Error Events 1136 Following Windows Server 2008 Forestprep

Most people are (quite rightly) terrified of seeing a whole bunch of errors in the DS event log following a schema update.   This happened to me in a lab environment at a customer recently and I thought I would share the information here.

I ran Windows Server 2008 adprep /forestprep on a Windows Server 2003 SP1 DC.  All seemed to go well and the schema update completed successfully.  Before moving on I checked the Directory Service event log and found a large number of 1136 error events.  There were effectively two events that were recurring, as shown below.

Event Type: Error
Event Source: NTDS General
Event Category: DS Schema
Event ID: 1136
Date:  23/01/2009
Time:  1:02:38 p.m.
User:  NT AUTHORITY\ANONYMOUS LOGON
Computer: DC1
Description:
Active Directory failed to create an index for the following attribute.
�
Attribute identifier:
591789
Attribute name:
msFVE-RecoveryGuid
�
A schema cache update will occur 5 minutes after the logging of this event and will attempt to create an index for the attribute.
�
Additional Data
Error value:
-1403 JET_errIndexDuplicate, Index is already defined

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: NTDS General
Event Category: DS Schema
Event ID: 1136
Date:  23/01/2009
Time:  1:01:53 p.m.
User:  NT AUTHORITY\ANONYMOUS LOGON
Computer: DC1
Description:
Active Directory failed to create an index for the following attribute.
�
Attribute identifier:
591822
Attribute name:
msFVE-VolumeGuid
�
A schema cache update will occur 5 minutes after the logging of this event and will attempt to create an index for the attribute.
�
Additional Data
Error value:
-1403 JET_errIndexDuplicate, Index is already defined

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. 

Some Googling revealed the problem to be to do with a combination of the BitLocker Drive Encryption schema updates that are included as part of the Windows Server 2008 schema extensions together with certain language locales (New Zealand English in my case).

The resolution of the issue involves removing the CONTAINER_INDEX setting within the searchFlags attribute value of the msFVE-VolumeGuid and msFVE-RecoveryGuid attribute schema objects.  To do this you can use ADSIEdit to modify the value for both attributes from 27 to 25, as shown in the screenshot below.

Once the modifications have been made, the errors no longer recur.

Interestingly, I could not reproduce the problem when running Windows Server 2008 forestprep on a Windows Server 2003 R2 SP2 DC with the same language locale.

For more information see the Microsoft KB article below.

Error messages after you install the BitLocker Drive Encryption schema updates in a Windows Server 2003 domain