Cannot enable computer and user accounts to be trusted for delegation

Question

I have been reading for days and followed every link that came up in the suggestions above and nothing is working. I am trying to add a domain controller to my environment. I have gotten to the point where I believe it is because I need the "enable computer and user accounts to be trusted for delegation" user right. The problem is nothing I do will enable it. Here is what I've tried:

Made sure the Default Domain Controller Policy is linked and enforced on the OU
Verified that the user right for delegation includes the Administrators group and the administrator account
Tried adding another user that is a domain admin and in admin group
Set the local security policy to have the admin, admin group and 3rd user
Logged in under 3rd user, ran whoami from elevated prompt

Ran gpupdate /force
Ran whoami /all

No matter what I do the state stays disabled and I cannot add my DC to the domain. I did instll the 5010215 update a ways back, could this be causing an issue as I saw other people saying the 5008012 was causing issues.

Answer 1

Hi Brandon,

Doesn't give us much. As the first error is the delegation error, I think we should check that one first.

As per this article, the issue might be permissions on the computer object of the new DC, can you do an effective permissions check using the ADUC security dialog to confirm that your account has rights to change the useraccountcontrol attribute. I would check a computer object in the computers container and a DC computer object in the Domain Controllers OU.

Also check the permissions on the Domain Controller OU for an deny permissions which might apply to your user.

I might be worth moving the computer object of the new DC to the domain controllers OU first and try the dcpromo again,

Gary.

Answer 2

Hi @Brandon Fogliano

The Enable computer and user accounts to be trusted for delegation rights, is normally allocated to the administrators by default, however this can be changed by using GPOs or Local Security Policy editor. You can use secpol.msc to confirm that the right has been assigned to administrators

When this right is assigned to a user, by default it is disabled, the right is typically enabled by the application as and when it is required. If you can see the privilege listed in the whoami /priv, then the user has the required right. You will need to run the whoami command from an command with run as administrator

If its listed then DCPromo should be able to request this right when it runs.

You can confirm if a process is able to request the right by using the NetTools User Rights option, which provides the ability to enable rights, you will need start NetTools with run as administrator.

Gary.

Answer 3

Hello BrandonFogliano,

In this situations, the recommendation is to decommission the server and reinstall. Then re-start the promotion process. In most cases, one single step was missing or didn't applied correctly, and that causes the further process to fail. Reinstalling will save you countless hours of backtracking steps.

I can recommend the next guide to add additional domain controllers to your domain: https://social.technet.microsoft.com/wiki/contents/articles/8630.active-directory-step-by-step-guide-to-install-an-additional-domain-controller-using-ifm.aspx

---

--If the reply is helpful, please Upvote and Accept as answer--

Answer 4

Ok I took the approach of doing both of your ideas. First with NetTools I was able to see that the permission gets set to Enabled for the delegation. I completely removed the AD role and rebooted the VM. I did the IFM method, which is cool, but once I get to the part of installing the AD from the media it fails even faster I get this message at the pre failure screen

Then here is the error screen

I really hope this helps, I've never had this hard of a time adding a DC. The other thing that is interesting is that after trying to run the media, if I go back an look in the Active Directory folder in the media the .dit file is now gone, like its being deleted.

Answer 5

I have also noticed that after the failed installation of Active Directory the new server is removed from DNS and I have to reregister it, what the heck is going on?