Error 8224 when extending active directory schema
Hello
I am experiecing an issue when attempting to extend my AD Schema for SCCM 2007.
I am using 2008 R2 and have followed the instructions in
http://technet.microsoft.com/en-au/library/bb680608.aspx
I get the following in the ExtADSch
<06-22-2010 17:53:11> Modifying Active Directory Schema - with SMS extensions.
<06-22-2010 17:53:11> DS Root:CN=Schema,CN=Configuration,DC=stpauls,DC=qld,DC=edu,DC=au
<06-22-2010 17:53:11> Failed to create attribute cn=MS-SMS-Site-Code. Error code = 8224.
<06-22-2010 17:53:11> Failed to create attribute cn=mS-SMS-Assignment-Site-Code. Error code = 8224.
<06-22-2010 17:53:11> Failed to create attribute cn=MS-SMS-Site-Boundaries. Error code = 8224.
<06-22-2010 17:53:11> Failed to create attribute cn=MS-SMS-Roaming-Boundaries. Error code = 8224.
<06-22-2010 17:53:11> Failed to create attribute cn=MS-SMS-Default-MP. Error code = 8224.
<06-22-2010 17:53:11> Failed to create attribute cn=mS-SMS-Device-Management-Point. Error code = 8224.
<06-22-2010 17:53:11> Failed to create attribute cn=MS-SMS-MP-Name. Error code = 8224.
<06-22-2010 17:53:11> Failed to create attribute cn=MS-SMS-MP-Address. Error code = 8224.
<06-22-2010 17:53:11> Failed to create attribute cn=mS-SMS-Health-State. Error code = 8224.
<06-22-2010 17:53:11> Failed to create attribute cn=mS-SMS-Source-Forest. Error code = 8224.
<06-22-2010 17:53:11> Failed to create attribute cn=MS-SMS-Ranged-IP-Low. Error code = 8224.
<06-22-2010 17:53:11> Failed to create attribute cn=MS-SMS-Ranged-IP-High. Error code = 8224.
<06-22-2010 17:53:12> Failed to create attribute cn=mS-SMS-Version. Error code = 8224.
<06-22-2010 17:53:12> Failed to create attribute cn=mS-SMS-Capabilities. Error code = 8224.
<06-22-2010 17:53:12> Failed to create class cn=MS-SMS-Management-Point. Error code = 8202.
<06-22-2010 17:53:12> Failed to create class cn=MS-SMS-Server-Locator-Point. Error code = 8202.
<06-22-2010 17:53:12> Failed to create class cn=MS-SMS-Site. Error code = 8202.
<06-22-2010 17:53:12> Failed to create class cn=MS-SMS-Roaming-Boundary-Range. Error code = 8202.
<06-22-2010 17:53:12> Failed to extend the Active Directory schema.
Any assistance with this would be greatly appreciated.
Thanks
William Hickson
June 22nd, 2010 4:37am
Hi,
In addition, this issue can be also related to replication errors on domain controllers
http://social.technet.microsoft.com/Forums/en-GB/configmgrsetup/thread/7f803d86-9b2e-4656-ad44-ab5cbcc8e9d9
Free Windows Admin Tool Kit Click here and download it now
June 22nd, 2010 1:26pm
Hi Kent
I was logged on as the domain admin account. I have double checked that this is a member of enterprise admins and schema admins. I did notice some replication errors in the ds event log that all appeared be to happening while the server was disconnected
from the network (as per instructions in technet article).
this is the error:
This server is the owner of the following FSMO role, but does not consider it valid. For the partition which contains the FSMO, this server has not replicated successfully with any of its partners since this server has been restarted.
Replication errors are preventing validation of this role.
Operations which require contacting a FSMO operation master will fail until this condition is corrected.
FSMO Role: DC=stpauls,DC=qld,DC=edu,DC=au
User Action:
1. Initial synchronization is the first early replications done by a system as it is starting. A failure to initially synchronize may explain why a FSMO role cannot be validated. This process is explained in KB article 305476.
2. This server has one or more replication partners, and replication is failing for all of these partners. Use the command repadmin /showrepl to display the replication errors. Correct the error in question. For example there maybe problems with IP connectivity,
DNS name resolution, or security authentication that are preventing successful replication.
3. In the rare event that all replication partners being down is an expected occurance, perhaps because of maintenance or a disaster recovery, you can force the role to be validated. This can be done by using NTDSUTIL.EXE to seize the role to the same server.
This may be done using the steps provided in KB articles 255504 and 324801 on http://support.microsoft.com.
The following operations may be impacted:
Schema: You will no longer be able to modify the schema for this forest.
Domain Naming: You will no longer be able to add or remove domains from this forest.
PDC: You will no longer be able to perform primary domain controller operations, such as Group Policy updates and password resets for non-Active Directory Domain Services accounts.
RID: You will not be able to allocation new security identifiers for new user accounts, computer accounts or security groups.
Infrastructure: Cross-domain name references, such as universal group memberships, will not be updated properly if their target object is moved or renamed.
This error is not occuring today and repadmin /showrepl shows that all in well.
Would this be because our DNS servers are not contactable while the server is disconnected? can the schema extensions be perforemd while connected to the network or is this not advisable?
Thanks
William
June 22nd, 2010 10:40pm
You don't have to disconnect any DC at all. It's just a precaution in case something fails during extending the schema. I've never heard of any problems when running extadsch.exe for ConfigMgr.
Free Windows Admin Tool Kit Click here and download it now
June 23rd, 2010 2:25am
Never ever ever disconnect any domain controller, System Management container should be replicated on DCs, otherwise you can not extend the AD schema for SCCM, so connect your DC and make sure that the replication works well between DCs
June 23rd, 2010 3:48am
System Management container should be replicated on DCs, otherwise you can not extend the AD schema for SCCM
System Management container and schema extensions are two totally separate things and have nothing to do with each other.
Free Windows Admin Tool Kit Click here and download it now
June 23rd, 2010 3:53am
Yes Trosten, I know this (when extending the schema for SCCM, several classes and attributes are added in AD) and
I think you misunderstood me,
In addition, if the container does not replicate between DCs we will have problems later, anyway we should never diconnect DC when extending AD Sch for ConfigMgr
June 23rd, 2010 4:03am
Please use this article i have 2 DC one was down. i run that DC and run force replica and it worked for me. i am using Win 2008 R2 64 bit with SCCM 2007.
http://www.windowsitpro.com/article/john-savills-windows-faqs/q-why-can-t-i-update-the-active-directory-ad-schema-for-microsoft-systems-management-server-sms-schema-update-is-enabled-and-i-have-schema-admins-permission-
Free Windows Admin Tool Kit Click here and download it now
May 12th, 2012 3:48pm
Hi Willam.
I had a similar issue when I tried running the extadsch.exe on my windows server 2003 sp2 virtual machine. I got similar error.Though the account was a part of the domain admins, schema admins and enterprise admins, it didn't work. I then noticed that
while trying to delete the extadsch.log file I was receiving an error which said I do not have the privileges. Then I added that user account to the Domain Controllers group. Then ran extadsch.exe again and this time it worked successfully.
You could probably try that too.
Good luck!
July 25th, 2012 2:46pm