Promoting a new server to be the second Domain Controller on the domain causes a "Replication Access was denied." message.

What credentials do you provide? Enterprise Admin or Domain Admin of your subdomain?

Enterprise admin AND Domain Admin. I'm using the default administrator account which is a member of both Enterprise Admins and Domain Admins.

This may also help:

http://technet2.microsoft.com/windowsserver/en/library/838dbebe-7a87-4cd2-b6f7-fc5847a2c2261033.mspx?mfr=true

Domain Controller Diagnosis
Performing initial setup:
   Done gathering initial info.
Doing initial required tests
   Testing server: Default-First-Site-Name\BANANA
      Starting test: Connectivity
         ......................... BANANA passed test Connectivity
Doing primary tests
   Testing server: Default-First-Site-Name\BANANA
      Starting test: CheckSecurityError
         [BANANA] No security related replication errors were found on this DC!  To target the connection to a specific source DC use /ReplSource:<DC>.
         ......................... BANANA passed test CheckSecurityError
   Running partition tests on : Schema
   Running partition tests on : Configuration
   Running partition tests on : {Domain NETBIOS Name remove for security}
   Running enterprise tests on : {Domain Name remove for security}

All the tests on that technet article it says to perform pass successfully.

I have also performed an integrity check on the domain, as well as performing an Offline defragmentation in order to try and rectify this problem.

I was told by the previous admin that its possible the system drive may have become full at some stage so the possibility of a corrupted AD is likely. But all the tests i've performed seem to indicate otherwise.

It's frustrating because it is the ONLY domain controller. If there was a backup, it would be so easy to fix.

There are some interesting ones. But they seem to indicate what the first error was showing.

The local domain controller failed to retrieve the changes requested for the following directory partition. As a result, it was unable to send the change requests to the domain controller at the following network address.
 

-----Event Log Entry 1-----
Directory partition:
CN=Schema,CN=Configuration,DC={FQDN removed for security},DC=qld,DC=edu,DC=au
Network address:
6afab99c-6e26-464a-975f-f58f105218bc._msdcs.{FQDN removed for security},.qld.edu.au
Extended request code:
0
 
Additional Data
Error value:
8453 Replication access was denied.

----- Event Log Entry 2 ------
The local domain controller could not disable the software-based disk write cache on the following hard disk.  
Hard disk:
c:
 Data might be lost during system failures.

----- Event Log Entry 3 -----
Internal error: An Active Directory error has occurred.
Additional Data
Error value (decimal):
1053
Error value (hex):
41d
Internal ID:
30004f4

http://support.microsoft.com/kb/329860/en-us may help

Regarding write cache: http://support.microsoft.com/kb/233541/en-us

I tried both resetting the secure channel password and checking the Domain Controllers properties in ADSIEDIT as the KB article suggested and it still didn't work. I try to do a DCPROMO on the server and it still fails.

My domain is in 2003 Native mode btw.

Have a look at  %systemroot%\debug\dcpromo.log
Maybe there are other warnings/errors before the security error.

Verify that the Admin account for joining isn't locked and the password has not expired...

The admin account isn't locked

dcpromoui 1064.1140 0422     Calling DsRoleDcAsReplica
dcpromoui 1064.1140 0423     lpServer               : (null)
dcpromoui 1064.1140 0424     lpDnsDomainName        : {Domain Name Hidden for Security}
dcpromoui 1064.1140 0425     lpReplicaServer        : (null)
dcpromoui 1064.1140 0426     lpSiteName             : (null)
dcpromoui 1064.1140 0427     lpDsDatabasePath       : C:\WINDOWS\NTDS
dcpromoui 1064.1140 0428     lpDsLogPath            : C:\WINDOWS\NTDS
dcpromoui 1064.1140 0429     lpRestorePath          : (null)
dcpromoui 1064.1140 042A     lpSystemVolumeRootPath : C:\WINDOWS\SYSVOL
dcpromoui 1064.1140 042B     lpAccount              : {Domain Name Hidden for Security}\administrator
dcpromoui 1064.1140 042C     Options                : 0xC0
dcpromoui 1064.1140 042D     Enter DoProgressLoop
dcpromoui 1064.1140 042E       Enter State::GetOperation REPLICA
dcpromoui 1064.1140 042F       Enter ProgressDialog::UpdateButton
dcpromoui 1064.1140 0430         Enter ProgressDialog::UpdateButton Cancel
dcpromoui 1064.1140 0431       Enter ProgressDialog::UpdateText Stopping service NETLOGON

dcpromoui 1064.1140 0432       Enter ProgressDialog::UpdateText Configuring the local domain controller to host Active Directory
dcpromoui 1064.1140 0433       Enter ProgressDialog::UpdateText Replicating the schema directory partition
dcpromoui 1064.1140 0434       Enter ProgressDialog::UpdateText The attempted domain controller operation has completed

