DCDIAG - Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have Replicating Directory Change

When you run DCDIAG, you might receive a “Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have Replicating Directory Change” error message.

The DCDIAG checks that the security descriptors on the naming context heads have appropriate permissions for replication. The error indicates that the Enterprise Domain Controllers group does not have Replicating Directory Changes In Filtered Set access rights for the DNS application directory partitions.

If you do not plan to add an RODC to the forest, you can disregard this error. If you plan to add an RODC to the forest, you must run adprep /rodcprep command.

You can read more on ADPREP related issues on the following TechNet article:

http://technet.microsoft.com/en-us/library/cc754463(WS.10).aspx

Posted in: Active Directory,ADPREP,Windows,Windows 2008 R2