Exchange Server Pro » Active Directory

Exchange 2007 ADPrep Error Executing Ldifde.exe to Import Schema File

Paul Cunningham — Sun, 22 May 2011 10:40:53 +0000

When you are preparing an Active Directory Forest for Exchange Server 2007 installation you may encounter this error:

An error occurred when executing ‘ldifde.exe’ to import schema file ‘C:\Admin\ex2007\Setup\ServerRoles\Common\Setup\Data\PostWindows2003_schema0.ldf’. Error code: 8206. More details can be found in the error file ‘C:\Users\Administrator\AppData\Local\Temp\2\ldif.err’.

On inspection of the ldif.err file the following information is shown:

Entry DN: CN=ms-Exch-Access-Control-Map,CN=Schema,CN=Configuration,DC=exchangeserverpro,DC=netAdd error on entry starting on line 1: Busy
The server side error is: 0x21a2 The FSMO role ownership could not be verified because its directory partition has not replicated successfully with atleast one replication partner.
The extended server error is:
000021A2: SvcErr: DSID-030A0AF2, problem 5001 (BUSY), data 0

This error can occur in multi-Domain Controller environments where replication issues exist. However it can also occur in single-Domain Controller environments under some conditions due to an apparent bug in the Exchange Server 2007 SP1 and SP2 setup files.

Using the Exchange Server 2007 SP3 setup files to extend the schema should resolve the issue.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange 2010 Setup Error – The Exchange Server is in an Inconsistent State

Paul Cunningham — Sun, 08 Aug 2010 11:30:48 +0000

When launching Exchange Server 2010 setup you may encounter this error message.

The Exchange Server is in an inconsistent state. Only disaster recovery mode is available. Please use Setup /m:RecoverServer to recover this Exchange server.

This can occur when the Exchange server object already exists within Active Directory, which can occur when a server has been uninstalled and you are attempting to reinstall it.

If you do not wish to use disaster recovery mode to reinstall the server you must first remove the Exchange server object from Active Directory.

Launch ADSIEdit.msc and navigate to CN=Configuration, CN=Services, CN=Microsoft Exchange, CN=, CN=Administrative Groups, CN= , CN=Servers, CN=, and then delete the server object.

In this example screenshot the server name is EX2.

After deleting the object you may need to wait for the change to replicate throughout Active Directory. Then you can relaunch Exchange setup and proceed with your installation as planned.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange 2000 and Windows Server 2008 Domain Controllers

Paul Cunningham — Thu, 03 Jun 2010 09:00:04 +0000

A reader emailed me to ask how they can go about upgrading their current environment without breaking Exchange.

They are currently running Exchange Server 2000 with Windows Server 2000 domain controllers, and wish to transition to Exchange Server 2007 and Windows Server 2008 domain controllers.

Although you can transition from Exchange 2000 to 2007 the problem in this case is the move from Windows Server 2000 to Windows Server 2008. Exchange 2000 will not work with Windows Server 2008 domain controllers, and Exchange 2007 will not work with Windows Server 2000 domain controllers.

From Microsoft:

Exchange 2000 Server Service Pack 3 and all previous versions of Microsoft Exchange are not for use with Windows Server 2008 directory servers. The following restrictions apply with respect to Exchange 2000 Server Service Pack 3:

Exchange 2000 Server Service Pack 3 can exist in an Active Directory forest that contains Windows Server 2008 directory servers, but Windows Server 2008 directory servers should not be installed in Active Directory Sites that contain Exchange 2000 Server.

If Windows Server 2008 directory servers must be deployed Active Directory Sites that contain Exchange 2000 Server you must first hard-code directory service access (DSAccess) on the Exchange 2000 Server servers in the site to point to directory servers running Windows Server 2003 or Windows 2000 Server.

In other words, at some point the reader will need to install a Windows Server 2003 domain controller to make the whole transition possible.

My recommendation is to use these general steps:

Install a Windows Server 2003 domain controller into the site(s) that will be hosting Exchange Server 2007, so that the environment pre-requisites for Exchange 2007 are met (ie, Windows Server 2003 SP1 DC/GC in the AD Site hosting Exchange 2007, plus the Schema Master must be Windows Server 2003 SP1)
Transition from Exchange Server 2000 to Exchange Server 2007
Introduce Windows Server 2008 domain controllers into the environment where required (upgrading the temporary Windows Server 2003 DC to 2008 is supported too)

Get more Exchange Server tips at ExchangeServerPro.com

Exchange 2010 Deployment: Preparing Active Directory

Paul Cunningham — Fri, 14 May 2010 11:15:23 +0000

The first step when installing Exchange Server 2010 is to prepare the Active Directory schema.

Applying the Exchange Server 2007 SP2 Schema Update

When installing to an existing Exchange 2003 organization, and to retain backward compatibility with Exchange Server 2007, the Active Directory schema updates for Exchange Server 2007 are applied first.

You must perform these steps with an account that is a member of the Enterprise Admins and Schema Admins groups.

Exchange Server 2007 setup will not run on Windows Server 2008 R2, even just to perform the schema update. If you have installed Windows Server 2008 R2 to run Exchange Server 2010 you will need to run the Exchange Server 2007 schema update from a different server that runs either:

Windows Server 2003 Service Pack 2 with
Windows Server 2008 with Windows Installer 4.5, or
Windows Server 2008 Service Pack 2

Note that the server you run the schema update from cannot be an existing Exchange server.

If you have installed Windows Server 2008 to run Exchange Server 2010 you can run the schema update on that server.

The server must reside in the same Active Directory Site as the Schema Master, and you will need to use the 32-bit or 64-bit Exchange Server 2007 setup files to match the operating system of the server you will run the schema update from.

Download the Exchange Server 2007 files from Microsoft and extract them the server. Launch a Command Prompt and run the Exchange Server 2007 schema update.

setup /PrepareAD

Applying the Exchange Server 2010 Schema Update

You must perform these steps with an account that is a member of the Enterprise Admins and Schema Admins groups. The server that you run the update from must reside in the same Active Directory Site as the Schema Master.

Download the Exchange Server 2010 files from Microsoft and extract them the server. Launch a Command Prompt and run the Exchange Server 2010 schema update.

setup /PrepareAD

If you have an Active Directory with multiple Domain Controllers you should wait for the new schema to replicate throughout the network before proceeding.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange 2010 Planning: Verifying Your Existing Network Environment

Paul Cunningham — Mon, 10 May 2010 10:52:36 +0000

Before you can deploy Exchange Server 2010 into an existing Exchange organization you must verify that your existing network environment meets the pre-requisites.

Active Directory Pre-Requisites

Active Directory requires the following to support Exchange Server 2010.

Component	Requirement
Schema Master	The Schema Master must be running one of the following operating systems: Windows Server 2003 Standard/Enterprise with SP1 (x86 or x64) Windows Server 2003 R2 Standard/Enterprise with SP1 (x86 or x64) Windows Server 2008 Standard/Enterprise (x86 or x64) Windows Server 2008 R2 Standard/Enterprise
Global Catalog	In each Site that will contain an Exchange server there must be at least one Global Catalog running one of the above operating systems.
Domain Controller	In each Site that will contain an Exchange server there must be at least one writable Domain Controller running one of the above operating systems.
Functional Level	Windows Server 2003 Functional mode or higher.

Exchange Organization Pre-Requisites

The existing Exchange Organization must be at least Exchange 2003 Native Mode, and all Exchange servers must be at least Exchange Server 2003 with Service Pack 2.

Exchange Pre-Deployment Analyzer

The Microsoft Exchange Pre-Deployment Analyzer is used to scan existing environments to verify their readiness for Exchange Server 2010.

Download the Exchange Pre-Deployment Analyzer tool from Microsoft and install it on your Exchange Server 2003 server.

Step through the wizard to perform a scan of your Exchange Organization, and address any outstanding issues that it reports.

Exchange Server 2007 Compatibility

When you are transitioning from Exchange Server 2003 to Exchange Server 2010 it is recommended to first run the Exchange Server 2007 Active Directory schema update. This ensures that if the need arises later on that an Exchange Server 2007 server can be installed into the environment.

If only the Exchange Server 2010 schema update is applied you can never add an Exchange Server 2007 server to the environment.

Link State Suppression

The Exchange Pre-Deployment Analyzer report may warn you that Link State Suppression is not enabled on the Exchange Server 2003 servers. Link State Suppression is only required if you plan to add more than one connector between the Exchange Server 2010 server and existing Exchange Server 2003 servers.

Get more Exchange Server tips at ExchangeServerPro.com

Security descriptor error during Exchange Server 2007 schema extension

Paul Cunningham — Thu, 25 Feb 2010 03:19:00 +0000

During Exchange Server 2007 schema extension you may encounter a security descriptor error which will cause setup to fail. The error may occur specifically during the “setup /PrepareAD” stage.

>setup /preparead

Welcome to Microsoft Exchange Server 2007 Unattended Setup

Preparing Exchange Setup

No server roles will be installed

Performing Microsoft Exchange Server Prerequisite Check

    Organization Checks              ......................... COMPLETED

Configuring Microsoft Exchange Server

    Organization Preparation         ......................... FAILED
     You do not have permissions to read the security descriptor on CN=Deleted O
bjects,CN=Configuration,DC=domain,DC=com,DC=au.

The Exchange Server Setup operation did not complete. For more information,visit
http://support.microsoft.com and enter the Error ID.

Exchange Server setup encountered an error.

To resolve this issue use the following steps for Windows Server 2003. For Windows Server 2008 skip to step 3, and be sure to launch an elevated privileges command prompt to run the commands.

Download and install the ADAM tools from Microsoft.
Go to Start -> Programs -> ADAM and launch ADAM Tools Command Prompt.

In the command prompt, run the following command (substitute your domain name where appropriate):

C:\WINDOWS\ADAM>dsacls "CN=Deleted Objects,DC=domain,DC=com,dc=au" /takeownership
Owner: DOMAIN\Domain Admins
Group: NT AUTHORITY\SYSTEM

Access list:
{This object is protected from inheriting permissions from the parent}
Allow BUILTIN\Administrators  SPECIAL ACCESS
                              LIST CONTENTS
                              READ PROPERTY
Allow NT AUTHORITY\SYSTEM     SPECIAL ACCESS
                              DELETE
                              READ PERMISSONS
                              WRITE PERMISSIONS
                              CHANGE OWNERSHIP
                              CREATE CHILD
                              DELETE CHILD
                              LIST CONTENTS
                              WRITE SELF
                              WRITE PROPERTY
                              READ PROPERTY

The command completed successfully

Re-run Exchange setup. It should now successfully extend the schema.

Link: http://support.microsoft.com/default.aspx?scid=kb;EN-US;892806

Updated: 25/2/2010 with Windows Server 2008 information.

Get more Exchange Server tips at ExchangeServerPro.com

Preparing for an Exchange Server 2007 Transition

Paul Cunningham — Mon, 17 Aug 2009 20:00:09 +0000

Before you begin the transition to Exchange Server 2007 you must first verify that your existing network environment is ready for Exchange Server 2007 and download the essentials software and tools for an Exchange Server 2007 transition.

Download the Exchange Server 2007 software and tools

Download the following software so that you have everything you need on hand for the installation.

For production Exchange servers only the 64-bit versions are required, however the 32-bit versions will be useful if you are deploying the Exchange Management Tools to administrative workstations or other hosts such as backup servers.

.NET 1.1 (x86 only – required for the ExBPA)
.NET 2.0 with Service Pack 1 (x86 and x64)
MMC 3.0 (x86 and x64)
PowerShell (x86 and x64)
Exchange Server 2007 with Service Pack 1 (both versions)
The latest update rollup for Exchange Server 2007 (both versions)
Exchange Best Practices Analyzer (version 2.8 or later)

Verify your existing network environment

Use this checklist to confirm that your network environment meets the pre-requisites for Exchange Server 2007.

Active Directory Functional Level

Both minimum functional levels must be met:

Domain functional level Windows 2000 Server Native Mode
Forest functional level Windows 2000 Server Native mode

Domain Controllers

There must be at least one Domain Controller and Global Catalog server in the same AD Site as the Exchange Server running Windows Server 2003 with Service Pack 1, and the Schema Master for the Forest must be at least Windows Server 2003 with Service Pack 1.

