Добрый день.
Ситуация такая:
Есть DC на 2008r2, сервер называется windc, развернут на физической машине.
Есть DC на 2012r2, сервер называется windctest, развернут на Hyper-V
windctest включен в домен, является ГК
С DNS косяков быть не должно, репликации ходят без проблем. Все проверял, в журналах DNS ошибок нет на обоих серверах.
Недавно решил полностью виртуализировать AD, начал с переноса ролей и наступил на неведомые грабли,
перенес все роли FSMO кроме schema master
вот что пишет в консольке на сервере windctest при попытке трансфера мастер роли:
Скрытый текст
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server windctest
Binding to windctest ...
Connected to windctest using credentials of locally logged on user.
server connections: q
fsmo maintenance: transfer schema master
ldap_modify_sW error 0x32(50 (Insufficient Rights).
Ldap extended error message is 00002098: SecErr: DSID-0315256E, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
Win32 error returned is 0x2098(Insufficient access rights to perform the operation.)
)
Depending on the error code this may indicate a connection,
ldap, or role transfer error.
Server "windctest" knows about 5 roles
Schema - CN=NTDS Settings,CN=WINDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=profit,DC=local
Naming Master - CN=NTDS Settings,CN=WINDCTEST,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=profit,DC=local
PDC - CN=NTDS Settings,CN=WINDCTEST,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=profit,DC=local
RID - CN=NTDS Settings,CN=WINDCTEST,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=profit,DC=local
Infrastructure - CN=NTDS Settings,CN=WINDCTEST,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=profit,DC=local
Я состою в группе schema admins.
В гуях обоих серверов во вкладке "Member Of" видно группу "Shema Admins"
Интересно вот что
Это я получаю на windc в консольке whoami /groups:
Скрытый текст
Group Name Type SID Attributes
============================================= ================ =========================================== ===============================================================
PROFIT\Schema Admins Group S-1-5-21-199429320-2110906339-61651236-518 Mandatory group, Enabled by default, Enabled group
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators Alias S-1-5-32-544 Mandatory group, Enabled by default, Enabled group, Group owner
BUILTIN\Remote Desktop Users Alias S-1-5-32-555 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\REMOTE INTERACTIVE LOGON Well-known group S-1-5-14 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
PROFIT\Domain Admins Group S-1-5-21-199429320-2110906339-61651236-512 Mandatory group, Enabled by default, Enabled group
PROFIT\Enterprise Admins Group S-1-5-21-199429320-2110906339-61651236-519 Mandatory group, Enabled by default, Enabled group
PROFIT\FS IT Private FC Alias S-1-5-21-199429320-2110906339-61651236-1142 Mandatory group, Enabled by default, Enabled group
PROFIT\Access VPN to PL Alias S-1-5-21-199429320-2110906339-61651236-1432 Mandatory group, Enabled by default, Enabled group, Local Group
PROFIT\FS IT Public FC Alias S-1-5-21-199429320-2110906339-61651236-1150 Mandatory group, Enabled by default, Enabled group, Local Group
PROFIT\Denied RODC Password Replication Group Alias S-1-5-21-199429320-2110906339-61651236-572 Mandatory group, Enabled by default, Enabled group, Local Group
Mandatory Label\High Mandatory Level Label S-1-16-12288 Mandatory group, Enabled by default, Enabled group, Local Group
А это вывод той же команды на windctest:
Скрытый текст
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
============================================= ================ =========================================== ===============================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Desktop Users Alias S-1-5-32-555 Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators Alias S-1-5-32-544 Mandatory group, Enabled by default, Enabled group, Group owner
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\REMOTE INTERACTIVE LOGON Well-known group S-1-5-14 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
PROFIT\Domain Admins Group S-1-5-21-199429320-2110906339-61651236-512 Mandatory group, Enabled by default, Enabled group
PROFIT\Enterprise Admins Group S-1-5-21-199429320-2110906339-61651236-519 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1 Mandatory group, Enabled by default, Enabled group
PROFIT\FS IT Private FC Alias S-1-5-21-199429320-2110906339-61651236-1142 Mandatory group, Enabled by default, Enabled group, Local Group
PROFIT\Access VPN to PL Alias S-1-5-21-199429320-2110906339-61651236-1432 Mandatory group, Enabled by default, Enabled group, Local Group
PROFIT\FS IT Public FC Alias S-1-5-21-199429320-2110906339-61651236-1150 Mandatory group, Enabled by default, Enabled group, Local Group
PROFIT\Denied RODC Password Replication Group Alias S-1-5-21-199429320-2110906339-61651236-572 Mandatory group, Enabled by default, Enabled group, Local Group
Как так? почему на первом DC я есть в группе админов схемы, а во второй меня там нет... может в этом трабла с переносом роли мастера схемы?
Что в этом случае можно сделать? Весь гугл уже перерыл
