Home All Groups Group Topic Archive Search About

Administrator has Insufficient Privaleges to Transfer FSMOs from PDC to Secondary DC

Author
11 Feb 2006 12:59 AM
Don
Sorry for the multi-post.  I meant to do this as a cross-post to both
microsoft.public.win2000.setup and microsoft.public.win2000.general to get a
little more exposure.

My apologies in advance to those offended by multi-posts!

Don


Show quoteHide quote
"Don" <some***@somewhere.net> wrote in message news:...
> I am trying to temporarily transfer a DC to another machine so we can
> rebuild the first machine.  Thanks to several folks in these newsgroups I
> got the scoop on how to do this.  So far, I managed to set up a second
> domain controller on the network (this is a stand-alone network with about
a
> dozen machines in a lab).  I was in the process of transferring the FSMOs
to
> the secondary machine when I ran into problems.
>
> When I try to transfer the RID, PDC, Infrastructure, Schema, etc I get an
> error for each which basically say:
>
> The transfer of the operations master role cannot be performed because:
The
> requested FSMO operation failed.  The current FSMO holder could not be
> contacted.
>
> (I say "basically the same" because in a couple cases it asks if I want to
> try a forced transfer.)  According to what I read, this is usually caused
by
> insufficient account privileges.  Well, I was in the domain administrator
> account which has about every permission I could find and a member of the
> Domain Administrators group, schema group, etc, etc.  I was also doing it
> from the machine which is currently the DC.
>
> From what I have read, this is the preferred way of performing the
transfer.
> There is a way to "pull" the FSMOs over to the secondary machine by
logging
> in to it and using command line commands.  However, some of the reading
> imply that doing a "pull" will render the old domain controller unable to
> resume as DC.  Yes, I know that ultimately I am putting a clean machine
back
> in, but there is some sensitivity to being able to return things to they
way
> they were if the rebuild does not work.  (The rebuild is a hard drive
swap,
> so I will have the old drive with everything on it.)  I am also concerned
> that the "pull" approach only half works and I am stuck with the old DC
> being lobotomized and the new, temporary DC with not enough smarts to do
the
> job.
>
> Anyone have insight into why "The current FSMO holder could not be
> contacted." and how to resolve the problem?  Any other suggestions would
be
> greatly appreciated too!
>
> Thanks!
>
> Don
>
>
>
>
>
>

Author
11 Feb 2006 4:44 AM
seth
Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller
http://support.microsoft.com/kb/255504/en-us



Show quoteHide quote
"Don" <some***@somewhere.net> wrote in message
news:OYtrUXqLGHA.2036@TK2MSFTNGP14.phx.gbl...
> Sorry for the multi-post.  I meant to do this as a cross-post to both
> microsoft.public.win2000.setup and microsoft.public.win2000.general to get
> a
> little more exposure.
>
> My apologies in advance to those offended by multi-posts!
>
> Don
>
>
> "Don" <some***@somewhere.net> wrote in message news:...
>> I am trying to temporarily transfer a DC to another machine so we can
>> rebuild the first machine.  Thanks to several folks in these newsgroups I
>> got the scoop on how to do this.  So far, I managed to set up a second
>> domain controller on the network (this is a stand-alone network with
>> about
> a
>> dozen machines in a lab).  I was in the process of transferring the FSMOs
> to
>> the secondary machine when I ran into problems.
>>
>> When I try to transfer the RID, PDC, Infrastructure, Schema, etc I get an
>> error for each which basically say:
>>
>> The transfer of the operations master role cannot be performed because:
> The
>> requested FSMO operation failed.  The current FSMO holder could not be
>> contacted.
>>
>> (I say "basically the same" because in a couple cases it asks if I want
>> to
>> try a forced transfer.)  According to what I read, this is usually caused
> by
>> insufficient account privileges.  Well, I was in the domain administrator
>> account which has about every permission I could find and a member of the
>> Domain Administrators group, schema group, etc, etc.  I was also doing it
>> from the machine which is currently the DC.
>>
>> From what I have read, this is the preferred way of performing the
> transfer.
>> There is a way to "pull" the FSMOs over to the secondary machine by
> logging
>> in to it and using command line commands.  However, some of the reading
>> imply that doing a "pull" will render the old domain controller unable to
>> resume as DC.  Yes, I know that ultimately I am putting a clean machine
> back
>> in, but there is some sensitivity to being able to return things to they
> way
>> they were if the rebuild does not work.  (The rebuild is a hard drive
> swap,
>> so I will have the old drive with everything on it.)  I am also concerned
>> that the "pull" approach only half works and I am stuck with the old DC
>> being lobotomized and the new, temporary DC with not enough smarts to do
> the
>> job.
>>
>> Anyone have insight into why "The current FSMO holder could not be
>> contacted." and how to resolve the problem?  Any other suggestions would
> be
>> greatly appreciated too!
>>
>> Thanks!
>>
>> Don
>>
>>
>>
>>
>>
>>
>
>
Author
13 Feb 2006 3:22 AM
Don
Seth,

I will take a look at this and give it a try on Monday or Tuesday and post
the results.