Incompatible features of Exchange Server 2000

These features must be removed:

Microsoft Mobile Information Server
Instant Messaging Service
Exchange Chat Service
Exchange 2000 Conferencing Server
Key Management Service
Cc:Mail Connector
MSMail Connector

Incompatible features of Exchange Server 2003

These features must be removed:

Novell Groupwise Connector
Network News Transport Protocol (NNTP)

Exchange Organization Mode

The Exchange Organization must be Native Mode. See Preparing a Mixed Mode Organization for Conversion to Native Mode.

Exchange legacy servers

Any existing legacy Exchange servers must be at least:

Exchange Server 2000 with Service Pack 3, or
Exchange Server 2003 with Service Pack 2

Link State Routing

Link State Routing must be disabled. See How to Suppress Link State Updates.

Exchange Server 2007 Readiness Check

The Exchange Server 2007 Readiness Check test performed by the Exchange Best Practices Analyzer must pass.

Get more Exchange Server tips at ExchangeServerPro.com

Windows Server 2003 32-bit R2 media needed to prep a non-R2 domain before first 64-bit R2 DC can be promoted

Paul Cunningham — Thu, 19 Feb 2009 10:00:00 +0000

In one of life’s “chicken and egg” situations I recently encountered the issue of promoting a Windows Server 2003 64-bit R2 server to be a Domain Controller in an environment with only Windows Server 2003 32-bit (non-R2) servers as existing Domain Controllers.

DCPromo will tell you that the Forest has not been prepared for the version of Windows you are trying to promote (ie, R2). This would normally not be a problem, the R2 media contains an adprep.exe to update the schema for R2 Domain Controllers.

Of course if you take your new 64-bit R2 disc 2 media and try to run adprep on the 64-bit server you will receive this error:

C:\WINDOWS\CMPNENTS\R2\ADPREP>adprep /forestprep
Adprep cannot run on this platform because it is not a domain controller.
[Status/Consequence]
Adprep stopped without making any changes.
[User Action]
Run Adprep on a domain controller.

Makes sense, so of course you put the disc into your existing Domain Controller and run adprep again.

Z:\>adprep /forestprep
The image file Z:\ADPREP.EXE is valid, but is for a machine type other than the
current machine.

Thats right, you can’t use your 64-bit media to run adprep on a 32-bit Domain Controller. This is where the chicken and egg scenario kicks in – how do you get your 64-bit R2 server to be a Domain Controller with no pre-existing 64-bit or R2 Domain Controllers available for the required schema update? Its not like Microsoft ships you a 32-bit copy of the OS when you buy the 64-bit edition.

The solution is to get your hands on the 32-bit R2 media. If you don’t have a friend or colleague with a copy the next easiest way to get it is from the trial software downloads on Microsoft.com. Go here and jump through the ridiculous hoops to “buy” a $0.00 trial edition so that you can download the ISO files. You only need to download and burn the ISO for disc 2 which contains the R2 adprep.exe and schema files.

Update: you can also download this hotfix that contains only the R2 adprep files.

Get more Exchange Server tips at ExchangeServerPro.com

Problem accessing Active Directory for Exchange 2007 OWA users

Paul Cunningham — Thu, 25 Sep 2008 20:23:15 +0000

Recently I posted about one cause of Outlook Web Access errors that users may experience after their mailbox is migrated from Exchange 2003 to Exchange 2007. Users are presented with a browser error containing the message:

Exception type: Microsoft.Exchange.Data.Storage.StoragePermanentException
Exception message: There was a problem accessing Active Directory.

In addition to that common cause I outlined previously there is another cause of this issue that can arise. This usually occurs if an administrator uses the legacy Exchange System Manager tools (eg as part of the Active Directory Users & Computers new account wizard) to create a user mailbox on an Exchange 2007 mailbox server. The legacy tools assign an incorrect attribute to the user account, which is explained further in this Microsoft support article:

This issue occurs when the msExchVersion attribute is not set correctly on the user object in the Active Directory.

Exchange 2007 uses the msExchVersion attribute to determine the version of Exchange that user objects are associated with. If the version value is less than 0.1, Exchange 2007 considers the object “read-only” and cannot write changes to the object.

