Running Adprep.exe

Applies To: Windows Server 2008, Windows Server 2008 Foundation, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2

This topic explains what Adprep.exe is. It also provides links to step-by-step instructions for running Adprep.exe.

  • What is Adprep.exe?

  • Considerations for using Adprep.exe in Windows Server 2012 R2 and Windows Server 2012

  • Considerations for using Adprep.exe in Windows Server 2008 R2 and Windows Server 2008

  • Running Adprep.exe

  • Troubleshooting errors with Adprep.exe

What is Adprep.exe?

Adprep.exe is a command-line tool that is included on the installation disk of each version of Windows Server. Adprep.exe performs operations that must be completed on the domain controllers that run in an existing Active Directory environment before you can add a domain controller that runs that version of Windows Server.

Adprep.exe commands run automatically as needed as part of the AD DS installation process on servers that run Windows Server 2012 or later. The commands need to run in the following cases:

  • Before you add the first domain controller that runs a version of Windows Server that is later than the latest version that is running in your existing domain.

  • Before you upgrade an existing domain controller to a later version of Windows Server, if that domain controller will be the first domain controller in the domain or forest to run that version of Windows Server.

For example, if your organization has domain controllers that run Windows 2000 Server or Windows Server 2003, before you can add a new domain controller that runs Windows Server 2008 R2 or upgrade one of the existing domain controllers to Windows Server 2008 R2, you must run Adprep.exe from the \Support\Adprep folder of the Windows Server 2008 R2 installation DVD on your existing domain controllers.

Adprep.exe is a rollup of all previous versions of this tool. In other words, if you currently have domain controllers that run Windows Server 2003 and you want to add domain controllers that run Windows Server 2008 R2, you only have to run Adprep.exe from the Windows Server 2008 R2 operating system disk. It is not necessary to run the version from Windows Server 2008 because the version in Windows Server 2008 R2 includes all the changes from previous versions.

What does Adprep.exe do?

Adprep.exe has parameters that perform a variety of operations that help prepare an existing Active Directory environment for a domain controller that runs a later version of Windows Server. Not all versions of Adprep.exe perform the same operations, but generally the different types of operations that Adprep.exe can perform include the following:

  • Updating the Active Directory schema

  • Updating security descriptors

  • Modifying access control lists (ACLs) on Active Directory objects and on files in the SYSVOL shared folder

  • Creating new objects, as needed

  • Creating new containers, as needed

For more information about the changes that Adprep.exe performs, see the following resources:

Considerations for using Adprep.exe in Windows Server 2012 R2 and Windows Server 2012

Beginning with Windows Server 2012, Adprep.exe is integrated into the AD DS installation process and runs automatically as needed. For example, when you install the first domain controller that runs Windows Server 2012 into an existing domain and forest, then adprep /forestprep and adprep /domainprep automatically run and report the results of the operations.

Some organizations may prefer to run Adprep.exe separately, either in advance of an AD DS installation or simply to extend an existing AD DS schema to support new features such as the Device Registration Service in Windows Server 2012 R2. For this reason, Adprep.exe is also included in the \Support\Adprep folder of the operating system disk.

Also beginning with Windows Server 2012, there is only one 64-bit version of Adprep.exe. It can be run remotely from any server that runs a 64-bit version of Windows Server 2008 or later. The computer where you run it can be either domain-joined or in a workgroup. It includes new syntax and parameter options in order to run it remotely.

For more information about the objects and containers that are created when the schema is extended to support Windows Server 2012 R2 and Windows Server 2012, see Changes to Adprep.exe.

Mitigating performance impact of deferred index creation

The execution of ADPREP and other applications that add indexed attributes to Active Directory databases greater than 100 GB may cause high CPU utilization by LSASS and high disk utilization from the writing of indexes. Then new indexes also trigger a replication event that must be processed by other DCs in the forest.

The addition of indexes in large Active Directory databases can prevent DCs from responding to clients and application server requests and cause desktop user or application performance degradation or operational failures. Windows Server 2008 R2 added indexes to improve LDAP query performance for certain queries. Windows Server 2012 and Windows Server 2012 R2 include those same indexes.

By installing hotfix 2846725 and enabling the DSheuristic attribute on DCs that run Windows Server 2008 R2, index creation is deferred and the time when indexing takes place is staggered across all DCs in the forest.

Beginning in Windows Server 2012, the introduction of schema changes occurs independently from the indexing of the attributes. See Deferred Index Creation.

In addition to applying the hotfix, you can take these steps to help prepare for the schema update:

  • Check the AD database size. See Determine the Database Size and Location Online.

  • Check the number of deleted objects.

  • Check the number of DCs that will get indexing.

  • Check the link speeds to those DCs

  • Use a test bed that reflects the production environment so that potential replication problems will be reproduced by testing (e.g. don’t test in a single domain forest if the production environment really has multiple domains).

Considerations for using Adprep.exe in Windows Server 2008 R2 and Windows Server 2008

In Windows Server 2008 R2, Adprep.exe is located in the \Support\Adprep folder of the operating system disk. In Windows Server 2008, Adprep.exe is located in the \Sources\Adprep folder.

Windows Server 2008 R2 includes a 32-bit version and a 64-bit version of Adprep.exe. The 64-bit version runs by default. If you want to run one of the Adprep.exe commands on a 32-bit computer, use the 32-bit version of Adprep.exe (Adprep32.exe).

Running Adprep.exe

To complete the required operations, you must run the Adprep.exe commands that are listed in the following table. You must run adprep /forestprep before you run other commands. Some commands must be run on specific domain controllers, as indicated in the table. None of the commands requires a restart of the server after the operation is complete. The remaining sections in this topic contain more details about each command.

Note

Command