ive been searching for a answer for this for about two days now and i was wondering if someone could help me out here. the network i manage at work is kinda limping along and i want to get sccm installed to get some more information, Well i got it installed and for some reason i cannot get it to publish to AD it says it does not have access, I was wondering if there was a way to change or find out what account it is using to try to add the containers and such to AD, I have tried changing things around but no luck, here is a log file. SMS_EXECUTIVE started SMS_HIERARCHY_MANAGER as thread ID 412 (0x19C). $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:07.601 2010 Central Daylight Time><thread=2744 (0xAB8)> ~Hierarchy Manager (build 6487) is starting... $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:07.601 2010 Central Daylight Time><thread=412 (0x19C)> CPublicKeyLookup::Initialize("C:\Program Files (x86)\Microsoft Configuration Manager\inboxes\hman.box\pubkey") $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:07.633 2010 Central Daylight Time><thread=412 (0x19C)> CPublicKeyLookup::Initialize() Initializing the Public Key Store Path to C:\Program Files (x86)\Microsoft Configuration Manager\inboxes\hman.box\pubkey~ $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:07.633 2010 Central Daylight Time><thread=412 (0x19C)> ~CHierarchyManager::SyncSiteModeSettings: verified site mode settings of the secondary sites. $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:07.695 2010 Central Daylight Time><thread=412 (0x19C)> ~Wait for site control changes for maximum 3600 seconds... $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:07.695 2010 Central Daylight Time><thread=412 (0x19C)> STATMSG: ID=3307 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_HIERARCHY_MANAGER" SYS=CAZDEPLOYMENT SITE=COL PID=5656 TID=412 GMTDATE=Thu Nov 04 05:18:48.103 2010 ISTR0="COL" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:48.103 2010 Central Daylight Time><thread=412 (0x19C)> ~Processed site control changes for the local site. $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:48.103 2010 Central Daylight Time><thread=412 (0x19C)> Time to verify that the public key of current site server in the site control file is still valid. $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:48.103 2010 Central Daylight Time><thread=412 (0x19C)> ~Wait for site control changes for maximum 3600 seconds... $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:48.103 2010 Central Daylight Time><thread=412 (0x19C)> Site COL in Sites table: Site status = 1, Detailed status = 1 $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.213 2010 Central Daylight Time><thread=412 (0x19C)> ~Processing site control file: Site COL File C:\Program Files (x86)\Microsoft Configuration Manager\inboxes\hman.box\0S1805HA.CT2 $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.213 2010 Central Daylight Time><thread=412 (0x19C)> Update the Sites table: Site=COL Parent=~ $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.291 2010 Central Daylight Time><thread=412 (0x19C)> Nothing has changed for the boundary $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.510 2010 Central Daylight Time><thread=412 (0x19C)> Unable to decode MBEx passwordThe operation completed successfully.~~ $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.510 2010 Central Daylight Time><thread=412 (0x19C)> ~Starting processing MP Certificates. $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.619 2010 Central Daylight Time><thread=412 (0x19C)> Signed MP Cert 308201E23082014FA0030201020210F448E4BE8808018240556B0E98F853FE300906052B0E03021D05003026311630140603550403130D43415A4445504C4F594D454E54310C300A06035504031303534D533020170D3130313130323036333935305A180F32313130313031303036333935305A3026311630140603550403130D43415A4445504C4F594D454E54310C300A06035504031303534D5330819F300D06092A864886F70D010101050003818D0030818902818100C18B1F25801B8C6BEE7910E972AC5474A0DA3072CF1E7BB5664CCA88DEDF3E5393CFF00B9FA620ADA1153DAC9BA883A4BB394A36F7F80AAF264806A547A05807996D6F262E57EBE09A3CA72A7CD99B384E3315619C5D5F4A9E5388A8F9E11AB02DB2BB6A2F11728CE93002A9223862F14B884AD11A1C209D889F529573203F610203010001A317301530130603551D25040C300A06082B06010401823765300906052B0E03021D05000381810095A059C69F805C034449DA1BFAB79535252410200D68718EF11FBE57A10C346400EE73201246F23D56F09C6FEAE58AE68936650550A8DE31ABD6CC85C29ABC702314FE1FE51970930CBDD591A60F5820815570F74567E77AA7F2BF80A0C65495699CEC2CFA0108C7660A74652FCB4A23601AF3D54384CFEB35F6F2DAA3A472AC, into sig: 