If all your existing Win2K DCs meet this requirement, type C and press Enter to continue. Otherwise, type any other key and press Enter to quit.
After you type C to confirm that you want to run Forestprep, then press Enter, the utility will start upgrading the schema, working its way from version 14 to version 30. Figure 1 shows a portion of this upgrade.
Before you can take the next step and run Domainprep in a domain, the schema changes must replicate to at least the infrastructure operations master in that domain. I recommend that you let the Forestprep schema updates replicate throughout the entire forest before you move on to Domainprep.
Forestprep Under the Covers
Even though the Forestprep operation is a significant schema upgrade, it doesn't add or remove any attributes in the partial attribute set. The partial attribute set is a subset of all the AD attributes in the Global Catalog (GC). In Win2K, changing which attributes are marked for the GC will cause a resynchronization of the GC on every DC in the forest. In a forest that contains large domains, such an operation on a DC can take days. If you have an application such as Exchange 2000 that depends heavily on the GC, the impact on your users will be even greater. The Forestprep operation doesn't affect the GC, however.
Forestprep performs two major functions. First, it runs schupgr.exe, the Win2K schema upgrade utility. Schupgr executes sequentially against the C:\%system-root%\system23\schxx.ldf files, in which xx changes from 14 to 30. These files contain the changes Forestprep makes to AD, so if you want to identify the AD updates, look in these files. If for some reason you must restart Forestprep, the process will continue from the most recent successful schxx.ldf file update. Second, Forestprep changes ACLs in the configuration partition. In Win2K and Windows NT 4.0, the Everyone group includes the Guests group (i.e., anonymous logons). Windows 2003 has tightened this definition; the Everyone group now contains Authenticated Users but not Guests. For DCs to read information in other domains, you need to adjust some ACLs on existing objects by adding Read rights for the Enterprise Domain Controllers group.
Adprep maintains detailed logs of all its activities in C:\%systemroot%\system32\debug\adprep\logs\YYYYmmDDhhMMss\adprep.log, where YYYYmmDDhhMMss represents the year, month, day, hour, minute, and second when you ran Adprep. This naming convention ensures that each Adprep execution gets its own unique folder, which also contains detailed logs of the execution of each LDIF file. These logs describe the execution's success on the schema master.
But how do you know when these changes have replicated throughout your forest? After Forestprep has successfully finished, it creates a Windows 2003 Update container in CN=ForestUpdates,CN=Configuration,DC=rootdomain,DC=company, DC=com, where rootdomain and company are the names of your root domain and company. An easy way to track the schema updates throughout the forest is to connect to the bridgehead servers of your major sites with ADSI Edit to determine when Forestprep creates this container.
Another way to determine that Forestprep replication has reached a particular DC is by checking the value of the ObjectVersion attribute on that DC. You can use ldp.exe (in the Win2K Support Tools) on the DC whose version you want to check. To do so, launch Ldp and select Connection, Connect; enter the target DC in the Connect dialog box; and click OK. Next, bind to the DC with a valid account and password. Select Browse, Search, and the schema container (CN=Schema,CN=Configuration,DC=yourdomain,DC=xyz, where yourdomain and xyz are your domain's name and extension—e.g., com, org, net). Enter the LDAP query (objectversion=*) in the Filter text field and select Subtree on the Scope tab to search the schema container for the value of ObjectVersion beyond the base distinguished name (DN) and throughout the subtree. Your output should look something like
ldap_search_s(ld,"CN=Schema,
CN=Configuration,
DC=domain1,DC=deuby,DC=net",
2, "(objectversion=*)", attrList,
0, &msg)
Result <0>: (null)
Matched DNs:
Getting 1 entries:
\>> Dn: CN=Schema,
CN=Configuration,
DC=domain1,DC=deuby,
DC=net
1> objectVersion: 30;
Register
