Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Long story short, I'm trying to install Blackberry Enterprise Server Express on my Exchange 10 server, which is also a windows server 2008 DC.

I need to allow a user called BESadmin to log on to the machine, so I can go through their installation process.

Low and behold, this user is already listed as a local admin on the machine, along with a bunch of other accounts I'd rather not be listed. Attempting to log in as this user gives a user profile error.

Attempting to delete them freezes my user accounts window..

I read that it is possible to fix this by deleting these users in safe mode with the local admin account. Well, my local admin account won't log on in safe mode..

Using the correct password, I see "Welcome" and then it tells me invalid password

Using an incorrect password, it tells me invalid password immediately.

Logged on as domain admin and using CTRL-ALT-DEL to change the local admin password yields similar results. It thinks for a moment before telling me invalid password when you give it the correct old password.

share|improve this question
Domain controllers shouldn't have a list of local user accounts. it removes those when you promote a server to a domain controller. – Nixphoe May 31 '11 at 16:48
These are domain user accounts which have administrative rights to the machine – wooz May 31 '11 at 16:49
Domain controllers shouldn't be exchange servers either. sigh – RobM May 31 '11 at 16:51
@robert- I wasn't going to bother going there :) – Jim B May 31 '11 at 16:53
I've recently read about why this is a bad idea, and am considering demoting it to a member server. I need to make sure this won't bork IIS though. – wooz May 31 '11 at 17:50
up vote 2 down vote accepted

installing BES on a domain controller is slightly different than on a member server. See Assign service account permissions for a BlackBerry Enterprise Server for Microsoft Exchange

share|improve this answer
Thanks a bunch. – wooz May 31 '11 at 17:54
@wooz: How to say thanks in an answer. – jscott May 31 '11 at 18:01
Only recently got the ability to upvote posts :) – wooz May 31 '11 at 18:08

Off-topic, that first sentence made me cringe. Virtualize!

Back on topic; domain controllers do not have local accounts, nor do they have local admins. All accounts are domain accounts, and all groups are domain groups (with the exception of the DSRM user, which we won't go into).

Bearing that in mind, if you're using the tools to manage local users and groups, that would most definitely not work. You need to manage your domain users and groups via the Active Directory tools, which includes the groups that grant administrative access on the domain controller.

Review those users and their memberships, and make changes appropriately, but be very careful; you can do a lot of damage deleting access from users when you're unsure why they had it in the first place.

share|improve this answer
From what I understand, BES express wants to live on the same server as Exchange. I'd actually rather not use BES for our one blackberry user, but I don't really have an option. I see where I went wrong, though. I'm a bit new to 2008, in 2003 you could grant local logon rights using the user accounts panel. 2008 doesn't like that. – wooz May 31 '11 at 17:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.