DCPROMO will not install DC; error during membership change "Access Denied"

Posted on 2005-04-16
Last Modified: 2010-04-14
Network with 3 Windows 2000 DC's.
55 PCs at 4 different offices.
T1's in place, all routing is functioning.  Bandwidth is not a problem.
First 3 DC's went in without incident.
last DC to be installed was in February.
Problem began 2 days ago when an additional DC was being added at a new office.

DNS is installed and functioning network wide; reverse zones are correct on all servers.  All servers can resolve other servers (including new one).
nslookup is able to resolve all servers (forward and reverse)
SRV records are present and correct.
PCs are able to be joined to the domain.

Running DCPROMO on new server:
DCPROMO executes, accepts Administrator user name and password.
specify directory locations for AD.
When the machine account change begins, DCPROMO errors out and the following message is generated:
The operation failed because: Failed to modify the necessary properties for the machine account SERVERNAME$.  "Access is denied".

Group policy has been verified for the "Enable Computer and User Accounts to be trusted for Delegation" setting.
file permissions have been verified for the ntds.dit file
an attempt at DCPROMO was run on the same LAN as the GC server to verify the problem.
We were able to duplicate the problem with a test server.
Forward and reverse DNS zones are standard DNS zones, not AD integrated.

A member server can be added successfully and there are no problem joining PCs to the domain.  DNS can be installed on a server and the zone transfers are working properly.
Question by:tsystems-tx
    LVL 10

    Expert Comment


    Author Comment

    I have already checked this and the other KB articles that reference disjointed name space, and DNS permissions.

    LVL 10

    Accepted Solution

    LVL 8

    Expert Comment

    by:Leandro Iacono
    I don thik this: "Group policy has been verified for the "Enable Computer and User Accounts to be trusted for Delegation" setting" will do the trick.

    Are you sure you are using and Enterprise Admins user account to join the DC?

    Author Comment


    Thank you for your help; the second link you posted had the solution to the problem.  The Domain Controllers were not in the Domain Controllers OU; they had been inadvertently moved when other computer objects were being moved.  (DUH.)

    You are awarded the points for the solution!


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Top 6 Sources for Identifying Threat Actor TTPs

    Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

    NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
    Password hashing is better than message digests or encryption, and you should be using it instead of message digests or encryption.  Find out why and how in this article, which supplements the original article on PHP Client Registration, Login, Logo…
    Need more eyes on your posted question? Go ahead and follow the quick steps in this video to learn how to Request Attention to your question. *Log into your Experts Exchange account *Find the question you want to Request Attention for *Go to the e…
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    10 Experts available now in Live!

    Get 1:1 Help Now