Thursday, September 16, 2010

Home /Active Directory /Domain /Widnows 2003 R2 /Windows /Windows 2008 R2 / Access is Denied When Demoting a Domain Controller

Access is Denied When Demoting a Domain Controller

27 comments

Issue #1: You will get the following error message when  demoting a domain controller:

The operation failed because: The attempt at remote domain controller dc.domain.com to remove domain controller CN=DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com from the forest was unsuccessful.  "Access is denied."

Resolution: Make sure the Protect object from accidental deletion is NOT selected in NTDS Settings properties.

NTDS Settings -> Properties -> Object Tab

image

Issue #2:

The operation failed because: Active Directory could not configure the computer account HOULAB01$ on the remote domain controller tdc01.santhosh.lab. "Access is denied."

Resolution: Make sure the Protect object from accidental deletion is NOT selected in domain controller object properties. 

image

Filed under
Share X LinkedIn Facebook Email
SS

Santhosh Sivarajan

Microsoft MVP · Identity & Cybersecurity Architect

Santhosh has 30+ years of hands-on enterprise experience in Identity and Access Management, Microsoft Entra ID, Active Directory, Microsoft 365 and Zero Trust architecture. He is the author of two books on Windows Server and security, and leads consulting, assessments and training at SAG Business Group.

SAG Business Group LinkedIn Publications Work with Santhosh

27 comments:

keep rocking.. This scenario really very helpful to me..:):):) hats off sivarajan.

Thanks a lot Santosh! I've been to a lot of sites with lengthy explanations, but none of them helped me.

So glad I came across your blog. You're the man!

Spent an hour trying to figure this out. THANK YOU!!!!

This was very helpful. I was able to demote domain controller. It is easy to forget small check marks. Santosh, it is good that you created this blog. Thank you very much. Your information was very useful - Srini

Thanks for this very helpful, buried in Tech-net somewhere very easy to over look this.

Thanks, after reading 20 other sites this solved it.

Thanks for the feedback JCA!

This comment has been removed by the author.

I had a similar situation but that box was already unchecked. I went to ADSIEDIT cn=default-first-site-name cn=sites cn=configuration dc=domain dc=local. My DC servers had security set to deny for everyone for "Delete all Child Objects" . No idea why? Unchecked and demotion went fine.

Thanks for the post. It came in handy after a while of looking for answers much appreciated.

This comment has been removed by the author.

Thanks! I had overlooked this issue.

Thanks for the quick and concise help! I turned this on a while back after running a BPA scan and completely forgot about it. Great work!

This comment has been removed by the author.

Absolutely! Thanks for the feedback. Happy to hear that you were able to resolve the issues.

if this wasn't so serious an issue this wouldn't have been so funny... thanks, you helped me get rid of our last 2008 DC!

This did the trick! Thanks so much!

Убрать защиту от удаления объекта ПК domain.local/Domain Controllers/DC-DEMOTEз
dcpromo.log [INFO] Error - Доменным службам Active Directory не удается настроить учетную запись компьютера DC-DEMOTE$ на удаленном контроллере домена Active Directory pdc.domain.local. (5)
dcpromoui.log OperationStatus : 0x5 !0 => error
DisplayString : Доменным службам Active Directory не удается настроить учетную запись компьютера DC-DEMOTE$ на удаленном контроллере домена Active Directory pdc.domain.local.

Убрать защита от удаления NTDS объекта domain.local/Configuration/Sites/domain-local-site/Servers/DC-DEMOTE/NTDS Settings
dcpromo.log [INFO] Error - Ошибка на удаленном сервере службы каталогов pdc.domain.local при попытке ликвидации сервера службы каталогов CN=DC-DEMOTE,CN=Servers,CN=domain-local-site,CN=Sites,CN=Configuration,DC=domain,DC=local. (5)
dcpromoui.log Enter ProgressDialog::UpdateText Ошибка на удаленном сервере службы каталогов pdc.domain.local при попытке ликвидации сервера службы каталогов CN=DC-DEMOTE,CN=Servers,CN=domain-local-site,CN=Sites,CN=Configuration,DC=domain,DC=local.

Thanks, you fixed my issue (2008 RODC)

Thank you for information. It helped me.
Talgat A

Its been 10 years and your still correct. Your are my hero

Post a Comment

Popular Posts
Workstation Trust Relationship Issue Issue: You receive the following error message, when you try to login to the domain.  The security database on the server does not have ... ADMT Service Account - Permission and Configuration The ADMT service account needs to have proper permission in source and target domains.  You don’t need to use 2 separate accounts.  You can ... My First Peek into Microsoft Exchange 2010 By Santhosh Sivarajan Before I really dive into Exchange 2010, I thought I would install and play with it first. I took some screen shots and notes during the ins... ObjectSID and Active Directory What is an objectSID in Active Directory? When a new object is created in Active Directory, Domain Controller assigns a unique value used ... AD Group Report - List Group Members in Active Directory–PowerShell Script Updated Script - http://portal.sivarajan.com/2011/10/search-ad-collect-local-admin-group.html Script #1 This script... Add Users to a Group–PowerShell Script Purpose – Add users to a group from an input file – PowerShell V2 Script.  Input file – Input file (Users.csv) contains samAccountName in... User Account Migration and Merging – Part I (ADMT) Part I - User Account Migration and Merging Using ADMT Part II - User Account Migration and Merging Using QMM pre-creating user account ... User Account Migration and Merging – Part II (Quest Migration Manager) Part I - User Account Migration and Merging Using ADMT Part II - User Account Migration and Merging Using QMM Pre-creating user account in... Delete Stale or Inactive Computer Accounts from Active Directory Here is an easy way to identify and delete inactive or stale computers in an Active Directory environment.  Using the dsquery command you c... Converting PowerShell (PS1) to EXE / Standalone Application As we know, there many applications available to convert a PowerShell file to a standalone executable file.  Based on my experience, PowerSh...