ADPrep cannot modify security descriptor - Promote DC issues

Question

Hello,

I'm trying to promote a 2016 server to a DC in an existing forest.

The current DC is a 2016 server.

When I attempt to do this, it states that ADprep cannot modify security descriptor CN=Keys

And to grant access to infrastructure master.

The account I am using has all permissions, domain admin, schema admin, enterprise admin etc.

Verified all permissions for the Schema is allowed as well for the account.

Any advisement here? I have no idea what else to try.

Answer 1

Refer to https://www.youtube.com/watch?v=J-4RMzvir2I

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

Hello

Thank you for posting in Q&A forum.

Adprep was unable to modify the entry due to a lack of permissions for CN=Keys, DC=<your domain>, DC=local. This indicates that you do not have the necessary permissions for this location.

You can follow these steps to resolve the issue:

1. Log on to the Domain Controller as an administrator.
2. Open Active Directory Users and Computers.
3. You will see an OU named "Keys."
4. Right-click on this OU, select "Properties," and then go to the "Security" tab.
5. Grant the necessary permissions to the user running Adprep.

Best regards

Yanhong

=====================================

If the answer is helpful, please click "Accept answer" and upvote it