During Active Directory promotion of a replica domain controller, you may receive the following error message:
The operation failed because: Failed to modify the necessary properties for the machine account %computername%$ "Access Denied".

The %SystemRoot%\Debug\Dcpromo.log folder contains entries similar to the following example:
MM/DD HH:MM:SS [INFO] Configuring the server account
MM/DD HH:MM:SS [INFO] NtdsSetReplicaMachineAccount returned 5
MM/DD HH:MM:SS [INFO] DsRolepSetMachineAccountType returned 5
MM/DD HH:MM:SS [INFO] Error - Failed to modify the necessary properties for the machine account %computername%$(5)
A network trace shows that the ModifyReponse frame to the LDAP ModifyRequest frame to the UserAccountControl attribute is unsuccessful with an "insufficient access" error message.

 

RESOLUTION

To resolve this problem, use the appropriate method: 

 

 

(click Computer Configuration, click Windows Settings, click Security Settings, click Local Policies, and then click User Rights Assignment).

The full