Executing TPMSchemaExtension.ldf generates error "Failed on line 110. The last token starts with '1'."

i noticed trying deploy windows tpm backup ad fails access denied in mdt. thought i had updated schema these 2 changes:

1. tpmschemaextension.ldf
2. tpmschemaextensionaclchanges.ldf

i re-ran them error on first 1 (domain placeholder real domain):

ldifde -i -v -f tpmschemaextension.ldf -c "dc=x" "dc=domain,dc=local" -k -j .
connecting "dc1.domain.local"
logging in current user using sspi
importing directory file "tpmschemaextension.ldf"
loading entries

there syntax error in input file
failed on line 110.  the last token starts '1'.
0 entries modified successfully.
error has occurred in program

the second 1 runs ok:

c:\users\admin-ndb\desktop>ldifde -i -v -f tpmschemaextensionaclchanges.ldf -c "dc=x" "dc=domain,dc=local
" -k -j .
connecting "dc1.domain.local"
logging in current user using sspi
importing directory file "tpmschemaextensionaclchanges.ldf"
loading entries
1: cn=ms-tpm-information-object,cn=schema,cn=configuration,dc=domain,dc=local
entry modified successfully.

2: (null)
entry modified successfully.


2 entries modified successfully.

command has completed successfully

running test passes well:

cscript list-aces.vbs
microsoft (r) windows script host version 5.8
copyright (c) microsoft corporation. rights reserved.

accessing object: dc=domain,dc=local

>            aceflags: 10
>             acetype: 5
>               flags: 3
>          accessmask: 32
>          objecttype: {aa4e1a6d-550d-4e05-8c35-4afcb917a9fe}
> inheritedobjecttype: {bf967a86-0de6-11d0-a285-00aa003049e2}
>             trustee: nt authority\self

1 ace(s) found in dc=domain,dc=local related bitlocker , tpm

is "failed on line 110.  the last token starts '1'." error because objects exist? see 7 entries in asdi edit tool:

line 29: dn: cn=ms-tpm-srk-pub-thumbprint,cn=schema,cn=configuration,dc=x
line 48: dn: cn=ms-tpm-owner-information-temp,cn=schema,cn=configuration,dc=x
line 67: dn: cn=ms-tpm-tpm-information-for-computer,cn=schema,cn=configuration,dc=x
line 87: dn: cn=ms-tpm-tpm-information-for-computer-bl,cn=schema,cn=configuration,dc=x
line 137: dn: cn=ms-tpm-information-objects-container,cn=schema,cn=configuration,dc=x
line 160: dn: cn=ms-tpm-information-object,cn=schema,cn=configuration,dc=x
line 196: dn: cn=tpm devices,dc=x

hi nathaniel b,

please refer following article check if perform procedure correctly:

https://technet.microsoft.com/en-us/library/dn466534(v=ws.11).aspx

we need set permissions password information first.

best regards,

anne

---

please remember mark replies answers if help.
if have feedback technet subscriber support, contact tnmff@microsoft.com.

Windows Server  >  Directory Services