61526D7C21A596D96C0FC0264D136C87E8505018884F8A60571F068193314624D965D762A228E3C9AB8E09EA742A868C89B14EB8C307239CE8A60CC1F0F24BBE202D41C9B4EB3C55EF9BC7C61DA8FCB1FF18FDC617C90468273C0EE3120573F4066E4AA3F73763595EE15AECCBBEC6E03A8AD42727D964517AF2039B67578A5C $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.635 2010 Central Daylight Time><thread=412 (0x19C)> Signed SMP Cert 308201E330820150A0030201020210DA9DD468F59DEFA14AF59085D8EAE407300906052B0E03021D05003026311630140603550403130D43415A4445504C4F594D454E54310C300A06035504031303534D533020170D3130313130333030353334385A180F32313130313031313030353334385A3026311630140603550403130D43415A4445504C4F594D454E54310C300A06035504031303534D5330819F300D06092A864886F70D010101050003818D0030818902818100948B41C7D5301C4B119F973430E504731BDB153D1FA9C7117C2A00F4B4453A91CD3FDB8E49497FC85C03F69DEF9EEC4DA6446321639A21D928CDE0015FBA2760A5EFE8EEEB9B1D38D869C08F4901F0ADF1F5C6001305D1355A30436BD06F0C6A5EC4EC647FF7CCA03DF41B6AE43983459FD4E30445CD155A7184EB2A11ED353B0203010001A318301630140603551D25040D300B06092B0601040182376504300906052B0E03021D050003818100501E50CA823687AC21D95E2F822C297C1F99DF3DAD3558B5AB577ECBA6B389C40045D2663D040EB723ED6EE8D8460123A729CECF762F6964520BD69390470F05B66FC561D80C6187F49FE84A42C65A6EB8A776D222727234FC9C241AF8E2C7EAF444E95AF658CFEC9B4B2B76446A12DC7035CCE35A13A93205C79A5435C57F5C, into sig: 592EFC899A2BF4A44989A5E5D4A88D07B2906380282D46CA97463F5F3C3C0F89801B38096CA753C97E4CCA8149E21D53ED4EEF9B2F5B7F7032A1495499AA08011E89041085A74B036BDCAB43FCD98AF245518449E27E685FF982D4C8A0BC2B646304867B9343B3E55D8B2F911118CE3EF3D7A097DB8D9AC60707F8BA0498A489 $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.635 2010 Central Daylight Time><thread=412 (0x19C)> ~Completed processing SMP Certificate. $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.635 2010 Central Daylight Time><thread=412 (0x19C)> Site system currently in use: COL CAZDEPLOYMENT SMS Component Server $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.635 2010 Central Daylight Time><thread=412 (0x19C)> Site system currently in use: COL CAZDEPLOYMENT SMS Device Management Point $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.635 2010 Central Daylight Time><thread=412 (0x19C)> Site system currently in use: COL CAZDEPLOYMENT SMS Distribution Point $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.635 2010 Central Daylight Time><thread=412 (0x19C)> Site system currently in use: COL CAZDEPLOYMENT SMS Management Point $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.635 2010 Central Daylight Time><thread=412 (0x19C)> Site system currently in use: COL CAZDEPLOYMENT SMS Reporting Point $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.635 2010 Central Daylight Time><thread=412 (0x19C)> Site system currently in use: COL CAZDEPLOYMENT SMS Server Locator Point $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.635 2010 Central Daylight Time><thread=412 (0x19C)> Site system currently in use: COL CAZDEPLOYMENT SMS Site Server $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.635 2010 Central Daylight Time><thread=412 (0x19C)> Site system currently in use: COL CAZDEPLOYMENT SMS Site System $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.635 2010 Central Daylight Time><thread=412 (0x19C)> Site system currently in use: COL CAZDEPLOYMENT SMS SQL Server $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.635 2010 Central Daylight Time><thread=412 (0x19C)> Site system currently in use: COL CAZDEPLOYMENT SMS State Migration Point $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.635 2010 Central Daylight Time><thread=412 (0x19C)> Checking SQL Cluster configuration. $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.775 2010 Central Daylight Time><thread=412 (0x19C)> This site is not using clustered SQL. $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.775 2010 Central Daylight Time><thread=412 (0x19C)> ~Server Info of site COL has changed. Update the DPInfo table in the database. $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.775 2010 Central Daylight Time><thread=412 (0x19C)> ~Distribution Points of site COL have changed. Update the DistributionPoints table in the database. $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.775 2010 Central Daylight Time><thread=412 (0x19C)> ~Will not update DP ["Display=\\CAZDEPLOYMENT\"]MSWNET:["SMS_SITE=COL"]\\CAZDEPLOYMENT\. DBCRC:1AB2693E,NewCRC:1AB2693E,Action:0,PDP:0 $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.791 2010 Central Daylight Time><thread=412 (0x19C)> Site System <CAZDEPLOYMENT> is the Default Management Point.for site <COL> $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.932 2010 Central Daylight Time><thread=412 (0x19C)> ~ClientDataCleanUpOnSecurityModeChange: No change detected in SSL_State. $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.947 2010 Central Daylight Time><thread=412 (0x19C)> Health state references are published in the same Active Directory forest where site server is located.