0

I have a Win2K8R2 domain controller on an ESXi host. I have a second ESXi host on which I have created a new Win2K8R2 Server to be a secondary domain controller. The second server was added to the domain and patched, and I am ready to run dcpromo. However....

When I run dcpromo and enter the DSRM password using an existing domain administrator credential, I get a critical error on the primary domain controller, and it automatically reboots after 60 seconds. I thought that the DSRM password is independent of other domain controllers. I can't figure out why this is happening, and google has been unfruitful.

It's a single domain forest, and I'm just trying to add the second server to be a secondary DC. The network has no external connections. Everything has to be transferred in via CD.

Both of the servers are in the same VLAN, and they can access the same shares. There is only one virtual NIC on the VM, and it has a static IP. The DNS has been configured to point to the primary domain controller, with the intention of setting itself as the primary after the dcpromo, with the primary as an alternate.

I did select the option for a DNS server and global catalog server during the dcpromo. The primary DC has DNS and DHCP roles assigned.

Hopefully I can figure out an answer. I've tried to anticipate as many questions as I can.

Thank you.

Improve this question
1
  • Someone just suggested to me that if the password doesn't meet complexity requirements, it can cause this issue. I won't be able to try it until tomorrow, but it seems to me that taking down a domain because of a password is very poor error handling.
    – David Paige
    Apr 23, 2015 at 20:10

1 Answer 1

Reset to default
0

The cause of this issue is that the password doesn't meet the minimum password requirements, such as passfilt.dll.

I had come across some hotixes from Microsoft which seemed to be related, but not exact. Someone who used to work with servers recognized the symptoms immediately.

I'd hoped to include KBs which were directly related to this specific issue, but was unable to find any.

This seems like a very poor method of dealing with password issues, by taking down the entire domain.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .