prepare active directory fails

s' are: View Entire Forest: 'True', Configuration Domain Controller: 'dc2012.domain.com', Preferred Global Catalog: 'dc2012.domain.com', Preferred Domain Controllers: '{ dc2012.domain.com }'
[10.21.2015 22:14:21.0864] [2] User specified parameters:  -DomainController:'dc2012.domain.com'
[10.21.2015 22:14:21.0864] [2] Beginning processing install-CannedAddressLists
[10.21.2015 22:14:21.0895] [2] Processing object "\".
[10.21.2015 22:14:21.0926] [2] Searching objects of type "AddressBookBase" with filter "(|((LdapRecipientFilter Equal (&(mailNickname=*)(objectCategory=group)))(|((LdapRecipientFilter Equal (& (mailnickname=*) (| (objectCategory=group) )))))))", scope "OneLevel" under the root "\".
[10.21.2015 22:14:21.0926] [2] Previous operation run on domain controller 'dc2012.domain.com'.
[10.21.2015 22:14:21.0926] [2] Previous operation run on domain controller 'dc2012.domain.com'.
[10.21.2015 22:14:21.0957] [2] [ERROR] Active Directory operation failed on dc2012.domain.com. This error is not retriable. Additional information: Insufficient access rights to perform the operation.
Active directory response: 00002098: SecErr: DSID-03150E49, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

[10.21.2015 22:14:21.0973] [2] [ERROR] The user has insufficient access rights.
[10.21.2015 22:14:22.0004] [2] Ending processing install-CannedAddressLists

So there I'm stuck. This apparently was encountered during CU8 upgrade aswell

How to get around this?
PrepareSchema and AD works all right

Was migrated from EX2007 but EX2007 is decomissioned

And yes, I'm enterprise, domain, schema and superduperhailcesar-admin