2

We have a server running Server 2008 R2 as our primary DC. We currently don't have a secondary DC, but are trying to add one. The secondary DC we are trying to use is running Server 2012 R2 Standard.

The Issue:

When we try to promote the second server to a domain controller we run into an error:

The Active Directory Domain Services Installation Wizard was unable to
convert the computer account SERVERNAME$ to an Active Directory 
Domain Controller Account.

You can see a screencap here: Active Directory Error

What We Have Tried:

We have tried modifying the Default Domain Controller Policy to give Delegation rights to Domain Admins. This part works, but doesn't appear when we run whoami /all. Instead we get this result: SeEnableDelegationPrivilege Disabled

We have also tried going into the AD Users And Computers > Computers > SERVERTOBEPROMOED. We went to Properties>Delegation and selected Trust this computer for delegation to any service (Kerberos Only).

After setting both of those, running gpupdate /force on both servers, and waiting 90 minutes, the whoami /all still shows SeEnableDelegationPrivilege Disabled

Note: The whoami /all was run on multiple computers including the AD and the computer to be promoted, and showed the same result.

We are at a loss for what is going on here. Rebuilding the entire AD is out of the question, but rebuilding the Default Domain Controller Policy could be on the cards, although we'd prefer not to do that.

  • 1
    whoami /all still shows SeEnableDelegationPrivilege Disabled. That is the default state. Windows enables the privilege when needed. Is your domain controller in the Domain Controllers OU, and is the Default Domain Controllers policy and Default Domain policy applying without error as confirmed with gpresult /h gpresult.html ? – Greg Askew Oct 30 '18 at 17:03
  • @GregAskew That is really good to know. We managed to fix it. We had to drop and re-add the new server to the domain and change the Link Order on the Domain Policy. This made them apply correctly. We don't really know why it wasn't before. Thanks! – hairydresden Oct 30 '18 at 17:20
2

Verify that that the policy Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Enable computer and users accounts to be trusted for delegation is set on the default domain controllers OU. Verify that the account you are using to promote the computer has this policy applied. You can use gpresult /h report.html to verify.

0

We solved it!

We had to drop the server we wanted to add as a domain controller from the domain and re-add it. After dropping it, before re-adding it, we had to delete the server object from the list of domain computers.

Hopefully this could help someone else who runs into this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.