adprep /rodcprep WS2008 和 WS2019

Question

我有一个具有以下条件的 WS2008r2 域：

• Domain functional level: WS2008r2
  

• Forest functional level: WS2003
  

我想在同一域中的远程站点中部署 RODC，但在 WS2019 中。

当我在主域上执行“adprep /rodcprep”时，出现以下错误：

D:\support\adprep>adprep /rodcprep

Adprep connected to the domain FSMO: XXX-DC01.XXX.XXX. 

==============================================================================

Adprep found partition DC=DomainDnsZones,DC=XXX,DC=XXX, and is about to update the permissions.

 
Adprep could not contact a replica for partition DC=DomainDnsZones,DC=XXX,DC=XXX.


Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).


Adprep failed the operation on partition DC=DomainDnsZones,DC=XXX,DC=XXX. Skipping to next partition.

============================================================================== 

==============================================================================

Adprep found partition DC=ForestDnsZones,DC=XXX,DC=XXX, and is about to update the permissions.

Adprep could not contact a replica for partition DC=ForestDnsZones,DC=XXX,DC=XXX.


Adprep encountered an LDAP error.

Error code: 0x0. Server extended error code: 0x0, Server error message: (null).


Adprep failed the operation on partition DC=ForestDnsZones,DC=XXX,DC=XXX. Skipping to next partition.

============================================================================== 

Adprep detected the operation on partition DC=XXX,DC=XXX has been performed. Skipping to next partition.

============================================================================== 

Adprep completed with errors. Not all partitions are updated. See the ADPrep.log

 in the C:\Windows\debug\adprep\logs\20211020101000 directory for more information.

 

To successfully update all partitions, the currently logged-on user needs to be a member of the Enterprise Admins group.  If that is not the case, please correct the problem, and then restart Adprep.

林功能级别我目前无法提高，因为 WS2003 服务器中有应用程序。

有没有办法在WS2019上配置RODC？

非常感谢。

Answer 1

• 由于您的林功能级别在 Windows Server 2003 上运行，该服务器已被 Microsoft 主动停用，因此也无法获得更新和支持。因此，因此，建议您将域功能级别升级到 Windows Server 2012 R2，将林功能级别升级到 Windows Server 2008 兼容级别。但是，由于某些应用程序和流程相关的依赖性，许多组织继续工作并依赖这些功能级别。

• 因此，要在 Windows Server 2019 操作系统上安装域控制器，环境中所需的最低林功能级别是 Windows Server 2008。此外，您可以将域功能级别设置为高于林功能的值级别，但您不能将域功能级别设置为低于林功能级别的值，因此域功能级别值始终设置为高于林功能级别的级别。

您可以参考以下文章将您环境中的林功能级别从 Windows Server 2003 升级到 Windows Server 2008，并将域功能级别从 Windows Server 2008 升级到 Windows Server 2012：-

https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/raise-active-directory-domain-forest-functional-levels

• 对于您收到的错误，您可以尝试将旧的 sysvol FRS 复制迁移到 DFSR，并使用 Dsmgmt 工具的“remove nc”参数对孤立分区执行元数据清理。有关更多信息，请参阅以下文档链接：-

https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/error-run-adprep-rodcprep-command

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc730970(v=ws.10)?redirectedfrom=MSDN