Error verifying Global Catalog server

Question

Hi Everyone,

I'm Jayson, newbie in Windows Server Administration. This is my first time posting here in Microsoft. Hope could find the right solution.

Here's my scenario: 

I have 2 domain controllers in a Windows 2000 Forest (Domain A), Server A and Server B. Server A contains all the FSMO Role and holding the Global Catalog while Server B is not a GC and obviously not a FSMO holder. Server A went down because of a Hardware Problem and cannot boot up anymore. Seizing the all FSMO role will using NTDSUTIL was my first option but it always failed. Users authentication is not possible at this point, luckily Windows 2000 Forest (Domain A) has an existing Forest Trust to a Windows 2008 Forest (Domain B) so I authenticated there and managed to connect Active Directory services of Windows 2000 Forest. From there i was able to force transfer the PDC Role, Infrastructure, RID and Schema Master (Using ADUC and AD Schema GUI). And there comes my problem seizuring Domain Naming Master. In GUI (AD Domains and Trust), Change Operations master is greyed out and in NTDSUTIL (CMD) i got this error:

ldap_modify_sW error 0x35(53 (Unwilling To Perform).

Ldap extended error message is 0000214B: SvcErr: DSID-

03210792, problem 5003 (WI

LL_NOT_PERFORM), data 0

Win32 error returned is 0x214b(Only DSAs configured to be

Global Catalog servers

should be allowed to hold the Domain Naming Master FSMO

role.)

)

Depending on the error code this may indicate a connection,

ldap, or role transfer error.

Role seizure is forbidden in this case

So from here i made Server B as Global Catalog but another problem came up, it does not recognized it self as a Global Catalog. From here i also determine that the Authentication problem also caused by the GC holder was down and creation of unique User Objects is not possible even thought RID Master has been seize already. I got this error by the way:

"Windows cannot validate the uniqueness of this proposed user name with global catalog server because:

The server is not operational. Windows will create this user account, but the user can log on only after the

username is verified to be unique. "

Hope someone has solved this. Many Thans!

Answer 1

Hi,

I would request you to post the question on Windows TechNet server Forums:

Here is the link:

https://social.technet.microsoft.com/Forums/windowsserver/en-US/home

Regards,