none
EnterpriseReference Test Failure after Raising Domain Functional Level Server 2003 --> Server 2008

    Question

  • Hi,

    I have a couple child domains in a larger forest.  The forest is at a Server 2003 functional level.  I recently raised two of the child domains to a Server 2008 functional level in hopes of enabling some of the new functionality. Things seem to be working correctly, but I am recieving the following when I run dcdiag /test:VerifyEnterpriseReferences:
     
    Starting test: VerifyEnterpriseReferences
       The following problems were found while verifying various important DN references.  Note, that  these problems can be reported because
       of latency in replication.  So follow up to resolve the following problems, only if the same problem is reported on all DCs for a given
       domain or if  the problem persists after replication has had reasonable time to replicate changes.
    
          [1] Problem: Missing Expected Value
           Base Object: CN=ChildDomainC2,OU=Domain Controllers,DC=ChildDomain,DC=ParentDomain,DC=COM
           Base Object Description: "DC Account Object"
           Value Object Attribute Name: msDFSR-ComputerReferenceBL
           Value Object Description: "SYSVOL FRS Member Object"
           Recommended Action: See Knowledge Base Article: Q312862
    
          [2] Problem: Missing Expected Value
           Base Object: CN=ChildDomainC3,OU=Domain Controllers,DC=ChildDomain,DC=ParentDomain,DC=COM
           Base Object Description: "DC Account Object"
           Value Object Attribute Name: msDFSR-ComputerReferenceBL
           Value Object Description: "SYSVOL FRS Member Object"
           Recommended Action: See Knowledge Base Article: Q312862

    LDAP Error 0x5e (94) - No result present in message. ......................... ChildDomainC2 failed test VerifyEnterpriseReferences

    I found the following article on what the correct value for this attribute should be, and verified it against a working child domain. Like the previous people who tried this fix, I do not seem to be able to edit the value.  http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/2ce07c3f-9956-4bec-ae46-055f311c5d96.   

    Here is the output I get when trying to edit the attribute via LDP:


    -----------
    ***Call Modify...
    ldap_modify_s(ld, 'CN=ChildDomainC2,OU=Domain Controllers,DC=ChildDomain,DC=ParentDomain,DC=COM',[1] attrs);
    Error: Modify: Constraint Violation. <19>
    Server error: 000020B1: AtrErr: DSID-030F0D1E, #1:
    	0: 000020B1: DSID-030F0D1E, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 230067 (msDFSR-ComputerReferenceBL)
    
    Error 0x20B1 The attribute cannot be modified because it is owned by the system.
     I followed the instructions here to see if I could edit the attribute in a test forest, but no dice.  http://adsearch-winzero.blogspot.com/2007/11/how-to-change-system-only-attributes.html

    Does anyone know if this is something I really need to worry about?  Do I need to call Microsoft to modify that attribute?

    I appreciate your help!
    • Edited by mbrat Monday, August 10, 2009 10:25 PM
    Monday, August 10, 2009 10:22 PM

Answers

All replies

  • Hi,

    Please refer to the following thread to troubleshoot this error.

    Dcdiag test failed on VerifyEnterpriseReferences
    http://social.technet.microsoft.com/forums/en-US/winserverDS/thread/f992e40d-823f-4a9c-bb0c-5811e9fcc005

    If it still occurs, please help to collect requested information for research.

    1. MPS Report.
    2. LDIFDE report.

    Thanks.


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Wednesday, August 12, 2009 6:00 AM
  • Mervyn,

    Thank you for the response.  I looked at the thread you pointed me to and it directed me to a Microsoft article on updating FRS and DFS References (http://technet.microsoft.com/en-us/library/cc794759(WS.10).aspx).  My FRS member objects look correct, ie, the names of the DCs are correct. 

    Looking at the second step about the DFSR member objects, under DFSR-GlobalSettings, I only have a replication group for a file server, and there is no Domain System Volume node.  Comparing to another child domain that has never used DFSR for file services (though they use it by default for the DCs), they do not have a DFSR-GlobalSettings node.  

    I suspect that this error comes up in DCdaig when a domain's FL is raised on a domain where DFSR is in use.  I've tried removing DFSR (which takes all the child nodes out of DFSR-GlobalSettings), but the error still comes up. 

    I can't run the LDIFDE report on the DC because the Domain System Volume does not exist. 

    As in the thread you referred me to, when I ran the MPS Report, the DCDiag logs in the report files show that my DC passes the VerifyEnterpriseReferences test, but if I run the DCDiag, I receive the failure still. 

    Is it right to conclude that the DCDiag utility included on Serve 2008 has a bug, but that the one included in the MPS Report utility does not? 

    Thanks again for your help!

    • Marked as answer by mbrat Monday, January 04, 2010 9:18 PM
    • Unmarked as answer by mbrat Friday, April 09, 2010 3:17 PM
    Wednesday, August 12, 2009 4:07 PM
  • Hi,

    Please check the version of these DCDIAG file. I suggest we trust the latest version. Also, check if there is any related error in Event Log.

    Thanks.


    This posting is provided "AS IS" with no warranties, and confers no rights.
    • Marked as answer by Mervyn ZhangModerator Monday, August 17, 2009 6:18 AM
    • Unmarked as answer by mbrat Monday, August 17, 2009 2:24 PM
    Friday, August 14, 2009 10:45 AM
  • Mervyn,

    I checked and the version of DCDiag included on Windows is newer than the one in the MS Report application...what do you reccomend I do next?

    Thanks!
    Monday, August 17, 2009 2:24 PM
  • Thought I'd throw a little update in here since I am still seeing this test fail. I researched the issue again and came up with some much more useful information this time:

     

    Problem:  http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/2ce07c3f-9956-4bec-ae46-055f311c5d96

     

    References:

    http://technet.microsoft.com/en-us/library/dd641227(WS.10).aspx

    http://technet.microsoft.com/en-us/library/dd641052(WS.10).aspx

    • Marked as answer by mbrat Friday, April 09, 2010 3:17 PM
    Friday, April 09, 2010 3:16 PM