02 October 2008

Extending Schema for ConfigMgr and 'A Referral was returned from the server'

I know this has been covered on a number of sites, but I had not seen this error before.

I have always said that the best way to extend the schema was to use an LDIF file (LDAP Data Interchange Format)

I prefer it as 'you are in more control' of the schema extension, and can see what changes are going to be made.

The only down side is that you have to modify the LDIF file before hand. The file in question is ConfigMgr_ad_schema.ldf, the modifications in question are changing all instances of DC=x to specific entries for your domain, more precisely the full name of the domain to be extended. For example for domain.com you would change DC=x to DC=domain, DC=com.

So the process I follow is

Backup the schema master domain controller’s system state using the NTBACKUP utility.
Disconnect the schema master domain controller from the network.
Edit the ConfigMgr_ad_schema.ldf file, located in the \SMSSETUP\BIN\I386 directory of the Configuration Manager 2007 installation files, as show above.
Use the LDIFDE command-line utility to import the contents of the modified ConfigMgr_ad_schema.ldf file.

For example, this command line will import the schema extensions into Active Directory, turn on verbose logging, and create a log file during the import process:
ldifde –i –f ConfigMgr_ad_schema.ldf –v –j <location to store log file>.

Seems simple.....

However I had a phone call from a site today saying it had not worked, and they had received the following error 'A Referral was returned from the server', add error on line 56.

Line 56 is where it updates the MS-SMS-Management-Point class, I couldn't see anything wrong there - and then it hit me. Their domain was domain.co.uk, they had changed DC=x to DC=domain, DC=co.uk - not good, it needs to be DC=domain, DC=co, DC=uk

Filed under: , ,

Comments

# Rob said:

I prefer giving the "always worried and paranoid" A/D admins the LDF to review, then when they are distracted and in total shock at all the attributes and classes going in I secretly run the EXTADSCH executable, get 100% implementation success and then say soothing things like "there there A/D admins, it's all over with now, and look, all that worry and it worked" !!!

Joking aside, as this should be thoroughly planned and taken very seriously, as A/D is the make or break on a companies productivity ... I'd love to hear stories about how updating the schema using EXTADSCH has caused customers headaches. I've only been in one place that reported issues with the update a few years back, but they didn't really manage their A/D very well and it was in a right state before they performed the upgrade. I guess the moral of this story is ... if your A/D is flakey then fix it and keep it fixed, then upgrade the schema ;-)

Good real world experience\information there David.

02 October 2008 16:26