Error 8224 when extending active directory schema
Hello I am experiecing an issue when attempting to extend my AD Schema for SCCM 2007. I am using 2008 R2 and have followed the instructions in http://technet.microsoft.com/en-au/library/bb680608.aspx I get the following in the ExtADSch <06-22-2010 17:53:11> Modifying Active Directory Schema - with SMS extensions. <06-22-2010 17:53:11> DS Root:CN=Schema,CN=Configuration,DC=stpauls,DC=qld,DC=edu,DC=au <06-22-2010 17:53:11> Failed to create attribute cn=MS-SMS-Site-Code. Error code = 8224. <06-22-2010 17:53:11> Failed to create attribute cn=mS-SMS-Assignment-Site-Code. Error code = 8224. <06-22-2010 17:53:11> Failed to create attribute cn=MS-SMS-Site-Boundaries. Error code = 8224. <06-22-2010 17:53:11> Failed to create attribute cn=MS-SMS-Roaming-Boundaries. Error code = 8224. <06-22-2010 17:53:11> Failed to create attribute cn=MS-SMS-Default-MP. Error code = 8224. <06-22-2010 17:53:11> Failed to create attribute cn=mS-SMS-Device-Management-Point. Error code = 8224. <06-22-2010 17:53:11> Failed to create attribute cn=MS-SMS-MP-Name. Error code = 8224. <06-22-2010 17:53:11> Failed to create attribute cn=MS-SMS-MP-Address. Error code = 8224. <06-22-2010 17:53:11> Failed to create attribute cn=mS-SMS-Health-State. Error code = 8224. <06-22-2010 17:53:11> Failed to create attribute cn=mS-SMS-Source-Forest. Error code = 8224. <06-22-2010 17:53:11> Failed to create attribute cn=MS-SMS-Ranged-IP-Low. Error code = 8224. <06-22-2010 17:53:11> Failed to create attribute cn=MS-SMS-Ranged-IP-High. Error code = 8224. <06-22-2010 17:53:12> Failed to create attribute cn=mS-SMS-Version. Error code = 8224. <06-22-2010 17:53:12> Failed to create attribute cn=mS-SMS-Capabilities. Error code = 8224. <06-22-2010 17:53:12> Failed to create class cn=MS-SMS-Management-Point. Error code = 8202. <06-22-2010 17:53:12> Failed to create class cn=MS-SMS-Server-Locator-Point. Error code = 8202. <06-22-2010 17:53:12> Failed to create class cn=MS-SMS-Site. Error code = 8202. <06-22-2010 17:53:12> Failed to create class cn=MS-SMS-Roaming-Boundary-Range. Error code = 8202. <06-22-2010 17:53:12> Failed to extend the Active Directory schema. Any assistance with this would be greatly appreciated. Thanks William Hickson
June 22nd, 2010 4:37am

Hi, In addition, this issue can be also related to replication errors on domain controllers http://social.technet.microsoft.com/Forums/en-GB/configmgrsetup/thread/7f803d86-9b2e-4656-ad44-ab5cbcc8e9d9
Free Windows Admin Tool Kit Click here and download it now
June 22nd, 2010 1:26pm

Hi Kent I was logged on as the domain admin account. I have double checked that this is a member of enterprise admins and schema admins. I did notice some replication errors in the ds event log that all appeared be to happening while the server was disconnected from the network (as per instructions in technet article). this is the error: This server is the owner of the following FSMO role, but does not consider it valid. For the partition which contains the FSMO, this server has not replicated successfully with any of its partners since this server has been restarted. Replication errors are preventing validation of this role. Operations which require contacting a FSMO operation master will fail until this condition is corrected. FSMO Role: DC=stpauls,DC=qld,DC=edu,DC=au User Action: 1. Initial synchronization is the first early replications done by a system as it is starting. A failure to initially synchronize may explain why a FSMO role cannot be validated. This process is explained in KB article 305476. 2. This server has one or more replication partners, and replication is failing for all of these partners. Use the command repadmin /showrepl to display the replication errors. Correct the error in question. For example there maybe problems with IP connectivity, DNS name resolution, or security authentication that are preventing successful replication. 3. In the rare event that all replication partners being down is an expected occurance, perhaps because of maintenance or a disaster recovery, you can force the role to be validated. This can be done by using NTDSUTIL.EXE to seize the role to the same server. This may be done using the steps provided in KB articles 255504 and 324801 on http://support.microsoft.com. The following operations may be impacted: Schema: You will no longer be able to modify the schema for this forest. Domain Naming: You will no longer be able to add or remove domains from this forest. PDC: You will no longer be able to perform primary domain controller operations, such as Group Policy updates and password resets for non-Active Directory Domain Services accounts. RID: You will not be able to allocation new security identifiers for new user accounts, computer accounts or security groups. Infrastructure: Cross-domain name references, such as universal group memberships, will not be updated properly if their target object is moved or renamed. This error is not occuring today and repadmin /showrepl shows that all in well. Would this be because our DNS servers are not contactable while the server is disconnected? can the schema extensions be perforemd while connected to the network or is this not advisable? Thanks William
June 22nd, 2010 10:40pm

You don't have to disconnect any DC at all. It's just a precaution in case something fails during extending the schema. I've never heard of any problems when running extadsch.exe for ConfigMgr.
Free Windows Admin Tool Kit Click here and download it now
June 23rd, 2010 2:25am

Never ever ever disconnect any domain controller, System Management container should be replicated on DCs, otherwise you can not extend the AD schema for SCCM, so connect your DC and make sure that the replication works well between DCs
June 23rd, 2010 3:48am

System Management container should be replicated on DCs, otherwise you can not extend the AD schema for SCCM System Management container and schema extensions are two totally separate things and have nothing to do with each other.
Free Windows Admin Tool Kit Click here and download it now
June 23rd, 2010 3:53am

Yes Trosten, I know this (when extending the schema for SCCM, several classes and attributes are added in AD) and I think you misunderstood me, In addition, if the container does not replicate between DCs we will have problems later, anyway we should never diconnect DC when extending AD Sch for ConfigMgr
June 23rd, 2010 4:03am

Please use this article i have 2 DC one was down. i run that DC and run force replica and it worked for me. i am using Win 2008 R2 64 bit with SCCM 2007. http://www.windowsitpro.com/article/john-savills-windows-faqs/q-why-can-t-i-update-the-active-directory-ad-schema-for-microsoft-systems-management-server-sms-schema-update-is-enabled-and-i-have-schema-admins-permission-
Free Windows Admin Tool Kit Click here and download it now
May 12th, 2012 3:48pm

Hi Willam. I had a similar issue when I tried running the extadsch.exe on my windows server 2003 sp2 virtual machine. I got similar error.Though the account was a part of the domain admins, schema admins and enterprise admins, it didn't work. I then noticed that while trying to delete the extadsch.log file I was receiving an error which said I do not have the privileges. Then I added that user account to the Domain Controllers group. Then ran extadsch.exe again and this time it worked successfully. You could probably try that too. Good luck!
July 25th, 2012 2:46pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics