DCDIAG - Error - Replicating Directory Changes in Filtered Set

DCDIAG - Error - Replicating Directory Changes in Filtered Set

dcdiag returns : ENTERPRISE DOMAIN CONTROLLERS doesn’t have Replicating Directory Changes In Filtered Set
 
customer runs dcdiag and get error :

Starting test: NCSecDesc
Error NT AUTHORITYENTERPRISE DOMAIN CONTROLLERS doesn’t have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=ForestDnsZones,dc=example-cloud,dc=com
Error NT AUTHORITYENTERPRISE DOMAIN CONTROLLERS doesn’t have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=DomainDnsZones,DC=its,dc=example-cloud,dc=com
......................... ITS-ADDC-SERV1 failed test NCSecDesc
 
Resolution Microsoft technet url : http://technet2.microsoft.com/windowsserver2008/en/library/6c438941-f9b5-4edb-a9ee-1781526389e51033.mspx?mfr=true

Explains that you may need to run the command : adprep /rodcprep

NCSecDesc in DCDIAG is to check that the security descriptors on the application directory partition heads have appropriate permissions for replication.

It is an expected issue when you promote a Windows Server 2008 domain controller in a Windows Server 2003 domain without preparing RODC (read-only domain controller) in the forest by running ’adprep /rodcprep’. If you do not plan to add an RODC to the forest, it is safe to ignore it. Otherwise, you can run "adprep /rodcprep".