Event ID 1168 NTDS General

[hatred]

If I am trying to promote a Windows 2003 Server into a Native AD with 2000 and 2003 DC's in it, the DCPROMO procedure stops half way through trying to copy the configuration folder of AD. The error that I am getting is "The operation failed because: The AD installation Wizard was unable to convert the computer account <name> to a domain account. "Access is denied". After that 1168 even is displayed in the event log. I have searched the internet but nothing seems to be helping me? Can anyone please help. Thanks.

[Anywhere]

The problem that you are facing can occur if the account that is used for the promotion operation has not been assigned the "Delegation Privilege" right. Or, if this right has been assigned, the policy has not propagated yet, possibly because of replication latency. By default, only members in the Administrators group have the "Delegation Privilege" right. Follow the complete steps given here - http://support.microsoft.com/kb/232070/en-us

[Metaldigger]

Check the article made on "Event 1168: Windows 2000 DCs Unable to Boot into Active Directory" over here - http://support.microsoft.com/?id=265089

[Sabastiaan]

The error message that you are getting might be happening because the user account that is used to execure DCPROMO might not been granted the “Enable computer and user accounts to be trusted for delegation” user right. So to solve this issue check the article on "DCPROMO fails with error "Access is denied" if the user performing the promotion is not granted the "trusted for delegation" user right" by following this link - http://support.microsoft.com/kb/2002413

[Carley]

It looks to me that there might be a name conflict in the Domain Controllers OU. So you can try to use an account with Enterprise Admin rights and test. If you are asked for any password then try to ensure using domain\username to make sure that the credentials are proper. You need to also ensure that your new DC is pointing to an existing DC for primary DNS before promoting.