- The administration of Windows 2000 domain controllers that are located in an external forest that is connected by earlier-version trusts.
- Focusing MMC snap-ins against a specific domain controller that is referenced by its IP address. For example, you click
Start, click Run, and then type
dsa.msc /server=x.x.x.x, where x.x.x.x is the IP address of the domain controller.
- Install Windows 2000 Service Pack 3 (SP3) on Windows 2000-based domain controllers.
- Turn off LDAP signing and sealing in the registry of the client computer that is running the administrative tools, and then restart the tools on the client.
- Active Directory Domains and Trusts
- Active Directory Sites and Services
- Active Directory Schema
- Active Directory Users and Computers
- ADSI Edit
- Group Policy Management Console
- Object Picker
With Windows 2000 Service Pack 2 and EarlierImportant This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
- Open Registry Editor.
- In Registry Editor, locate to the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AdminDebug.
- Click Edit, point to New, and then click DWORD Value.
- In the text box that appears, type ADsOpenObjectFlags and then press enter.
- Double-click the ADsOpenObjectFlags registry key you just created, and then change the Value Data to one of the following values
Value Data (Hexadecimal) Disables 1 Signing 2 Encryption 3 Encryption and Signing
Caution This procedure will disable the use of signed or encrypted LDAP traffic for some Active Directory administrative tools. We recommend that you avoid disabling this feature.
To turn off the signature and encryption of LDAP traffic for the Windows Server 2003 Active Directory tools, set the ADsOpenObjectFlags value to 0x03 in the following registry key on the client computer:
ADsOpenObjectFlags registry key. Administrators can also use Windows 2000 versions of the tools against Windows 2000-based domain controllers with SP2 or earlier on Windows 2000-based clients and servers. The client may not negotiate a connection with the earlier-version server if the client tries to authenticate by using NTLM. For example, this may occur in cross-forest trusts or when the client tries to connect to the server by means of an IP address.
The Windows Server 2003 snap-ins and command-line tools that automatically secure LDAP traffic over the network. Possible error messages include:
- Active Directory Domains and Trusts: The configuration information describing this enterprise is not available. The server is not operational, or the configuration information describing this enterprise in not available. The directory service is not available. Contact your system administrator to verify that you domain is properly configured and is currently online.
- Active Directory Sites and Services Naming information cannot be located because: The directory service is not available. Contact your system administrator to verify that you domain is properly configured and is currently online.
- Windows cannot connect to the new forest because: The server is not operational.
- Active Directory Schema: The Domain Controller could not be set. The directory service is unavailable.
- Active Directory Users and Computers Windows cannot connect to the new domain because: The server is not operational.
- Naming information cannot be located because: The directory service is not available. Contact your system administrator to verify that you domain is properly configured and is currently online.
- ADSI Edit - Dsmove.exe dsmove failed: dn of object: The directory service is unavailable .
- Dsrm.exe dsrm failed: The directory service is unavailable.
- Dsadd.exe dsadd failed: <dn of object>: The directory service is unavailable.
- Dsget.exe dsget failed: The directory service is unavailable.
- Dsmod.exe dsmod failed: dn of object :The directory service is unavailable.
- Dsquery.exe dsquery failed: The directory service is unavailable.
- Group Policy Management Console: The specified network resource or device is no longer available.
- Object Picker Object Not Found.
Article ID: 325465 - Last Review: May 27, 2008 - Revision: 1