Unity Permissions Wizard Schema Error

[Aaron Harrison]

I'm trying to set up a Unity VM (non-UM) demo system.

I've installed W2K, ran the CUSPA and installed patches etc... I've installed Exchange. The system is a single server also running as the lone DC for it's own domain.

Now when I run the Permissions Wizard (either the latest from ciscounitytools.com or the one on the 4.0(4) CD) it complains that I need to update the schema before running it.

I installed Exchange without running domainprep and forestprep first as these functions are performed by the Exchange setup anyway and are only needed when replication of the changes may cause setup to fail.

With a single server I shouldn't need to run them. Despite this and in case the Permissions Wizard looks for a particular bit of evidence that it has been run, I've now run both domainprep and forestprep.

I still get the same errror that the schema needs to be updated. Exchange is running fine as far as I can tell.

Anyone know what the permissions wizard is checking or have any suggestions?

Thanks

Aaron

[Aaron Harrison]

Erm... fixed my own problem.

Turns out that skimming over the Exchange installation section of the manual as I've done it a million times wasn't a good idea, as Unity has it's own schema updates to perform.

I expect it will work now I've followed the instructions correctly.

Old age must be setting in.

[Rui Carlos Antunes]

Hi.

Did you had any problems updating the AD Schema?

When I try to run ADSchemaSetup I get an error message («Setup failed to initialize Active Directory») and I am told to check if the network connection is active, the AD services are running, that I'm logged on to the Schema Master and I'm a member of the Schema Admins security group - which is true for everything!

Any help would be appreciated. Thanks...

[Aaron Harrison]

Hi - I didn't have any such problems I'm afraid...

Can you clue me in a little more on your environment? Is it single server VM or a full UM deployment? Number of DCs/AD site configuration etc?

Were you able to install Exchange 2000/2k3 without any problems on the same box?

[Rui Carlos Antunes]

Hello.

We are installing a standalone Cisco Unity server for Unified Messaging. This server is the Domain Controller. Two Cisco CallManagers and one IPCC Express will integrate with the ActiveDirectory running on the Cisco Unity Server.

We had no problems installing Exchange 2000.

Is there any way to make sure that the Active Directory services are fully functional? We just followed the guidelines from Cisco (we run "Dcpromo" and used the value for a «System That Has No Network Connection») so everything should be fine, but...

When you updated your AD Schema, did you log on as Administrator and did you logged on with a domain (for example, if AD domain is xpto.com, did you logged in with Administrator@xpto.com)?

Thanks for all your help.

[Aaron Harrison]

ok - if you've had no problems installing Exchange 2000 that suggests your AD is OK - installing Exchange makes lots of updates to the AD schema...

Once you've got AD installed and your server is a DC, you can only log in with Domain accounts, and your local Administrator account on the DC/Unity box no longer exists - so logging in as Administrator@xpto.com is the same as logging in as Administrator (assuming your AD domain is xpto.com)

I'm not sure what you mean by "System That Has No Network Connection" ? Is this part of a Cisco doc or something?

However it's worth checking a few things.... firstly if you're running AD on the Unity box (making it the first and only DC in it's own domain) then DNS should have installed and configured as part of the DCPROMO process.

If you check your IP configuration, you should have the address of your Unity box/DC as the only DNS entry - if not change it and reboot, the server will then register the correct DNS entries. Some of these are service records that serve as the location method for domain controllers and so on.

Have you also run the CUSPA to get all the SPs etc on there? And run the Exchange SP3?

When you say standalone Unity server for UM also running as a DC, do you mean you have a separate Exchange server? If so is this in the same or a different domain?

[Rui Carlos Antunes]

The stuff about «System That Has No Network Connection» was directly taken from Cisco Unity Installation Guide,

DNS is installed on the Cisco Unity server (when we run Dcpromo it detects that there is no DNS server configured and it asks if we want to configure the local server as a DNS server - to which I answered yes).

I also set on the LAN Connection settings the DNS server field with the Cisco Unity IP address (local DNS server).

I used CUSPA to install everything nice and clean (I've done everthing «by the book»).

The Exchange 2000 service is configured on the Unity server itself, along with Active Directory.

I'm installing everything again (for the 3rd time) hoping that this time I won't have problems when trying extend the AD Schema (but I don't have much hope).

Thanks for your help...

[Aaron Harrison]

Ah - it just threw me off when you said UM, I thought you had to run the message store on a seperate box when you're using UM as opposed to VM-only.

If you've done this three times and got the same problem you must be entering something that it doesn't like or perhaps it's related to your hardware configuration (NICs probably) - I don't mean you're doing something wrong as there aren't that many mistakes you can make up to this point.

Is there more than one NIC in the server? If so try disabling all but one and ensuring that is configured correctly (i.e. DNS pointed at it's own IP or use 127.0.0.1). If you're using any NIC fault tolerance drivers (i.e. HP NIC teaming) take that off to rule it out and disable all but one NIC.

Basically if Exchange setup can extend your schema then AD is working, so it must be something peculiar to the way that the ADSchemaSetup program tries to find or access AD. If your server is resolving your domain name against another DNS server it may try to access the wrong AD and fail (i.e. the DNS server you use is an Internet one and xpto.com is resolvable there, or if you have another AD domain with that name reachable with whatever DNS server you have set).

ALso the adschemasetup.exe dumps out some logs on the desktop in a folder called "ldif logs"... Is there anything useful in there or can you post it?