-
Title
Cannot open the Active Administrator Console and errors display when running the AA Configuration Wizard -
Description
The AA Configuration Wizard may complete with warnings. When viewing the log file, an error similar to the following may be logged:
"Active Administrator configuration completed but with warnings An error occurred while attempting to setup password recovery for Active Administrator. Please make sure you have rights to your forest root and that you are a member of the Schema Admins group"
"Unable to set trust computer for delegation due to the following error: Access is denied"
You may also get the following error when you try to open the AA Console:
"An error occurred while attempting to connect to the AFS server. Login failed. The login is from an untrusted domain and cannot be used with Windows authentication"
-
Cause
This can occur if the account used to run the Data Services and Foundation Services has been added to the 'Deny access to this computer from the network' local security policy on the SQL server where the AA database is hosted -
Resolution
WORKAROUND:
Remove the service account from the 'Deny access to this computer from the network' local security policy
STATUS:
An Enhancement Request to be able to use a non Domain Admin account for the services and assign it the necessary permissions, has been submitted to development for consideration in a future release of Active Administrator. Enhancement ID: TF00636524
-
Defect ID
TF00636524 -
Additional Information
This type of scenario can occur when trying to implement Microsoft's best practices around securing Domain Admin accounts and utilising Microsoft's least privileged model.