This weekend I was going to do a simple task... promo a server to take over as a secondary domain controller and uninstall the existing secondary domain controller.

Uninstall was uneventful,

However on the new server, I'm getting stuck on: Active Directory Domain Services could not configure the computer account $ to the remote Active Directory Domain Controller account

Most of my googling resulted in add BUILTIN\Administrators to the domain controller default GPO. However it was already there. I tried specifically adding my account and the computer... no difference. I tried temporarily linking the GPO policy to the servers and doing a GPupdate /force. No dice.

I even tried creating a local account and attempting the process. Same result.

At this point I'm selecting my second choice server and attempting moving ahead, because... ya know I gotta get it done today.

Domain functional level is windows 2016. Windows server standard 64 bit running on Hyper-V Hypervisor. Both VM's are Windows Server 2016.

I reset the DSRM password on the PDC because I couldn't find where the old one was recorded.

I'm now left scratching my head as to what could have been on the application server that would have prevented the promo.

The second server also failed. Active Directory Domain Services could not configure the computer account $ to the remote Active Directory Domain Controller account

What the heck am I missing?

I jumped to: Technet Error article However as far I can determine I have all the correct rights, and my GPResults is showing it as a winning policy.

However when I do a whoami /all it either doesn't show it, or shows it as disabled in the permissions section.

Firewalls are not in play.

This Server has no issues pinging the Domain controller and has been part of the domain for quite some time as an application server.

If you've already killed this dragon, or know of a different approach that may help me do it, it would be appreciated.

Follow Up:

I spun up a blank WS 2016 std VM and was able to promo it to domain controller.

I'll likely just go ahead and start from a blank VM and add back in the items I need afterwards.

Unless anyone is able to assist, but you'd likely need a listing of all my GPO's and software and blah. I wonder if deactivating all my GPO's would solve the issue. I may try it, or I may just build on what I already know works.

Thanks for reading and showing interest my question.

  • 1
    As far as GPOs go, you should have the Microsoft default domain policy at the top and the Microsoft Default Domain Controllers policy for the Domain Controllers OU. If you have customized those policies, export them and re import them as new policies and reset the MS default policies. If you have enforced GPOs at the Domain level, unenforceable them and for troubleshooting only, temperarily block inheritance just so your DC safe getting the Microsoft default domain controllers policy, then re attempt promotion. – spacenomyous Nov 4 '17 at 22:32
  • What's wrong with the current secondary domain controller? It can probably be fixed. Where are they located physically? Re purposing an existing server as a DC isn't a good idea, since the current server has probably already been tattooed by existing GPOs and permissions have probably been modified. I would stand up a fresh, new DC with a new name and then demote and remove the current secondary – spacenomyous Nov 4 '17 at 22:49
  • Did you make sure the first domain controller had all of the FSMO roles? – Spencer Nov 4 '17 at 23:13
  • The existing secondary DC picked up duty as a session host for RDP. So I had to move the Secondary Domain Controller off of it. – Pug Nov 7 '17 at 1:53
  • @Spencer I assume since it promo'ed the second VM fine it wasn't a PDC issue, but instead an issue with GPO or Software as suggested by Spacenomyous. – Pug Nov 7 '17 at 1:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.