Note The msExchVersion attribute may not set correctly if you created the user’s mailbox by using the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in instead of by using the Exchange 2007 Management Console.

To resolve the issue you can use the following Exchange Management Shell cmdlet:

Set-Mailbox User_Name -ApplyMandatoryProperties

To check a user for the correct attribute use the Get-Mailbox cmdlet. In my example here you can see both the correct and incorrect attributes displayed.

[PS] C:\>get-mailbox User1 | fl ExchangeVersion

ExchangeVersion : 0.1 (8.0.535.0)

[PS] C:\>get-mailbox User2 | fl ExchangeVersion

ExchangeVersion : 0.0 (6.5.6500.0)

If you have several mailboxes affected by this issue you can find them with this command:

[PS] C:\>get-mailbox | where {$_.ExchangeVersion -like "0.0*" -and $_.ServerName
 -eq "exchange2007"}

Name                      Alias                ServerName       ProhibitSendQuota
----                      -----                ----------       ---------------
User2                     User2                exchange2007     unlimited

Similarly you can use this command to correct multiple mailboxes at once:

[PS] C:\>get-mailbox | where {$_.ExchangeVersion -like "0.0*" -and $_.ServerName
 -eq "exchange2007"} | Set-Mailbox -ApplyMandatoryProperties

Links:

Error message when users try to log on to Outlook Web Access in Exchange 2007: “A problem occurred while trying to use your mailbox”

Get more Exchange Server tips at ExchangeServerPro.com

Users unable to access Outlook Web Access after mailbox moves

Paul Cunningham — Sun, 27 Jul 2008 20:00:08 +0000

Some users may report that they are not able to access OWA after their mailbox has been moved to the Exchange Server 2007 server.

Check the properties of the account in Active Directory Users & Computers and verify that in the Security tab the account is configured to inherit permissions. If the tick box is cleared you should tick it and apply the change.

On a larger scale this can be quite problematic. If you find you need to apply this change to a lot of user accounts you can do it with a few quick command lines.

First use DSQuery to dump out a list of user accounts in an OU into an text file.

C:\>dsquery user ou=network users,dc=test,dc=local -scope subtree -limit 0 >users.txt

Using -scope subtree means DSQuery will enumerate the user accounts for all sub-OUs as well. Using -limit 0 ensures that the results will not be cut off by the default limit of 100.

You can now use a For loop to process each user account with DSACLs.

C:\>for /F "delims=" %i in (users.txt) do (dsacls %i /P:N)

Be sure to set “delims=” as shown so that the spaces in the distinguished names of the users don’t get treated as delimiters.

It can be tempting to dump out the user list of the entire domain and apply this fix, but before you go down that path make sure you read and understand this article published by Microsoft.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange Server Pro » Active Directory

Exchange 2007 ADPrep Error Executing Ldifde.exe to Import Schema File

Related posts:

Exchange 2010 Setup Error – The Exchange Server is in an Inconsistent State

Related posts:

Exchange 2000 and Windows Server 2008 Domain Controllers

Related posts:

Exchange 2010 Deployment: Preparing Active Directory

Applying the Exchange Server 2007 SP2 Schema Update

Applying the Exchange Server 2010 Schema Update

Related posts:

Exchange 2010 Planning: Verifying Your Existing Network Environment

Active Directory Pre-Requisites

Exchange Organization Pre-Requisites

Exchange Pre-Deployment Analyzer

Exchange Server 2007 Compatibility

Link State Suppression

Related posts:

Security descriptor error during Exchange Server 2007 schema extension

Related posts:

Preparing for an Exchange Server 2007 Transition

Download the Exchange Server 2007 software and tools

Verify your existing network environment

Active Directory Functional Level

Domain Controllers

Incompatible features of Exchange Server 2000

Incompatible features of Exchange Server 2003

Exchange Organization Mode

Exchange legacy servers

Link State Routing

Exchange Server 2007 Readiness Check

Related posts:

Windows Server 2003 32-bit R2 media needed to prep a non-R2 domain before first 64-bit R2 DC can be promoted

Related posts:

Problem accessing Active Directory for Exchange 2007 OWA users

Related posts:

Users unable to access Outlook Web Access after mailbox moves

Related posts: