KB ID 0001242 

Problem

Post By: Daniel Newton

I was configuring a ADCS (Active Directory Certificate Services) on a DC (Domain Controller) for a client today and wanted to setup web-enrolment. I gave the Certificate Service User permissions to the IIS_USRS Group and everything was going well. Then, this error popped up when assigning the service account in setup.

Solution

This can be easily fixed, just follow these instructions and then you will be cooking on gas! (Remember I am on a domain controller)

Go to Active Directory Users and Computers (dsa.msc) Locate the ‘Builtin’ container > then the Administrators group > and add your server account.

REALY: Yes, you need the right to ‘Log on Locally’, and remember this is a Domain Controller, try adding that right manually though GPO, its restricted.

So, when you try and authenticate for the Service Account in setup, it will come up with no errors

To prove that it’s not all smoke and mirrors, here is the user authenticated,

Related Articles, References, Credits, or External Links

NA