Long story short, I'm trying to install Blackberry Enterprise Server Express on my Exchange 10 server, which is also a windows server 2008 DC.

I need to allow a user called BESadmin to log on to the machine, so I can go through their installation process.

Low and behold, this user is already listed as a local admin on the machine, along with a bunch of other accounts I'd rather not be listed. Attempting to log in as this user gives a user profile error.

Attempting to delete them freezes my user accounts window..

I read that it is possible to fix this by deleting these users in safe mode with the local admin account. Well, my local admin account won't log on in safe mode..

Using the correct password, I see "Welcome" and then it tells me invalid password

Using an incorrect password, it tells me invalid password immediately.

Logged on as domain admin and using CTRL-ALT-DEL to change the local admin password yields similar results. It thinks for a moment before telling me invalid password when you give it the correct old password.

  • 2
    Domain controllers shouldn't have a list of local user accounts. it removes those when you promote a server to a domain controller. – Nixphoe May 31 '11 at 16:48
  • These are domain user accounts which have administrative rights to the machine – wooz May 31 '11 at 16:49
  • 3
    Domain controllers shouldn't be exchange servers either. sigh – Rob Moir May 31 '11 at 16:51
  • 1
    @robert- I wasn't going to bother going there :) – Jim B May 31 '11 at 16:53
  • I've recently read about why this is a bad idea, and am considering demoting it to a member server. I need to make sure this won't bork IIS though. – wooz May 31 '11 at 17:50

installing BES on a domain controller is slightly different than on a member server. See Assign service account permissions for a BlackBerry Enterprise Server for Microsoft Exchange


Off-topic, that first sentence made me cringe. Virtualize!

Back on topic; domain controllers do not have local accounts, nor do they have local admins. All accounts are domain accounts, and all groups are domain groups (with the exception of the DSRM user, which we won't go into).

Bearing that in mind, if you're using the tools to manage local users and groups, that would most definitely not work. You need to manage your domain users and groups via the Active Directory tools, which includes the groups that grant administrative access on the domain controller.

Review those users and their memberships, and make changes appropriately, but be very careful; you can do a lot of damage deleting access from users when you're unsure why they had it in the first place.

  • From what I understand, BES express wants to live on the same server as Exchange. I'd actually rather not use BES for our one blackberry user, but I don't really have an option. I see where I went wrong, though. I'm a bit new to 2008, in 2003 you could grant local logon rights using the user accounts panel. 2008 doesn't like that. – wooz May 31 '11 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.