Windows Server 2003 adprep /forestprep command causes mangled attributes in Windows 2000 forests that contain Exchange 2000 servers

• You run the Windows Server 2003 adprep /forestprep command in a Windows 2000 forest before you install Exchange 2000.
• You add Exchange 2000 to an existing Windows 2000 forest. You run the Inetorgpersonfix.ldf file before you run the Windows Server 2003 adprep /forestprep command.
• You add Exchange 2000 to an existing Windows 2000 forest. You then run the Exchange Server 2003 setup /forestprep command before you run the Windows Server 2003 adprep /forestprep command.

• You add the Exchange 2000 version of the InetOrgPerson class to a Windows 2000 forest before you add the InetOrgPerson class from the InetOrgPerson Kit.
• You add the Exchange 2000 version of the InetOrgPerson class to a Windows 2000 forest before you run the Windows Server 2003 adprep /forestprep command.
• You add the Windows 2000 InetOrgPerson Kit and then install the Exchange 2000 schema changes before you run the Windows Server 2003 adprep /forestprep command.
• A Windows 2000 domain controller that contains the Exchange 2000 definition of InetOrgPerson does not receive updates to Active Directory after you run the Inetorgpersonfix.ldf file from the Windows Server 2003 installation media.

Scenario 1: Exchange 2000 schema changes are added after you run the adprep /forestprep command

Scenario 2: Exchange 2000 schema changes are installed before you run the Windows Server 2003 adprep /forestprep command

1. Log on to the console of the schema operations master by using an account that is a member of the Schema Administrators group and of the Enterprise Administrators group.
2. Enable Schema Updates on the schema master. For more information about how to permit updates to the Active Directory schema, click the following article number to view the article in the Microsoft Knowledge Base:
   285172 Schema updates require write access to schema in Active Directory
3. Mangled HouseIdentifier, Secretary, and LabeledURI attributes have LDAPDisplayName attributes that are similar to the following format:
   lDAPDisplayName: DUP-labeledURI-9591bbd3-d2a6-4669-afda-48af7c35507d;
   lDAPDisplayName: DUP-secretary-c5a1240d-70c0-455c-9906-a4070602f85f
   lDAPDisplayName: DUP-houseIdentifier-354b0ca8-9b6c-4722-aae7-e66906cc9eef
   If the LDAPDisplayName attributes for LabeledURI, Secretary and HouseIdentifier were mangled, run the Windows Server 2003 Inetorgpersonfix.ldf script to recover:
   1. Create a folder named %systemroot%\iop.
   2. At a command prompt, type cd %systemroot%\iop, and then press ENTER.
   3. Extract the Inetorgpersonfix.ldf file from the Support.cab file that is located in the Support\Tools folder of the Windows Server 2003 installation media.
   4. From the console of the schema operations master, load the Inetorgpersonfix.ldf file by using Ldifde.exe to correct the LdapDisplayName attribute of the houseIdentifier, the Secretary, and the labeledURI attributes. To do this, type the following command, where dn path for forest root domain is the domain name path for the root domain of the forest wrapped in quotation marks:
      ldifde -i -f inetorgpersonfix.ldf -v -c DC=X "dn path for forest root domain"
      Note In this command, X is a case-sensitive constant. Enter it exactly as it appears here.
4. Verify that the LDAPDisplayName values for the CN=ms-Exch-Assistant-Name, the CN=ms-Exch-LabeledURI, and the CN=ms-Exch-House-Identifier attributes in the schema naming context now appear as msExchAssistantName, msExchLabeledURI, and msExchHouseIdentifier before you run the Windows Server 2003 adprep /forestprep command.
   
   To verify that the LDAPDisplayName values are correct, you can use ADSI Edit. To do this, follow these steps.
   
