I am having a problem updating my Win2k domain to allow for a win2k3 domain server, adprep /forestprep ran ok, but when I run adprep /domainprep it fails and never runs, here is the adprep log file I receive, I appreciate any help. thanks Joe Harrison Adprep created the log file ADPrep.log under C:\WINNT\system32\debug\adprep\logs\20080903111036 directory. Adprep copied file C:\CMPNENTS\R2\ADPREP\schema.ini from installation point to local machine under directory C:\WINNT. Adprep successfully made the LDAP connection to the local domain controller 1ISBE. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is (null). LDAP API ldap_search_s() finished, return code is 0x0 Adprep successfully retrieved information from the local directory service. Adprep successfully initialized global variables. [Status/Consequence] Adprep is continuing. Adprep was about to call the following LDAP API. ldap_add_s(). The entry to add is cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_add_s() finished, return code is 0x44 Adprep attempted to create the directory service object cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. [Status/Consequence] The object exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_add_s(). The entry to add is cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_add_s() finished, return code is 0x44 Adprep attempted to create the directory service object cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. [Status/Consequence] The object exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=ab402345-d3c3-455d-9ff7-40268a1099b6,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=ab402345-d3c3-455d-9ff7-40268a1099b6,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=bab5f54d-06c8-48de-9b87-d78b796564e4,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=bab5f54d-06c8-48de-9b87-d78b796564e4,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=f3dd09dd-25e8-4f9c-85df-12d6d2f2f2f5,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=f3dd09dd-25e8-4f9c-85df-12d6d2f2f2f5,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=2416c60a-fe15-4d7a-a61e-dffd5df864d3,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=2416c60a-fe15-4d7a-a61e-dffd5df864d3,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=7868d4c8-ac41-4e05-b401-776280e8e9f1,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=7868d4c8-ac41-4e05-b401-776280e8e9f1,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=860c36ed-5241-4c62-a18b-cf6ff9994173,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=860c36ed-5241-4c62-a18b-cf6ff9994173,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=0e660ea3-8a5e-4495-9ad7-ca1bd4638f9e,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=0e660ea3-8a5e-4495-9ad7-ca1bd4638f9e,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=a86fe12a-0f62-4e2a-b271-d27f601f8182,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=a86fe12a-0f62-4e2a-b271-d27f601f8182,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=d85c0bfd-094f-4cad-a2b5-82ac9268475d,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=d85c0bfd-094f-4cad-a2b5-82ac9268475d,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=6ada9ff7-c9df-45c1-908e-9fef2fab008a,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=6ada9ff7-c9df-45c1-908e-9fef2fab008a,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=10b3ad2a-6883-4fa7-90fc-6377cbdc1b26,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=10b3ad2a-6883-4fa7-90fc-6377cbdc1b26,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=98de1d3e-6611-443b-8b4e-f4337f1ded0b,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=98de1d3e-6611-443b-8b4e-f4337f1ded0b,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=f607fd87-80cf-45e2-890b-6cf97ec0e284,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=f607fd87-80cf-45e2-890b-6cf97ec0e284,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=9cac1f66-2167-47ad-a472-2a13251310e4,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=9cac1f66-2167-47ad-a472-2a13251310e4,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=6ff880d6-11e7-4ed1-a20f-aac45da48650,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=6ff880d6-11e7-4ed1-a20f-aac45da48650,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=293f0798-ea5c-4455-9f5d-45f33a30703b,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=293f0798-ea5c-4455-9f5d-45f33a30703b,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=5c82b233-75fc-41b3-ac71-c69592e6bf15,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=5c82b233-75fc-41b3-ac71-c69592e6bf15,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=4dfbb973-8a62-4310-a90c-776e00f83222,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=4dfbb973-8a62-4310-a90c-776e00f83222,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=8437c3d8-7689-4200-bf38-79e4ac33dfa0,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=8437c3d8-7689-4200-bf38-79e4ac33dfa0,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=7cfb016c-4f87-4406-8166-bd9df943947f,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=7cfb016c-4f87-4406-8166-bd9df943947f,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=f7ed4553-d82b-49ef-a839-2f38a36bb069,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=f7ed4553-d82b-49ef-a839-2f38a36bb069,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=8ca38317-13a4-4bd4-806f-ebed6acb5d0c,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x0 Adprep checked to verify whether operation cn=8ca38317-13a4-4bd4-806f-ebed6acb5d0c,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net has completed. [Status/Consequence] The operation GUID already exists so Adprep did not attempt to rerun this operation but is continuing. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is cn=3c784009-1f57-4e2a-9b04-6915c9e71961,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x20 Adprep verified the state of operation cn=3c784009-1f57-4e2a-9b04-6915c9e71961,cn=Operations,cn=DomainUpdates,cn=System,DC=isbespr1,DC=isbe,DC=net. [Status/Consequence] The operation has not run or is not currently running. It will be run next. Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=IP Security,CN=System,DC=isbespr1,DC=isbe,DC=net. LDAP API ldap_search_s() finished, return code is 0x20 Adprep was unable to modify the security descriptor on object CN=IP Security,CN=System,DC=isbespr1,DC=isbe,DC=net. [Status/Consequence] ADPREP was unable to merge the existing security descriptor with the new access control entry (ACE). [User Action] Check the log file Adprep.log in the system root System32\Debug\Adprep\Logs directory for more information. Adprep encountered an LDAP error. Error code: 0x20. Server extended error code: 0x208d, Server error message: 0000208D: NameErr: DSID-031001BD, problem 2001 (NO_OBJECT), data 0, best match of:'CN=System,DC=isbespr1,DC=isbe,DC=net'. Adprep was unable to update domain-wide information. [Status/Consequence] Adprep requires access to existing domain-wide information from the infrastructure master in order to complete this operation. [User Action] Check the log file, Adprep.log, in the C:\WINNT\system32\debug\adprep\logs\20080903111036 directory for more information.