~ $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.947 2010 Central Daylight Time><thread=412 (0x19C)> ~Check if the security mode of the site has changed. $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.947 2010 Central Daylight Time><thread=412 (0x19C)> ~Lookup for WCM Configuration CRC of site COL was not found. HMAN will update the WSUSServerLocations table in the database. $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.947 2010 Central Daylight Time><thread=412 (0x19C)> ~Successfully executed delete WSUSServerLocations where SiteCode = "COL" and IsINF = 0 $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.963 2010 Central Daylight Time><thread=412 (0x19C)> ~Successfully executed delete WSUSServerLocations where SiteCode = "COL" and IsINF = 1 $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:53.963 2010 Central Daylight Time><thread=412 (0x19C)> Update Site Boundaries in Active Directory~ $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:54.025 2010 Central Daylight Time><thread=412 (0x19C)> Active Directory DS Root:DC=web,DC=cazarin,DC=local~ $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:54.854 2010 Central Daylight Time><thread=412 (0x19C)> Searching for the System Management Container.~ $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:54.854 2010 Central Daylight Time><thread=412 (0x19C)> System Management container exists.~ $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:54.854 2010 Central Daylight Time><thread=412 (0x19C)> Searching for SMS-Site-COL Site Object.~ $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:54.869 2010 Central Daylight Time><thread=412 (0x19C)> SMS-Site-COL doesn't exist, creating it.~ $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:54.869 2010 Central Daylight Time><thread=412 (0x19C)> SMS-Site-COL could not be created, error code = 8202.~ $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:54.869 2010 Central Daylight Time><thread=412 (0x19C)> STATMSG: ID=4913 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_HIERARCHY_MANAGER" SYS=CAZDEPLOYMENT SITE=COL PID=5656 TID=412 GMTDATE=Thu Nov 04 05:18:54.869 2010 ISTR0="SMS-Site-COL" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:54.869 2010 Central Daylight Time><thread=412 (0x19C)> No Ranged IP boundaries are currently published for this site.~ $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:54.869 2010 Central Daylight Time><thread=412 (0x19C)> ~There is no parent site, no need to forward any site control images. $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:54.869 2010 Central Daylight Time><thread=412 (0x19C)> ~Created site control notification for site COL $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:54.869 2010 Central Daylight Time><thread=412 (0x19C)> STATMSG: ID=3306 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_HIERARCHY_MANAGER" SYS=CAZDEPLOYMENT SITE=COL PID=5656 TID=412 GMTDATE=Thu Nov 04 05:18:54.869 2010 ISTR0="C:\Program Files (x86)\Microsoft Configuration Manager\inboxes\hman.box\0S1805HA.CT2" ISTR1="COLO" ISTR2="COL" ISTR3="52" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:54.869 2010 Central Daylight Time><thread=412 (0x19C)> Site COL in Sites table: Site status = 1, Detailed status = 1 $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:54.900 2010 Central Daylight Time><thread=412 (0x19C)> ~Processing site control file: Site COL File C:\Program Files (x86)\Microsoft Configuration Manager\inboxes\hman.box\25SDSGY5.CT2 $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:54.900 2010 Central Daylight Time><thread=412 (0x19C)> ~The serial number (51) for the site control file C:\Program Files (x86)\Microsoft Configuration Manager\inboxes\hman.box\25SDSGY5.CT2 (site = COL) is out of date, discard it, the current site serial number is 52 $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:54.916 2010 Central Daylight Time><thread=412 (0x19C)> ~Wait for site control changes for maximum 3600 seconds... $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:54.932 2010 Central Daylight Time><thread=412 (0x19C)> ~Wait for site control changes for maximum 3600 seconds... $$<SMS_HIERARCHY_MANAGER><Thu Nov 04 00:18:59.932 2010 Central Daylight Time><thread=412 (0x19C)>

