Article ID: 291356
Article Last Modified on 1/15/2006
APPLIES TO
- Microsoft Internet Security and Acceleration Server 2000 Standard Edition
This article was previously published under Q291356
SYMPTOMS
When you run the Internet Security and Acceleration (ISA) Server 2000 Enterprise Initialization tool (Msisaent.exe) to populate the ISA Server 2000 schema in Windows 2000 Active Directory, you may receive the following error message:
CAUSE
This problem can occur if the Remote Registry service on the domain controller that holds the schema master role in the forest does not run.
The ISA Server 2000 Enterprise Initialization tool can modify the Windows 2000 Active Directory schema if the tool connects to the domain controller that holds the schema master role, and then locates the following registry value:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Ntds\Parameters\Schema Update Allowed
If the value is set to 1 (true), ISA Server 2000 does not modify the value.
If the value is set to 0 (false), ISA Server 2000 changes the value to 1, makes the schema modifications, and then changes the value back to 0.
NOTE: The error will also occur if the Network Interface cards in the machine have been disabled.
RESOLUTION
To resolve this problem, install the ISA Server schema to the Windows 2000 Active Directory. You must be an administrator on the local computer. Also, you must be a member of the Enterprise Admins and Schema Admins groups.
The Remote Registry service on the domain controller that holds the schema master role must be started so that the ISA Server 2000 Enterprise Initialization tool can change the Schema Update Allowed registry value to make the schema writeable.
To find out if the Remote Registry service is running on the schema master:
- Locate the schema master for the forest as outlined in the following article:
234790 How to Find FSMO Role Holders (Servers)
- On the schema master, right-click My Computer, and then click Manage.
- Click Services and Applications, and then click Services. In the Services list, locate the Remote Registry service, and then start the service if it is not already running.
- Run the ISA Server 2000 Enterprise Initialization tool again either from the Isaautorun.exe program or the Msisaent.exe tool.
STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.
Keywords: kberrmsg kbsetup kbprb KB291356
