Search the Community

Hey Guys / Niall - I recently built a new SCCM environment with 4 Secondary servers for an upcoming domain migration and have just about finished it. When looking in the console under "Active Directory Forests", I see that under "Publishing Status" it says "Insufficient Access Rights." The permissions for the "Systems Management" container seem correct. Looking within it, I see that it has created objects for the Primary + 2 of the 3 Secondary sites - but that's it. Below you can see the contents of the Systems Management container currently. AH1 is the Primary site with ABQ & TUL Secondaries. The 3rd Secondary is missing completely... I personally didn't extend the schema or assign rights, but here's how it is currently configured. When looking under the Security tab of the System Management container's Properties, I see that there is an AD Security Group named "SCCM Site Servers" with full rights. I've also verified that all of the SCCM Site Servers (including the primary and all secondaries) have been added to this group. No specific user / service accounts have been added. Aside from that group, the following exist: SELF (No rights) Authenticated users (Read) SYSTEM (Full Rights) DOMAIN\Domain Admins (Full Rights) DOMAIN\Enterprise Admins (Full Rights - Inherited) DOMAIN\Administrators (Read & Write but not Full - Inherited) DOMAIN\Pre-Windows 2000 Compatible Access (No Rights) ENTERPRISE DOMAIN CONTROLLERS (No Rights) If I examine the Properties of the Forest within the console, the option to discover sites & subnets in the AD forest is enabled and set to use the computer account of the site server. The Publishing tab has all 4 (Primary + 3 Secondaries) checked and no domain / server specified. I tried adding the hostname of the Secondary site which wasn't listed in the SM container directly via Delegating Access. When viewing Advanced properties of the container's security, the added hostname looks to have the same configuration as the AD Group. Once added, I unchecked it's site under Publishing, applied, clicked ok, went back to Publishing, checked it, applied, then clicked OK again. So far, no changes. Not 100% sure if this would attempt to reinitiate it, though. After I make changes in attempts to resolve, how can I best verify they are successful if not the above? Finally, I looked through all ad* logs and even though I didn't look in great detail, I didn't see anything recent that stood out. Any suggestions for resolving this? Thanks!

Hopefully I'll explain this correctly. We are currently planning on setting up SCCM CB 1702 in our DEV environment. The domain itself is a little strange (or at least to me). There is an empty root (absr.domain.com) where the schema admin resides - was setup way before my time. Then the actual DEV domain (abc.domain.com). Tried extended the schema there and it failed stating I didn't have the needed ID privileges. I then logged in as the 'root' admin and ran it and from the command line. It stated it was successful, but it didn't create the log file on the C:\ drive? Is there a way to use ADSI edit or some other tool to verify that the schema was indeed extended? I've worked at a number of companies and have never seen this setup before. Just one domain. Thank you ZT

I'm trying to extend the active schema for config 2012 and I continue to get an permissions error = 5 when trying to run command line utility extadsch.exe, which is included in the setup binaries. I checked and my admin account and it is part of the Schema admin group. Also just be sure, I'm suppose to install extadsch from the main DC, and not the SCCM server, correct? Thanks, Paul