When promoting a Windows Server 2016 to DC, adprep fails with an error that an attribute or value already exists.
The DN is CN=Send-As,CN=Extended-Rights,CN=Configuration,DC=<domain>.
Forest and domain functional level is Windows Server 2008 R2, Exchange 2010 is also present in the domain. The result is the same if performed on the new-to-be DC implicit via Install-ADDSDomainController or directly on the schema master.
Here is the output from adprep:
PS C:\Temp\support\adprep> .\adprep.exe /forestprep
ADPREP WARNING:
Before running adprep, all Windows Active Directory Domain Controllers in the forest must run Windows Server 2003 or lat
er.
You are about to upgrade the schema for the Active Directory forest named '<domain>', using the Active Directo
ry domain controller (schema master) 'dc1.<domain>'.
This operation cannot be reversed after it completes.
[User Action]
If all domain controllers in the forest run Windows Server 2003 or later and you want to upgrade the schema, confirm by
typing 'C' and then press ENTER to continue. Otherwise, type any other key and press ENTER to quit.
c
Current Schema Version is 86
Upgrading schema to version 87
Verifying file signature
Connecting to "dc1.<domain>"
Logging in as current user using SSPI
Importing directory from file "C:\Temp\support\adprep\sch87.ldf"
Loading entries.
Add error on entry starting on line 1: Attribute Or Value Exists
The server side error is: 0x2083 The specified value already exists.
The extended server error is:
00002083: AtrErr: DSID-031513D7, #1:
0: 00002083: DSID-031513D7, problem 1006 (ATT_OR_VALUE_EXISTS), data 0, Att 90155 (appliesTo):len 72
0 entries modified successfully.
An error has occurred in the program
ERROR: Import from file C:\Temp\support\adprep\sch87.ldf failed. Error file is saved in C:\Windows\debug\adprep\logs\201
61125155706\ldif.err.87.
If the error is "Insufficient Rights" (Ldap error code 50), please make sure the specified user has rights to read/write
objects in the schema and configuration containers, or log off and log in as an user with these rights and rerun forest
prep. In most cases, being a member of both Schema Admins and Enterprise Admins is sufficient to run forestprep.
Adprep was unable to upgrade the schema on the schema master.
[Status/Consequence]
The schema will not be restored to its original state.
[User Action]
Check the Ldif.err log file in the C:\Windows\debug\adprep\logs\20161125155706 directory for detailed information.
Adprep was unable to update forest information.
[Status/Consequence]
Adprep requires access to existing forest-wide information from the schema master in order to complete this operation.
[User Action]
Check the log file, ADPrep.log, in the C:\Windows\debug\adprep\logs\20161125155706 directory for more information.The referenced ldif.err.87 file:
Entry DN: CN=Send-As,CN=Extended-Rights,CN=Configuration,DC=<domain>
changetype: modify
Attribute 0) appliesTo:7b8b558a-93a5-4af7-adca-c017e67f1057
Add error on entry starting on line 1: Attribute Or Value Exists
The server side error is: 0x2083 The specified value already exists.
The extended server error is:
00002083: AtrErr: DSID-031513D7, #1:
0: 00002083: DSID-031513D7, problem 1006 (ATT_OR_VALUE_EXISTS), data 0, Att 90155 (appliesTo):len 72
An error has occurred in the program
The referenced ldif.err file:
Entry DN: CN=Send-As,CN=Extended-Rights,CN=Configuration,DC=<domain>
changetype: modify
Attribute 0) appliesTo:7b8b558a-93a5-4af7-adca-c017e67f1057
Add error on entry starting on line 1: Attribute Or Value Exists
The server side error is: 0x2083 The specified value already exists.
The extended server error is:
00002083: AtrErr: DSID-031513D7, #1:
0: 00002083: DSID-031513D7, problem 1006 (ATT_OR_VALUE_EXISTS), data 0, Att 90155 (appliesTo):len 72
An error has occurred in the program
Can anyone shine some light into this matter and what to do?
Searching the internet I could not find anything resembling this.
Thanks a lot for any input!