I think i have added the computer account to every different group on active directory, with reboots inbetween and i still have no luck with this..........

Hi, You need to Create the System Management container in AD and grant the site server computer account access to that. For more information check - http://technet.microsoft.com/en-us/library/bb632591.aspx and http://technet.microsoft.com/en-us/library/bb633169.aspxKent Agerlund | http://scug.dk/ | The Danish community for System Center products

Thats already beeb done, i have granted it access every which way possible, and it still says it does not have access

You were not getting an "access denied" in that case, but 8202 = The specified directory service attribute or value does not exist. Have you already extended the schema? http://technet.microsoft.com/en-us/library/bb633121.aspx

Well that where im a little confused, The domain that was setup here has two location, The main location and this location, the mail location has a primary domain controller and this location has a primary domain controller which is the second in the list, I ran the extend on the primary using a LDF file because the executable kept getting access denied errors, which that domain controller happens to be running windows 2000. Its a big mess............ So in theory the schema has been extended I also set the permissions on the windows 2000 domain controller to allow schema updates

my preferred method: Manually create the System Management container using ADSIedit http://technet.microsoft.com/en-us/library/bb632591.aspx using ExtADSch.exe as a method to extend AD schema as it's easier to read the log files it created http://technet.microsoft.com/en-us/library/bb680608.aspx and then use ADSIedit to verify site information is published in AD http://technet.microsoft.com/en-us/library/bb693614.aspx---Packie

