Server 2008 R2: Domain-Wide Updates
Updated: July 22, 2009
Applies To: Windows 7, Windows Server 2008, Windows Server 2008 R2
If the operation that is performed by the domainprep command in Windows Server 2008 R2 (operations 75, 76, and 77) complete successfully, the revision attribute for the CN=ActiveDirectoryUpdate,CN=DomainUpdates,CN=System,DC=ForestRootDomain object is set to 5:
Operation 75: {5e1574f6-55df-493e-a6-71-aa-ef-fc-a6-a1-00}
Create the following object:
- CN=Managed Service Accounts
Attributes:
- objectClass: Container
- Description: Default container for managed services accounts
- ShowInAdvancedViewOnly: FALSE
Permissions:
- (A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)
- (A;;RPWPCRCCDCLCLORCWOWDSW;;;DA)
- (OA;;CCDC;ce206244-5827-4a86-ba1c-1c0c386c1b64;;AO)
- OA;;CCDC;bf967aba-0de6-11d0-a285-00aa003049e2;;AO)
- (OA;;CCDC;bf967a9c-0de6-11d0-a285-00aa003049e2;;AO)
- (A;;RPLCLORC;;;AU)
Operation 76: {d262aae8-41f7-48ed-9f-35-56-bb-b6-77-57-3d}
Add the following value to the multivalued attribute otherWellKnownObject of the domain directory partition:
- B:32:1EB93889E40C45DF9F0C64D23BBB6237:CN=Managed Service Accounts,<distinguished name of the domain>
Operation 77: {82112ba0-7e4c-4a44-89d9-d46c9612bf91}
Create the follow object:
Attributes:
- objectClass: msImaging-PSPs
Pasted from <http://technet.microsoft.com/en-us/library/dd378973(WS.10).aspx>