Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Having a peculiar issue promoting a Windows 2012 R2 server in a domain at 2003 domain/forest functional level.

Built a new 2012 R2 server, added the following software (labtech, appassure, eset A/V, & Teamviewer). It activated and appeared to be working fine. I added the Active Directory Domain Services role, and completed the configuration (Domain/Forest Prep, and DC promotion). All appeared to go well. I rebooted the server, and that's where the peculiar stuff began. I noticed the server indicated it needed activated again; but would not accept the key. I verified the key was good. That's when I noticed the Software Protection service (as well as many other core services - Base Filtering engine, DHCP client, firewall, etc) would not start. The error message for all of them was "Access Denied".

I called MS, and they wanted to troubleshoot at a service level. Their fix was to use procmon and identify the resource that needed permissions (registry key, file or folder) and add "everyone" with full control). That got the services to start; but the problem re-appeared after a reboot.

Thinking the issue might have been with the anti-virus package during the promotion process, I rebuilt the DCs from scratch and removed the metadata from AD (as I could not demote the machines "rpc server unavailble").

I tried to promote the newly built machines again. The only changes to the brand new machines being critical updates. Again the promotion appeared to work fine; but upon reboot (and a long wait to allow replication to occur) similar problems began to re-appear.

I have verified that the schema updates are correct (schema version is 69 - for Windows 2012 R2).

I am not finding much about this issue through my own searches, so I thought I would post this to see if anyone else has seen anything similar...

share|improve this question
1  
This type of thing is exactly why multi-role servers are a thing to be avoided. –  HopelessN00b Jun 13 at 15:26
1  
I agree. The software I mentioned is just typical client fare (monitoring, virus protection and access). The server is intended to solely be a DC. –  Cybersylum Jun 13 at 18:45
    
so what are the exact resources that caused "access denied"? Can A/V be completely removed for a test? Do you have a domain controller policy that would set too restrictive permissions? –  strongline Jun 17 at 17:56
    
We found that the issue was caused due to a number of file system and registry permissions settings defined in the Default Domain Controllers Policy. While no one can seem to explain why these settings were in that GPO, this does help explain why a 2012 R2 member server would run just fine; but begin to have issues after being promoted. We ended up having to reset this policy to defaults (with the help of MS Support). It took quite a bit of time to get reg key & directory permissions back to the point where all of the services would start. –  Cybersylum Jun 23 at 11:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.