need help...adding an additional DC 1

[cbbxxxd]

i have a win2k adv. server with AD,DNS,DHCP all setup
it's running fine...
i'm trying to setup an backup server, so if one fails it'll take that place...

when i type in dcpromo setup everything...
towards the users name, password, domain
i get an error stating: "the operation failed because: Fail to modify the neccesary poperties for the machine account server$ Access is Denied"

can someone please tell me what am i doing wrong...
thank you in advance...

 

[rjbj]

Here is the solution to your problem. This MS article addresses your exact problem.

http://support.microsoft.com/default.aspx?scid=kb;en-us;250874

 

[cbbxxxd]

thank you for that post....but....
the page from microsoft is too hard to understand...

can someone please explain how??
need it to work....
thank you

 

[arteus]

The solution is in the resolution. All you need to do is make sure that the admin user (or group) has the correct rights.

tw

 

[cbbxxxd]

i've tried to setup a user with admin rights
and use the administrator password
both won't work...

am i suppose to play with the registry???

can someone please help me out....

thank u

 

[rjbj]

To resolve this problem, use the appropriate method:
Verify that the current domain controllers in the domain have applied security policy and the Enable computer and users accounts to be trusted for delegation user right granted to the Administrators Group (click Computer Configuration, click Windows Settings, click Security Settings, click Local Policies, and then click User Rights Assignment).

For computers that do not have this right, confirm that group policy objects in the directory service and file system have replicated, and then manually apply the policy by typing the following command:

secedit /refreshpolicy machine_policy

NOTE: Look for the following message in the application log to confirm the application of the policy:

Event ID 1704: Security Policy in the Group policy objects are applied successfully.
Stop the Netlogon service on the source domain controllers that do not have this right applied to discover another domain controller in the domain that applied this right.
Verify that the source domain controller is in the organization unit. The name of the source domain controller can be found in the hidden file called Dcpromo.log in the %Systemroot%\debug folder on the Windows 2000 server that you are trying to promote.
Open a command prompt on the source domain controller, and run the Gpresult.exe Resource Kit utility to verify that the domain controllers policy is being applied to the source domain controller.