Having problem moving Schema Master

[hindustnidude]

I dont have any possible ways to move the Schema master, the Change-button is greyed out on the Snap-in. I have DC1, DC2 and DC3 and the DC1 is holding the DMSO roles being the Windows 2003 AD-DC. It is also an NT4-PDC upgraded to Windows 2003 AD-DC and the others are fresh installation. I can move other FSMO roles except for the Schema master. No matter which DC i connected to on the Snap-in, the change button is greyer out, so there is not means of transferring the role to the targeted DC. By using NTDSUTIL I was getting "ldap, or role transfer error". Any ideas? Thanks

[absolute55]

Do you mean to say that you are a schema admin? If not, then you will need to be a schema admin to move the role. If that isnt it, then use the admod to move the role and post the error message:

admod -h DC_to_Move_to -sc xferschema -exterr

[Viceman]

To change the permission of Schema Master, domain admin accounts dont have one. This change is a forest level change. Domain Admin accounts will be only making changes that affect their own domain. You might only have a single domain in your forest so it makes little difference but imagine if a domain admin in one domain can change this in a multi domain forest. It could have the ability to change something that affects other domains thuse outside of the domain security boundary.