When promoting a domain controller into the existing SBS domain they received the following error:
We have not encountered this error on any of the Swings we have done to date.
Active Directory Wizard was unable to convert the computer account NewDC$ to a domain controller account. Access denied.
A quick search turned up the problem:
- Microsoft KB 232070: When you run Dcpromo.exe to create a replica domain controller, you receive the "Failed to modify the necessary properties for the machine account. Access is denied." error message.
This is what the policy setting in the Default Domain Controllers GPO should be out of the box on one of our SBS domains:
Enable computer and user accounts to be trusted for delegation
Now, something to keep in mind when making any changes to these types of policy settings: Do not click the Add User or Group button and type the name of a user or group then click the OK button.
Take an extra step or two to make sure that the proper Active Directory object is selected:
- Click the Add User or Group button.
- Click the Browse button.
- Type the name of the user or group. In this case we will use administrators.
- Click the Check Names button.
- A successful query will underline your user or group thus confirming the correct object is selected. Any other possibilities and you will get a "Which one do you want" type prompt.
- Click OK.
- Click OK.
- Click Apply and OK.
- Click Start --> Run --> GPUpdate /Force [Enter]
- Check the SBS App Log for the SceCli information Event ID 1704 indicating a successful replication.
You can then rerun DCPromo on the problematic server. Make sure that Windows Firewall service is disabled on the soon to be DC!
Microsoft Small Business Specialists
*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.