Hi Joe, According to the research, the issue may be related to not running ADPREP /DOMAINPREP on the Infrastructure Master Role Holder or the Infrastructure Master Role Holder is not Online. Please follow the steps to check if the issue will be re-occur. 2. Run the following command on the domain controller to find which server has the Infrastructure Master role: NETDOM QUERY FSMO 3. Try to connect to the Infrastructure Master to ensure that it is online and reachable. 4. Use a Domain Administrator account to troubleshoot and run "ADprep /DomainPrep", the "ADprep /DomainPrep" operation can either be run on the Infrastructure master. 5. Check the replication on the Infrastructure master and the DC you are running the "Adprep /domainrep" on: Repadmin /Showreps 6. Once you confirm that the Infrastructure master is reachable and AD replication in the domain is working fine but still the "IP Security" container missing in the domain, then I would like to suggest you do the following. Use LDIFDE to export the "IP Security" object from a good domain and then import it to the problem domain. EXPORT Command: Ldifde -d "CN=IP Security,CN=System,DC=<domain name>,DC=com" -m -f c:\ipsec.ldf IMPORT Command: Ldifde -i -f c:\ipsec.ldf 7. After the above operation is complete, please rerun the "ADPrep /DomainPrep" to check if the issue can be resolved. Hope it helps.David Shen - MSFT

Hello David thanks for getting back to me I have double checked and the Infrastructure Master in the DC I am running adprep on, the replication has taken place, I have even transfered the roles to another DC in my domain and still have the trouble. So I will not even be able to copy the IP Securit object over from a good domain, I am kind of lost for now.ThanksJoe

Hi Joe, Based on the research, the issue may be due to lose of the IP Security object in the system container of the Windows 2000 domain. So the IP security object may be the point of the issue. If possible, you may consider fresh install a Windows 2000 virtual machine by using Virtual PC 2007, and then promote the VM to be an DC. Afterwards, you may export the IP security settings from the VM with the following command. EXPORT Command: Ldifde -d "CN=IP Security,CN=System,DC=<domain name>,DC=com" -m -f c:\ipsec.ldf And then import the ipsec.ldf file to the real production system with the command. IMPORT Command: Ldifde -i -f c:\ipsec.ldf Download Virtual PC 2007 http://www.microsoft.com/downloads/details.aspx?familyid=04D26402-3199-48A3-AFA2-2DC0B40A73B6&displaylang=en Hope it helps.David Shen - MSFT

Ok, I have setup a fresh 2000 server then I promoted it to be DC, but the IP Security CN is missing from the new DC as well, is there anything else that you can think of that will help me get that CN back so that I can up date my DC. Let me know.thanksJoe

Hi Joe, Well, I have already built a local domain system and export the entries of IP security object. Could you please send your valid e-mail address to tfwst@microsoft.com so that I can send the ipsec.ldf file for you to import?David Shen - MSFT

I am still having problem with adprep /domainpredrunning, I am missing the IP Security object out of the system folder in AD, does anyone know how I can recreate the object.thanksJoe