Unable to successfully run adprep /domainprep on Windows 2000 Domain

While�running Adprep /domainprep to prepare a Windows 2000 Active Directory Domain to accept Windows Server 2003 Domain controllers the tool unexpectedly exits with little or no error messages displayed.� This issue�may occur even after successfully running Adprep /forestprep on the Active Directory Forest.
�
Running the tool again produces the same results.� Attempting to run DCPROMO on the Windows Server 2003 server results in a message stating Adprep /domainprep still needs to be run.� This verifies that Adprep didn't successfully run the domainprep function.
�
A�sample of the end of the Adprep�log file�is shown below (domain changed to protect source):
�
-----------------------------------------------------------

Adprep verified the state of operation cn=6ad29ff3-c2df-45a1-928e-9fef2fab018a,cn=Operations,cn=DomainUpdates,cn=System,DC=sales,DC=contoso,DC=msft.

[Status/Consequence]

The operation has not run or is not currently running. It will be run next.



Adprep was about to call the following LDAP API. ldap_search_s(). The base entry to start the search is CN=User,CN={21B2F310-016F-11E2-945F-01C04FB934F3},CN=Policies,CN=System,DC=sales,DC=contoso,DC=msft.



LDAP API ldap_search_s() finished, return code is 0x0
-----------------------------------------------------------------

�
�

Improper or mangled ACE's on the GUID shown immediately before the tool exits.
�
Most frequently observed where the Administrators and Enterprise Admins Groups have been Denied access to the affected GUID.

From a Domain Controller or a management workstation while logged in with administrative rights to the Domain do the following:
�
1) Open Active Directory Users and Computers.
2) Expand your Domain.
3) Enable Advanced Features from the View menu.
4) Expand System, then expand Policies.
5) Locate the GUID identified in the last entry of the Adprep log file.
6) Right-click the entry and select Properties, then Security.
7) Change the permissions on this GUID to allow Full Control to the Denied groups.� This might involve taking Ownership to accomplish.
�
Re-run the Adprep /domainprep function to complete the preparation of the Domain for a Windows Server 2003 object.

This article also applies to Windows 2000 Server and Windows 2000 Advanced Server

Microsoft corporation and/or its respective suppliers make no representations about the suitability, reliability, or accuracy of the information and related graphics contained herein. All such information and related graphics are provided "as is" without warranty of any kind. Microsoft and/or its respective suppliers hereby disclaim all warranties and conditions with regard to this information and related graphics, including all implied warranties and conditions of merchantability, fitness for a particular purpose, workmanlike effort, title and non-infringement. You specifically agree that in no event shall Microsoft and/or its suppliers be liable for any direct, indirect, punitive, incidental, special, consequential damages or any damages whatsoever including, without limitation, damages for loss of use, data or profits, arising out of or in any way connected with the use of or inability to use the information and related graphics contained herein, whether based on contract, tort, negligence, strict liability or otherwise, even if Microsoft or any of its suppliers has been advised of the possibility of damages.