Question about promoting Server to DC on Server 2016

---

Hello!
I have 2 production domain controllers, and wanted to add a third one, just in case. As we restarted for some roles we had some issues on boot that were resolved and now the AD is OK between the 2 DCs without any erros (already checked).

When trying to add this 3rd DC I have this error on the Verification phase: Verification of Administrator rights failed. The Administrator account does not have the "Enable computer and user accounts to be trusted for delegation" right enabled.

I didn't install the other 2 DCs. When I started there, they were already in place. On the DCs Default Policies, on that item, it's blank. I don't know of any other changes.

What might be causing this? I looked online and wanted to check if anyone share an issue like this from their history.
Thank you!

Fabio,

Take a look at the following:

https://community.spiceworks.com/topic/1988315-help-with-adding-windows-domain-controller

It is probably a combination of ensuring that you add the Domain Admin to the policy element and also you may need to modify the item mentioned in the URL post.

Let me know if you have any questions.

Cheers,

Adam

Hello Adam,
Thank you for your message. I tried that and it returned Access Denied...very strange. What do you think I compara my default DC policy with a clean one of a fresh promoted DC?

Hello.

Just to give an update regarding this. After installing a fresh DC on my laptop just for testing the Default Domain Controllers policy has the option "Enable computer and user accounts to be trusted for delegation" enabled for BUILTIN\Administrators. Someone removed it because it was on a best practice from Microsoft to lock down DCs. I added this on the Policy, then a forced gpupdate and voilá, the verification all went well.
I'm going to investigate where this bets practice is just for understanding if this is the best practice indeed or not.

Regards,
Fábio

Fabio,

I am glad that you seem to have it all sorted out. Good detective work !! :)

The best practice is centered around the idea of the reduction of attack surface via the minimization of privilege. By removing the Administrator, the behavior is blocked. The other side to the best practice is DOCUMENTATION, so that you, or anyone else who was operating in the environment AFTER the original action(s) were taken, would be able to quickly understand what was done, and if necessary, how to reverse these actions to allow for some modification of the environment to be accomplished.

Please let me know if you have any other questions.

Cheers,

Adam