AD Security

  • Thread starter Thread starter Roger Mathews
  • Start date Start date
R

Roger Mathews

Something has gone way wrong with my directory. I am currently not able to
add Exchange servers or additional domain controllers. When trying to add
an additional dc to the existing domain I got the access denied error "The
operation failed because: Failed to modify the necessary properties for the
machine account VCS10$ "Access is denied. ".

But the credentials being provided are correct and for the administrator
account. The administrator is a member of the domain admin, enterprise
admin and administrators groups. Local policies look ok, domain controller
policies look ok, GPRESULT reveils only two GPO's being applied, 1 for proxy
setup and 1 for locking the screen. I'm not quite sure where to look for
the security issue whether it is an NTFS permission or policy permission or
hidden somewhere else within AD. The administrators account is also the
delegated authority for this domain.

I would appreciate any help and direction. Thanks in advance.
 
Make sure that you in the default domain controllor security policy that you
have the administrators group added to the enable computer/user to be
trusted for delegation. This should work.
 
Yes, the Administrators group is trusted for delegation. This is configured
in the only GPO for the domain controllers OU. Another thing I forgot to
mention is that DCDIAG reports all is ok with AD. Thanks for your feedback.
Any other thoughts?
 
Back
Top