Thanks!

Don



Show quoteHide quote
"seth" <m*@myhouse.net> wrote in message
news:OHAnbXsLGHA.1288@TK2MSFTNGP09.phx.gbl...
>
> Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller
> http://support.microsoft.com/kb/255504/en-us
>
>
>
> "Don" <some***@somewhere.net> wrote in message
> news:OYtrUXqLGHA.2036@TK2MSFTNGP14.phx.gbl...
> > Sorry for the multi-post.  I meant to do this as a cross-post to both
> > microsoft.public.win2000.setup and microsoft.public.win2000.general to
get
> > a
> > little more exposure.
> >
> > My apologies in advance to those offended by multi-posts!
> >
> > Don
> >
> >
> > "Don" <some***@somewhere.net> wrote in message news:...
> >> I am trying to temporarily transfer a DC to another machine so we can
> >> rebuild the first machine.  Thanks to several folks in these newsgroups
I
> >> got the scoop on how to do this.  So far, I managed to set up a second
> >> domain controller on the network (this is a stand-alone network with
> >> about
> > a
> >> dozen machines in a lab).  I was in the process of transferring the
FSMOs
> > to
> >> the secondary machine when I ran into problems.
> >>
> >> When I try to transfer the RID, PDC, Infrastructure, Schema, etc I get
an
> >> error for each which basically say:
> >>
> >> The transfer of the operations master role cannot be performed because:
> > The
> >> requested FSMO operation failed.  The current FSMO holder could not be
> >> contacted.
> >>
> >> (I say "basically the same" because in a couple cases it asks if I want
> >> to
> >> try a forced transfer.)  According to what I read, this is usually
caused
> > by
> >> insufficient account privileges.  Well, I was in the domain
administrator
> >> account which has about every permission I could find and a member of
the
> >> Domain Administrators group, schema group, etc, etc.  I was also doing
it
> >> from the machine which is currently the DC.
> >>
> >> From what I have read, this is the preferred way of performing the
> > transfer.
> >> There is a way to "pull" the FSMOs over to the secondary machine by
> > logging
> >> in to it and using command line commands.  However, some of the reading
> >> imply that doing a "pull" will render the old domain controller unable
to
> >> resume as DC.  Yes, I know that ultimately I am putting a clean machine
> > back
> >> in, but there is some sensitivity to being able to return things to
they
> > way
> >> they were if the rebuild does not work.  (The rebuild is a hard drive
> > swap,
> >> so I will have the old drive with everything on it.)  I am also
concerned
> >> that the "pull" approach only half works and I am stuck with the old DC
> >> being lobotomized and the new, temporary DC with not enough smarts to
do
> > the
> >> job.
> >>
> >> Anyone have insight into why "The current FSMO holder could not be
> >> contacted." and how to resolve the problem?  Any other suggestions
would
> > be
> >> greatly appreciated too!
> >>
> >> Thanks!
> >>
> >> Don
> >>
> >>
> >>
> >>
> >>
> >>
> >
> >
>
>
Author
12 Feb 2006 10:19 PM
To Old To . . .
If the rebuild is only a hard drive swap, You can use Norton ghost to do
this, simple and easy to use.

Show quoteHide quote
"Don" wrote:

> Sorry for the multi-post.  I meant to do this as a cross-post to both
> microsoft.public.win2000.setup and microsoft.public.win2000.general to get a
> little more exposure.
>
> My apologies in advance to those offended by multi-posts!
>
> Don
>
>
> "Don" <some***@somewhere.net> wrote in message news:...
> > I am trying to temporarily transfer a DC to another machine so we can
> > rebuild the first machine.  Thanks to several folks in these newsgroups I
> > got the scoop on how to do this.  So far, I managed to set up a second
> > domain controller on the network (this is a stand-alone network with about
> a
> > dozen machines in a lab).  I was in the process of transferring the FSMOs
> to
> > the secondary machine when I ran into problems.
> >
> > When I try to transfer the RID, PDC, Infrastructure, Schema, etc I get an
> > error for each which basically say:
> >
> > The transfer of the operations master role cannot be performed because:
> The
> > requested FSMO operation failed.  The current FSMO holder could not be
> > contacted.
> >
> > (I say "basically the same" because in a couple cases it asks if I want to
> > try a forced transfer.)  According to what I read, this is usually caused
> by
> > insufficient account privileges.  Well, I was in the domain administrator
> > account which has about every permission I could find and a member of the
> > Domain Administrators group, schema group, etc, etc.  I was also doing it
> > from the machine which is currently the DC.
> >
> > From what I have read, this is the preferred way of performing the
> transfer.
> > There is a way to "pull" the FSMOs over to the secondary machine by
> logging
> > in to it and using command line commands.  However, some of the reading
> > imply that doing a "pull" will render the old domain controller unable to
> > resume as DC.  Yes, I know that ultimately I am putting a clean machine
> back
> > in, but there is some sensitivity to being able to return things to they
> way
> > they were if the rebuild does not work.  (The rebuild is a hard drive
> swap,
> > so I will have the old drive with everything on it.)  I am also concerned
> > that the "pull" approach only half works and I am stuck with the old DC
> > being lobotomized and the new, temporary DC with not enough smarts to do
> the
> > job.
> >
> > Anyone have insight into why "The current FSMO holder could not be
> > contacted." and how to resolve the problem?  Any other suggestions would
> be
> > greatly appreciated too!
> >
> > Thanks!
> >
> > Don
> >
> >
> >
> >
> >
> >
>
>
>
Author
13 Feb 2006 3:28 AM
Don
To Old To ...,

I wish it were just a hard disk swap.  The machine has a 5MB (yes 5MB) c:\
drive which contains some licensing info.  The system drive is e:\ and is
only 5GB.  I have no clue how the  machine ended up like this as this is the
configuration I inherited.  Aside from the bizarre partitioning, the
existing Win2000 server installation has some problems specifically the
Dmadmin service.  Due to an antivirus upgrade, we finally ran out of room on
e: so I decided it was time to do a clean build on a nice size (34GB) c:

Trust me, I considered Ghosting the machine, but could not come up with a
good way to solve all the other little problems!

Thanks for the suggestion though!

Don






Show quoteHide quote
"To Old To . . ." <ToOl***@discussions.microsoft.com> wrote in message
news:E9A6BD83-5B8D-47CE-9930-E7720B84730E@microsoft.com...
> If the rebuild is only a hard drive swap, You can use Norton ghost to do
> this, simple and easy to use.
>
> "Don" wrote:
>
> > Sorry for the multi-post.  I meant to do this as a cross-post to both
> > microsoft.public.win2000.setup and microsoft.public.win2000.general to
get a
> > little more exposure.
> >
> > My apologies in advance to those offended by multi-posts!
> >
> > Don
> >
> >
> > "Don" <some***@somewhere.net> wrote in message news:...
> > > I am trying to temporarily transfer a DC to another machine so we can
> > > rebuild the first machine.  Thanks to several folks in these
newsgroups I
> > > got the scoop on how to do this.  So far, I managed to set up a second
> > > domain controller on the network (this is a stand-alone network with
about
> > a
> > > dozen machines in a lab).  I was in the process of transferring the
FSMOs
> > to
> > > the secondary machine when I ran into problems.
> > >
> > > When I try to transfer the RID, PDC, Infrastructure, Schema, etc I get
an
> > > error for each which basically say:
> > >
> > > The transfer of the operations master role cannot be performed
because:
> > The
> > > requested FSMO operation failed.  The current FSMO holder could not be
> > > contacted.
> > >
> > > (I say "basically the same" because in a couple cases it asks if I
want to
> > > try a forced transfer.)  According to what I read, this is usually
caused
> > by
> > > insufficient account privileges.  Well, I was in the domain
administrator
> > > account which has about every permission I could find and a member of
the
> > > Domain Administrators group, schema group, etc, etc.  I was also doing
it
> > > from the machine which is currently the DC.
> > >
> > > From what I have read, this is the preferred way of performing the
> > transfer.
> > > There is a way to "pull" the FSMOs over to the secondary machine by
> > logging
> > > in to it and using command line commands.  However, some of the
reading
> > > imply that doing a "pull" will render the old domain controller unable
to
> > > resume as DC.  Yes, I know that ultimately I am putting a clean
machine
> > back
> > > in, but there is some sensitivity to being able to return things to
they
> > way
> > > they were if the rebuild does not work.  (The rebuild is a hard drive
> > swap,
> > > so I will have the old drive with everything on it.)  I am also
concerned
> > > that the "pull" approach only half works and I am stuck with the old
DC
> > > being lobotomized and the new, temporary DC with not enough smarts to
do
> > the
> > > job.
> > >
> > > Anyone have insight into why "The current FSMO holder could not be
> > > contacted." and how to resolve the problem?  Any other suggestions
would
> > be
> > > greatly appreciated too!
> > >
> > > Thanks!
> > >
> > > Don
> > >
> > >
> > >
> > >
> > >
> > >
> >
> >
> >