   Warning If you use the ADSI Edit snap-in, the LDP utility, or any other LDAP version 3 client, and you incorrectly modify the attributes of Active Directory objects, you can cause serious problems. These problems may require you to reinstall Microsoft Windows 2000 Server, Microsoft Windows Server 2003, Microsoft Exchange 2000 Server, Microsoft Exchange Server 2003, or both Windows and Exchange. Microsoft cannot guarantee that problems that occur if you incorrectly modify Active Directory object attributes can be solved. Modify these attributes at your own risk.
   1. Click Start, point to Programs, point to Windows 2000/2003 Support Tools, and then click ADSI Edit.
   2. Expand Schema [Your_Domain].
   3. Expand Cn=Schema, CN=Configuration, CN=your internal names.
   4. In the right pane, locate an attribute to verify.
   5. Right-click the attribute, and then click Properties.
   6. In the Select which properties to view list, click Both.
   7. In the Select a property to view list, click LDAPDisplayName.
   8. Verify that the LDAPDisplayName value is correct.
   9. Repeat steps e through h for each attribute you want to verify.
5. Run the adprep /forestprep command and the /domainprep command.

Scenario 3: you did not run InetOrgPersonfix before you ran the Windows Server 2003 adprep /forestprep command

1. Install Ldp.exe from the Support\Tools folder of the Windows 2000 or the Windows Server 2003 media.
2. Start Ldp.exe from a domain controller or a member computer in the forest.
   1. On the Connection menu, click Connect, leave the Server box empty, type 389 in the Port box, and then click OK.
   2. On the Connection menu, click Bind, leave all the boxes empty, and then click OK.
3. Record the distinguished name path for the SchemaNamingContext attribute.
   
   For example, for a domain controller in the CORP.ADATUM.COM forest, the distinguished name path would be CN=Schema,CN=Configuration,DC=corp,DC=adatum,DC=com.
4. On the Browse menu, click Search.
5. Configure the following settings:
   • Base DN: Type the distinguished name path for the schema naming context that is identified in step 3.
   • Filter: Type (ldapdisplayname=dup*).
   • Scope: Click Subtree.
6. Mangled HouseIdentifier, Secretary, and LabeledURI attributes have LDAPDisplayName attributes that are similar to the following format:
   lDAPDisplayName: DUP-labeledURI-9591bbd3-d2a6-4669-afda-48af7c35507d;
   lDAPDisplayName: DUP-secretary-c5a1240d-70c0-455c-9906-a4070602f85f
   lDAPDisplayName: DUP-houseIdentifier-354b0ca8-9b6c-4722-aae7-e66906cc9eef
   If the LDAP Display names for LabeledURI, Secretary and HouseIdentifier were mangled, run the Windows Server 2003 Inetorgpersonfix.ldf script to recover:
   1. Create a folder named %systemroot%\iop.
   2. At a command prompt, type cd %systemroot%\iop, and then press ENTER.
   3. Extract the Inetorgpersonfix.ldf file from the Support.cab file that is located in the Support\Tools folder of the Windows Server 2003 installation media.
   4. From the console of the schema operations master, load the Inetorgpersonfix.ldf file by using Ldifde.exe to correct the LdapDisplayName attribute of the houseIdentifier, the Secretary, and the labeledURI attributes. To do this, type the following command, where dn path for forest root domain is the domain name path for the root domain of the forest wrapped in quotation marks:
      ldifde -i -f inetorgpersonfix.ldf -v -c DC=X "dn path for forest root domain"
      Note In this command, X is a case-sensitive constant. Enter it exactly as it appears here.
7. Verify that the houseIdentifier, the Secretary, and the labeledURI attributes in the schema naming context are not mangled.
8. Use Winnt32.exe to upgrade the Windows 2000 domain controllers.
   
   For more information about how to upgrade a Windows 2000 domain controller by using Winnt32.exe, click the following article number to view the article in the Microsoft Knowledge Base:
   325379 How to upgrade Windows 2000 domain controllers to Windows Server 2003

Errors encountered by Exchange 2000 Server when InetOrgPerson attributes are mangled

[14:07:16] ScRunLDIFScript (k:\admin\src\libs\exsetup\exmisc.cxx:1333)
Error code 0XC1037AE6 (31462): Extending the schema in the Active Directory failed. 
Please consult the error log LDIF.ERR in your TEMP directory.

Enhancements to Adprep.exe in Windows Server 2003 Service Pack 1