KB ID 0001242 Dtd 06/10/16
Problem
Post By: Daniel Newton
I was configuring a ADCS (Active Directory Certificate Services) on a DC (Domain Controller) for a client today and wanted to setup web-enrolment. I gave the Certificate Service User permissions to the IIS_USRS Group and everything was going well. Then, this error popped up when assigning the service account in setup.
Solution
This can be easily fixed, just follow these instructions and then you will be cooking on gas! (Remember I am on a domain controller)
Go to Active Directory Users and Computers (dsa.msc) Locate the ‘Builtin’ container > then the Administrators group > and add your server account.
REALY: Yes, you need the right to ‘Log on Locally’, and remember this is a Domain Controller, try adding that right manually though GPO, its restricted.
So, when you try and authenticate for the Service Account in setup, it will come up with no errors
To prove that it’s not all smoke and mirrors, here is the user authenticated,
Related Articles, References, Credits, or External Links
NA
19/01/2017
This worked!! Thank you!
28/01/2017
Your most welcome! 🙂
16/04/2019
You are crazy, adding this to Domain Admins destroys the whole purpose of service accounts with least privileges. This is very bad practise.
16/04/2019
Hi Martin,
Thanks for the feedback, I had to check this as it was a guest post. The crux of the problem here is, this role is being deployed on a DC, which I would rather not do, but Daniel does specify this. Also the service account does need to be a member of builtin\administrators, and not domain admins. I would rather have the role on a member server and then simply grant ‘log on as a service’ and ‘log on locally’ but the latter is not available on a DC.
Regards