I have a win 2000 dc (HAL) that is the only dc in it’s domain. We did an upgrade from win NT dc to 2000, but we used a different machine (claims). We upgraded an NT pdc to win 2000, then we put the new win 2000 (HAL) online as a dc also. Once this was done we took the pdc we had upgraded offline. We never did any replication. We ran into several issues: Domain trusts work fine, as do logins, etc. However, I cannot create new user accounts, and the defualt domain policy is not working. We have tried many ways of getting HAL to be the RID, PDC, and Infrustucture master. For some reason, with the pdc we upgraded online, they couldn’t connect to each other, so we seized the roles on HAL. HAL is now the Operations Master for RID, PDC,Infrustructure, Schema, and Domain Master. The other dc is no longer online, per instructions never to put it back online once roles were seized on HAL. I still cannot create new users, and the default domain policy is not working.
Here are some errors in the logs:
Userenv Error None 1000 NT AUTHORITY\SYSTEM HAL The Group Policy client-side extension Security was passed flags (17) and returned a failure status code of (3).
SceCli Error None 1001 N/A HAL “Security policy cannot be propagated. Cannot access the template. Error code = 3.
\\mpc-domain\sysvol\mpc-domain\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf. ”
Another:
SAM Error None 16650 N/A HAL The account-identifier allocator failed to initialize properly. The record data contains the NT error code that caused the failure.
Another:
NtFrs Warning None 13508 N/A HAL The File Replication Service is having trouble enabling replication from CLAIMS to HAL for c:\winnt\sysvol\domain using the DNS name claims.mpc-domain. FRS will keep retrying.
Even with the other dc online, the roles couldn’t transfer. We recieved the same errors then also.