Dcdiag fails for NCSecDesc test on Windows 2008 Domain Controllers

Article translations Article translations
Article ID: 967482 - View products that this article applies to.
Expand all | Collapse all
Source: Microsoft Support

RAPID PUBLISHING

RAPID PUBLISHING ARTICLES PROVIDE INFORMATION DIRECTLY FROM WITHIN THE MICROSOFT SUPPORT ORGANIZATION. THE INFORMATION CONTAINED HEREIN IS CREATED IN RESPONSE TO EMERGING OR UNIQUE TOPICS, OR IS INTENDED SUPPLEMENT OTHER KNOWLEDGE BASE INFORMATION.

Symptom



When you run DCDIAG on a Windows Server 2008 Domain Controller the process might fail the Naming Context Security Descriptors Test (NcSecDesc), and you may see a message similar to the following:

 

 

Starting test: NCSecDesc

        Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

           Replicating Directory Changes In Filtered Set

        access rights for the naming context:

        DC=DomainDnsZones,DC=CONTOSO,DC=COM

        Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

           Replicating Directory Changes In Filtered Set

        access rights for the naming context:

        DC=ForestDnsZones,DC=CONTOSO,DC=COM

        ......................... Contoso-DC1 failed test NCSecDesc

Cause



If you have not run adprep/rodcprep, Dcdiag.exe will return an error when it runs the NCSecDesc test. This test checks that the security descriptors on the naming context heads have appropriate permissions for replication. The error indicates that the Enterprise Domain Controllers group does not have Replicating Directory Changes In Filtered Set access rights for the DNS application directory partitions.

Resolution



If you do not plan to add an RODC to the forest, you can disregard this error. If you plan to add an RODC to the forest, you must run adprep /rodcprep.

 

More Information



For more information, see the document “Known Issues for Installing and Removing AD DS” at the following Microsoft Web site: http://technet.microsoft.com/en-us/library/cc754463.aspx

 



 

DISCLAIMER

MICROSOFT AND/OR ITS SUPPLIERS MAKE NO REPRESENTATIONS OR WARRANTIES ABOUT THE SUITABILITY, RELIABILITY OR ACCURACY OF THE INFORMATION CONTAINED IN THE DOCUMENTS AND RELATED GRAPHICS PUBLISHED ON THIS WEBSITE (THE “MATERIALS”) FOR ANY PURPOSE. THE MATERIALS MAY INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS AND MAY BE REVISED AT ANY TIME WITHOUT NOTICE.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT AND/OR ITS SUPPLIERS DISCLAIM AND EXCLUDE ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO REPRESENTATIONS, WARRANTIES, OR CONDITIONS OF TITLE, NON INFRINGEMENT, SATISFACTORY CONDITION OR QUALITY, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE MATERIALS.

Properties

Article ID: 967482 - Last Review: February 3, 2009 - Revision: 1.0
APPLIES TO
  • Windows Server 2008 Standard
  • Windows Server 2008 Enterprise
  • Windows Server 2008 Datacenter
Keywords: 
kbnomt kbrapidpub KB967482

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com