UCCE 8.5(2) install on W2008 R2 SP1 - 2008 DC Problems

Question

I recently installed from 8.0.1A a UCCE and CVP system in my lab - DC (W2003), RGR, AW-HDS, PG with CUCM, CUPS, CVP. As noted, the Domain Controller was a W2003 box. Basically no worries.
So now I try to do it again with a W2008 R2 Domain Controller and this thing is wild. I've ensured that the Firewalls are off at all three levels, but the Domain Manager is complaining and I have trouble logging into the Web setup tool.
Anyone have any tips to make this play nice. It was simple with a 2003 DC, but the 2008 R2 DC is a spider's web of security layers.
Regards,
Geoff

Answer 1

But I must say there is very little tracing in the DomainManager - even when I made the registry change.
My mistake. It does not write at a higher trace level to DomainManager.txt but instead creates a new file called sadlib.log in the TEMP directory.
I'm still unable to create the OU correctly so that Web Setup allows the instance to be added.
But if I run DomainManager again, it crashes when I click on the + to expand the top level item.
When I try to add the instance the trace from Websetup.log is:
17: SB738571.W2008.ICM: Aug 24 2011 11:11:55.249 -0700: %ICM-ERROR-ADSetupAuthorizer.checkAndFixSecurityGroups:  A problem was encountered while checking or creating security groups for instance OU=ucce1,OU=lab,OU=Cisco_ICM,DC=W2008,DC=ICM; Exception Details: Should have SG member "CN=lab_ucce1_Setup,OU=ucce1,OU=lab,OU=Cisco_ICM,DC=W2008,DC=ICM" in:
CN=lab_ucce1_Config,OU=ucce1,OU=lab,OU=Cisco_ICM,DC=W2008,DC=ICM
0x8A (138)
Should have SG member "CN=lab_ucce1_Setup,OU=ucce1,OU=lab,OU=Cisco_ICM,DC=W2008,DC=ICM" in:
CN=lab_ucce1_WebView,OU=ucce1,OU=lab,OU=Cisco_ICM,DC=W2008,DC=ICM
0x8A (138)
Although I can't use the DomainManager I can go directly to the DC and add the groups I "think" it wants, referring to the above trace. No good.
sadlib.log - the error I get when I try to add the Cisco_ICM OU is detailed a little more in this log.
08/24/11 10:37:11   SadMan::addSGMember getAdObject SadIcmInstance::GetIcmInstance() returned NULL
08/24/11 10:37:11   SadMan::addSGMember adding member LDAP://W2008.ICM/CN=Domain Admins,CN=Users,DC=W2008,DC=ICM to group CN=Cisco_ICM_Config,OU=Cisco_ICM,DC=W2008,DC=ICM
08/24/11 10:37:11   SadMan::addSGMember Succeeded (0x0) adding member LDAP://W2008.ICM/CN=Domain Admins,CN=Users,DC=W2008,DC=ICM to group CN=Cisco_ICM_Config,OU=Cisco_ICM,DC=W2008,DC=ICM
08/24/11 10:37:11   SadMan::addSGMember getAdObject SadIcmInstance::GetIcmInstance() returned NULL
08/24/11 10:37:11   SadMan::addSGMember adding member LDAP://W2008.ICM/CN=Domain Admins,CN=Users,DC=W2008,DC=ICM to group CN=Cisco_ICM_WebView,OU=Cisco_ICM,DC=W2008,DC=ICM
08/24/11 10:37:11   SadMan::addSGMember Succeeded (0x0) adding member LDAP://W2008.ICM/CN=Domain Admins,CN=Users,DC=W2008,DC=ICM to group CN=Cisco_ICM_WebView,OU=Cisco_ICM,DC=W2008,DC=ICM
08/24/11 10:37:11   SadMan::addSGMember getAdObject SadIcmInstance::GetIcmInstance() returned NULL
08/24/11 10:37:11   SadMan::addSGMember adding member LDAP://W2008.ICM/CN=Domain Admins,CN=Users,DC=W2008,DC=ICM to group CN=Cisco_ICM_Setup,OU=Cisco_ICM,DC=W2008,DC=ICM
08/24/11 10:37:11   SadMan::addSGMember Succeeded (0x0) adding member LDAP://W2008.ICM/CN=Domain Admins,CN=Users,DC=W2008,DC=ICM to group CN=Cisco_ICM_Setup,OU=Cisco_ICM,DC=W2008,DC=ICM
08/24/11 10:37:11   SadStatus::appendText Cannot get Security, no bind to object OU=Cisco_ICM,DC=W2008,DC=ICM
08/24/11 10:37:11   SadStatus::addError Cannot add ACE Null Dacl
08/24/11 10:37:11   SadMan::getGuid
Not quite enough to help me. I am sure there is some security setting I need to "relax" on the DC before this runs in order for it to work.
Any clues guys?
Regards,
Geoff