dcpromoui 1064.1140 0435       Enter ProgressDialog::UpdateButton
dcpromoui 1064.1140 0436       Progress loop complete.
dcpromoui 1064.1140 0437       Calling DsRoleGetDcOperationResults
dcpromoui 1064.1140 0438       Error 0x0 (!0 => error)
dcpromoui 1064.1140 0439       Operation results:
dcpromoui 1064.1140 043A       OperationStatus      : 0x2105 !0 => error
dcpromoui 1064.1140 043B       DisplayString        : Active Directory could not replicate the directory partition CN=Schema,CN=Configuration,DC={Domain Name Hidden for Security},DC=qld,DC=edu,DC=au from the remote domain controller banana.{Domain Name Hidden for Security}.qld.edu.au.
dcpromoui 1064.1140 043C       ServerInstalledSite  : (null)
dcpromoui 1064.1140 043D       OperationResultsFlags: 0x0
dcpromoui 1064.1140 043E       Enter ProgressDialog::UpdateText Active Directory could not replicate the directory partition CN=Schema,CN=Configuration,DC={Domain Name Hidden for Security},DC=qld,DC=edu,DC=au from the remote domain controller banana.princeofpeace.qld.edu.au.
dcpromoui 1064.1140 043F       Enter State::SetOperationResultsMessage Active Directory could not replicate the directory partition CN=Schema,CN=Configuration,DC={Domain Name Hidden for Security},DC=qld,DC=edu,DC=au from the remote domain controller banana.{Domain Name Hidden for Security}.qld.edu.au.
dcpromoui 1064.1140 0440       Enter State::SetOperationResultsFlags 0x0
dcpromoui 1064.1140 0441   Exception caught
dcpromoui 1064.1140 0442   catch completed
dcpromoui 1064.1140 0443   handling exception
dcpromoui 1064.1140 0444   Enter State::ClearHiddenWhileUnattended
dcpromoui 1064.1140 0445   Enter State::GetRunContext NT5_MEMBER_SERVER
dcpromoui 1064.1140 0446   Enter State::GetRunContext NT5_MEMBER_SERVER
dcpromoui 1064.1140 0447   Enter EnableConsoleLocking
dcpromoui 1064.1140 0448     Enter RegistryKey::Create SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
dcpromoui 1064.1140 0449     Enter RegistryKey::SetValue-DWORD DisableLockWorkstation
dcpromoui 1064.1140 044A   Enter State::SetOperationResults result FAILURE
dcpromoui 1064.1140 044B   Enter ProgressDialog::UpdateText
dcpromoui 1064.1140 044C   Enter State::IsOperationRetryAllowed
dcpromoui 1064.1140 044D     true
dcpromoui 1064.1140 044E   Enter GetErrorMessage 80072105
dcpromoui 1064.1140 044F   Enter State::GetOperationResultsMessage Active Directory could not replicate the directory partition CN=Schema,CN=Configuration,DC={Domain Name Hidden for Security},DC=qld,DC=edu,DC=au from the remote domain controller banana.princeofpeace.qld.edu.au.
dcpromoui 1064.1140 0450   Enter Dialog::ModalExecute
dcpromoui 1064.1140 0451     Enter GetCredentialsDialog::OnInit
dcpromoui 1064.1140 0452       Enter Computer::GetNetbiosName
dcpromoui 1064.1140 0453         JUPITER
dcpromoui 1064.1140 0454       Enter Computer::IsJoinedToDomain JUPITER
dcpromoui 1064.1140 0455         is domain joined
dcpromoui 1064.1140 0456       Enter State::GetOperation REPLICA
dcpromoui 1064.1140 0457       Enter GetCredentialMessage
dcpromoui 1064.1140 0458         Enter State::GetOperation REPLICA
dcpromoui 1064.1140 0459         Enter State::GetReplicaDomainDNSName {Domain Name Hidden for Security}.qld.edu.au
dcpromoui 1064.1140 045A       Enter State::GetUserDomainName {Domain Name Hidden for Security}.qld.edu.au
dcpromoui 1064.1140 045B       Enter State::GetUsername administrator
dcpromoui 1064.1140 045C       Enter CredUi::SetUsername
dcpromoui 1064.1140 045D       Enter State::GetPassword
dcpromoui 1064.1140 045E       Enter CredUi::SetPassword
dcpromoui 1064.1140 045F   credential retry canceled
dcpromoui 1064.1140 0460   Enter ComposeFailureMessage
dcpromoui 1064.1140 0461     Enter State::GetOperationResultsMessage Active Directory could not replicate the directory partition CN=Schema,CN=Configuration,DC={Domain Name Hidden for Security},DC=qld,DC=edu,DC=au from the remote domain controller banana.princeofpeace.qld.edu.au.
dcpromoui 1064.1140 0462     Enter State::GetOperationResultsFlags 0x0
dcpromoui 1064.1140 0463     Enter State::SetFailureMessage The operation failed because:

Active Directory could not replicate the directory partition CN=Schema,CN=Configuration,DC={Domain Name Hidden for Security},DC=qld,DC=edu,DC=au from the remote domain controller banana.{Domain Name Hidden for Security}.qld.edu.au.

"Replication access was denied."

Running out of ideas... it looks like a typical permission problem, but you say the Admin account is okay and has all permissions but it doesn't work...

So maybe just create a new account, add it to the required groups (Domain Admin, Enterprise Admin, etc.) and use this one for joining...
Or check if any weird Group Policy is removing required permissions/user rights from the admin account you're using...
Also someone might have messed with the permissions on your active directory. I'd expect some serious error events on your dc, if thats the case... but who knows.

Yeah checked all that..

Thanks for your help. It's been driving me nuts for two days. I think i'm resigned to the outcome that I'm going to have to rebuild the domain. I don't mind doing that, it's just a few extra days work I'd hoped to avoid. Oh well. Least this way I will know the domain is built properly :)

Most of the KB articles I read said If it got to this point, you're better off rebuilding the domain anyway, so I think it's the best thing I can do.

Nup. theres no metadata relevant on the server. It's only aware of itself from any reference I can find.

From what I can see, It seems as though this domain was once part of a forest, that it no longer has access to. Hence why the schema catalogs won't replicate. They simply arent there.