my preferred method: Manually create the System Management container using ADSIedit http://technet.microsoft.com/en-us/library/bb632591.aspx using ExtADSch.exe as a method to extend AD schema as it's easier to read the log files it created http://technet.microsoft.com/en-us/library/bb680608.aspx and then use ADSIedit to verify site information is published in AD http://technet.microsoft.com/en-us/library/bb693614.aspx ---Packie This is what i get when trying to extent the schema, <11-04-2010 13:47:56> Modifying Active Directory Schema - with SMS extensions. <11-04-2010 13:47:57> DS Root:CN=Schema,CN=Configuration,DC=cazarin,DC=local <11-04-2010 13:47:57> Failed to create attribute cn=MS-SMS-Site-Code. Error code = 5. <11-04-2010 13:47:57> Failed to create attribute cn=mS-SMS-Assignment-Site-Code. Error code = 5. <11-04-2010 13:47:57> Failed to create attribute cn=MS-SMS-Site-Boundaries. Error code = 5. <11-04-2010 13:47:57> Failed to create attribute cn=MS-SMS-Roaming-Boundaries. Error code = 5. <11-04-2010 13:47:57> Failed to create attribute cn=MS-SMS-Default-MP. Error code = 5. <11-04-2010 13:47:57> Failed to create attribute cn=mS-SMS-Device-Management-Point. Error code = 5. <11-04-2010 13:47:57> Failed to create attribute cn=MS-SMS-MP-Name. Error code = 5. <11-04-2010 13:47:57> Failed to create attribute cn=MS-SMS-MP-Address. Error code = 5. <11-04-2010 13:47:57> Failed to create attribute cn=mS-SMS-Health-State. Error code = 5. <11-04-2010 13:47:57> Failed to create attribute cn=mS-SMS-Source-Forest. Error code = 5. <11-04-2010 13:47:57> Failed to create attribute cn=MS-SMS-Ranged-IP-Low. Error code = 5. <11-04-2010 13:47:57> Failed to create attribute cn=MS-SMS-Ranged-IP-High. Error code = 5. <11-04-2010 13:47:57> Failed to create attribute cn=mS-SMS-Version. Error code = 5. <11-04-2010 13:47:57> Failed to create attribute cn=mS-SMS-Capabilities. Error code = 5. <11-04-2010 13:47:57> Failed to create class cn=MS-SMS-Management-Point. Error code = 8202. <11-04-2010 13:47:57> Failed to create class cn=MS-SMS-Server-Locator-Point. Error code = 8202. <11-04-2010 13:47:57> Failed to create class cn=MS-SMS-Site. Error code = 8202. <11-04-2010 13:47:57> Failed to create class cn=MS-SMS-Roaming-Boundary-Range. Error code = 8202. <11-04-2010 13:47:57> Failed to extend the Active Directory schema. Your Windows NT logon ID does not have the necessary privileges to extend the Active Directory schema, please find details in "C:\ExtADSch.log". Even though ive tried running it on the domain administrator account, I think it has somthing to do with the windows 2000 domain controller, but i set the schema to allow updates. I think there may be somthing wrong with the domain controller permissions. Any ideas? I extended the schema with a LDF file but when i run extadsch.exe it doesnt say that it already exists

do you have access to manually create the System Management container or any container in your own forest using ADSIedit?---Packie

do you have access to manually create the System Management container or any container in your own forest using ADSIedit? ---Packie Yes, i have created the System Management container manually, The SCCM sees it and if i create the SMS-Site-COL it sees that but cannot update it I have set the permissions on the container to have full access for the sccm machine, also i have tried using delegation for setting the permissions and had no luck

more info on error 8202: http://support.microsoft.com/kb/830022---Packie

I am going to try to upgrade the domain controller to a newer version of windows then see how that goes, i think that windows 2000 domain controller is seen its time and has to go, i will report back after i get that task done.

It suggest that both of your service account and computer account have the correct rights to update AD. Perhaps you need to add the sccm server account with the correct rights. Good luck upgrading your DC :)---Packie

Thanks! Which account is the SCCM server account? and how do i find out? maybe that is my issue. I have the sccm server added with full rights on the container

your sccm server account is the site server computer accountKent Agerlund | http://scug.dk/ | The Danish community for System Center products

your sccm server account is the site server computer account Kent Agerlund | http://scug.dk/ | The Danish community for System Center products i already have the computer added to the container, either way i am upgrading the DC right now so thats gotta help

The system management container has nothing to do with extending the schema. That's a different thing. No need to update any DCs IMHO. Make sure to follow http://technet.microsoft.com/en-us/library/bb633121.aspx exactly: hint: schema admin + allow schema updates when DC is server 2000: http://technet.microsoft.com/en-us/library/bb632955.aspx

That's because you did not upgrade the schema yet (or you tried but it failed). Just makse sure to extend the schema and those issues will go away. I figured it had to do with that, i will get this DC upgraded and report back with an answer, Thanks guys!!