Problems demoting DC with DCpromo

[Agentstarks]

I'm trying to retire one of my DC's and during dcpromo i'm getting a "new credentials" box with the error:

"The operation failed because the attempt to configure the machine account GIS$ on
server <different-DC-server>.company.com failed. 'Access is denied'. Specify an account with Enterprise Administrator privileges to the forest 'company.com'.&quot;

And then there are three labels with three textboxes, one for the username, and another for the password and the third for the domain.

I am trying to run dcpromo from the Administrator account, which is a member of the Enterprise Admins group. Shouldn't that cover it?

 

[Seaspray0]

in the username, try putting the full path, like:

domain\username

if you are in a subdomain, try an account from the top domain... topdomain\username that has enterprise administrator rights.

Keep in mind there are different admin groups... admin, domain admin, enterprise admin, schema admin...

make sure the account you use is in the enterprise admin group.

 

[Agentstarks]

There's no subdomains in my network just the one domain (KTUA), and I have the KTUA\Administrator account that I'm running DCpromo with in the Domain Admin group as well as the Enterprise Admins group. I also tried creating a new user called Enterprise and made that a member of the Enterprise Admin group and no other groups but that didn't work either.

 

[j93saturn]

Is the DC you are trying to demote the &quot;first 2000 DC&quot; that you brought on-line?

 

[Agentstarks]

It's not the first DC, and it doesn't have any FSMO primary roles either, those are all on two other DC's.

 

[raquetman75]

So you have already an Enterprise Admin rights along with Domain Admin rights .. Mmm. What else could it be? Well maybe this is a ridiculous suggestion but for curiosity sake, use the original password when you promote this server to a dc

 

[Agentstarks]

The whole permissions thing was stumping me so I decided to just manually remove the computer. I found instructions to do this here:

http://www.jsifaq.com/SUBJ/tip4900/rh4984.htm

 

[mikeconn]

I'm having the same issue except this is the first DC in the domain. So what is different if it is the first DC? I haven't been able to locate an answer on Microsoft yet.