Errors with FSMO Role owner, and it's very urgent.

[swemho]

We had a little problem in our AD, one of our dc's (also exchange server) went dead, so in replacing it we could do a proper demotion, thus it is still "on the network".

I've used ntdsutil do clean up the metadata and remove it that way, and removed it from Active Directory Domains and Trusts. So this far it all seems fine, and the second (we only have 2) domain controller should seize control of the schema etc after approx 15 minutes, but it doesn't.
I've tried to use ntdsutil and Active Directory Schema mmc to change the schema master, but without result. It just can't be done, it claims that the old server is still the schema master. And I do not understand this since I have done virtually everything in my power to remove it from our AD.

The real problem is that I cannot install exchange on the new server because I cannot do /forestprep nor /domainprep, thus no installation. Because it claims that it cannot access the Active Directory, nor contact the Schema master. Alas we have no mail.
Can someone give me some helpful tips ?

Best Regards,

Marcus Hansebo

 

[Andreh]

What security rights does the user you are using to attempt to run this have? It sounds like you have a fair idea what you are doing and don't mean to ask a simple question, just wondering if this user has sufficient rights?

The user will need Enterprise Admins/Schema Admins permssions.

Cheers.

 

[swemho]

I'm an enterprise admin, and schema admin, well basically I'm every admin there is =).

The thing is I wasn't in place when this domain controller went ballistic on us, so I couldn't really see if I could help out in phase one. So it feels like the who AD is messed up.

But it looks like if it all comes down to the schema.

 

[Hondy]

Can't you just take ownership of the FSMO role onto your other DC?

 

[swemho]

as I mentioned earlier, I've tried to use ntdsutil and the Schema MMC, but it is not possible to change the schema master, it says it cannot contact the current schema master DOH, of course it can't it's not there. But the strange this is that I have manually removed the old DC, so it should automatically transfer that role, which it doesn't. And this should as you say leave me with the manual option, which also fails. Thus I'm in knee deep shit. I don't feel like reinstalling the whole AD (no we don't have any backups of the AD) just because of this. There ought to be some hacking way of achieving what I want.

 

[Hondy]

Go to Active Directory Users and Computers, at the top level right-click and properties, check the RID allocation etc. and take control of the roles.

Does this help?

 

[Hondy]

Sorry, I just checked, it's not properties, it's operations masters...