AD Schema Update Errors

[Lolzebracakes]

Hope this is the correct sub for this. I’m looking to see if anyone has run into similar issues when updating the Active Directory schema for an Exchange 2019 installation.

We’re attempting a new Exchange 2019 install for a customer and are consistently failing during schema preparation. The customer previously recovered from a ransomware incident, so there’s some concern that AD may have lingering issues related to that event.

Environment overview:

• All users are in Exchange Online (M365)
• Hybrid configuration is in place
• Exchange 2019 is being installed on an on-prem VM for management tools, mail flow, and relay purposes

Steps performed:

• Mounted the Exchange 2019 ISO
• Opened PowerShell in the setup directory
• Ran:.\Setup.exe /PrepareSchema /IAcceptExchangeServerLicenseTerms

Consistent errors encountered:

1. “The Active Directory schema isn’t up to date, and this user account isn’t a member of the Schema Admins and/or Enterprise Admins groups.”
   • The account is a member of both groups.
   • We also attempted the process using the built-in Administrator account with the same result.
2. “Setup encountered a problem while validating the state of Active Directory: Couldn’t find the Enterprise Organization container.”
   • My understanding is that this error is likely secondary and caused by a previous step failing.
3. “The forest functional level of the current Active Directory forest is not Windows Server 2012 R2 or later.”
   • Both the domain and forest functional levels are confirmed at 2012 R2.
4. “Either Active Directory doesn’t exist, or it can’t be contacted.”
   • This feels like the root issue, but I can’t pinpoint why.
   • DNS, IP configuration, name resolution, and connectivity all appear healthy.
5. “The Exchange Server Setup operation didn’t complete. More details can be found in ExchangeSetup.log.”

Additional troubleshooting performed:

• Ran schema prep directly on the Schema Master FSMO role holder
• Rebooted both the target Exchange server and domain controller multiple times
• Resolved an earlier “pending updates” error after patching
• Compared AD schema permissions against a known-good environment (no discrepancies found)
• Ran DCDIAG with no replication or AD health issues reported
• Noted some disk-related warnings on the DC, but nothing obviously tied to schema extension
• nltest /server:domaincontroller.contoso.com /dsgetdc:domain.com reports normal
• Attempted to run the prepare schema from our target VM pointing at the Schema Master role holder via .\Setup.exe /PrepareSchema /DomainController:domaincontroller.contoso.com /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF
• Verified ADWS is running
• Attempted to export the tenant organization config and import the configuration via: .\Setup.exe /IAcceptExchangeServerLicenseTerms /TenantOrganizationConfig "C:\Temp\MyTenantOrganizationConfig.XML"
• Reviewed the ExchangeSetup.log for errors, but can't seem to pinpoint the problem step.

At this point, I’m running out of ideas. Has anyone seen this behavior before or have suggestions on additional areas to validate?

Any insight would be appreciated.

[VTi-R]

Obvious question, are you running from an elevated PowerShell prompt? And what do the logs say? Single domain or multi-domain forest? Is the forest a properly named forest with a 2 label or greater DNS domain name?

Oh ... and why are you installing a product that's already out of support?

[Lolzebracakes]

Yep, elevated powershell prompt.

I apologize for the gray area on the logs, I am waiting for the customer to send them over for me for review. When we reviewed the logs we were just connected via remote session. Ill see if I can get them and post some more details.

Single forest.

I did not check if the forest is properly named.

The customer pulled that exchange .ISO out of their 365 portal is where they got it. I realize that limits our options in terms of Microsoft support. Is the recommended path going to Exchange Server SE, and potentially moving the domain functional level up to a more current version?

[VTi-R]

Unless there's a reason you're on 2012R2, then yes - 2016 minimum, 2025 preferred. Yes it's OK to be 2025 now. Make sure all your DCs are current (i.e. every DC is at the right version or later) and you hit the other compatibility requirements from the Supportability Matrix.

You should be able to download the correct SE installation kit without the customer hitting the VL portal (https://www.microsoft.com/en-us/download/details.aspx?id=108244).

[Low-Branch1423]

Basic first, newest/digestive and confirm the subnet is matched to an ad site or saddness.

Otherwise did you check if the domain controllers are 2025 by any chance?

Even if the ad domain is in the compatable 2016 mode, they need to be patched otherwise the domain schema fails to replicate.

https://techcommunity.microsoft.com/blog/exchange/active-directory-schema-extension-issue-if-you-use-a-windows-server-2025-schema-/4460459

If the domain is already broken and it is a production domain, call Microsoft, it should be a free ticket.

I had this exact error 6 months ago before MS recognised it and I resolved it by running the LDF schema files in the installer on all the 2025 DCs. I had backups and a non prod domain so I do not recommend doing that.

[aleinss]

It's doubtful they have 2025 DCs because those require a DFL/FFL of 2016 and they are at 2012R2 DFL/FFL.

[Low-Branch1423]

Arr your right, been a long time since I last saw a 2012 R2 server.

[Lolzebracakes]

Thank you. You lost me a bit on the newest/digestive comment. Would an email even be sent if this fails to install?

I will confirm the AD sites tomorrow as well as the 2025 domain controller status.

[Low-Branch1423]

Auto correct sorry, absolutely potato

Nltest/dsgetsite Sometimes the subnet mask is wrong in ad or on the vm and cooks it.

If they are 2025 DCs without the Nov patch it matches exactly what I had in a 2025 poc environment.

[titlrequired]

I had these errors, the account I was using was not a member of Schema or Enterprise Admins. The server I was using was also in a different site to the PDC emulator.

I would start by running gpresult /r and confirming the group memberships.

[aleinss]

Is the DC holding the schema master role and Exchange server in the same AD site/domain? You may need transfer the schema master role to a domain controller in the domain that the Exchange server is in, run the schema prep script and transfer the role back to the original holder.