Return
-
Title
Authorizationmanager check failed -
Description
You can observe following error in FR console when running recovery:
AuthorizationManager check failed.
FRRestore64 log will contain
May 25 12:35:36.775 [3392:4160] Error + CategoryInfo : SecurityError: (:) [], ParentContainsErrorRecordExceptionMay 25 12:35:36.775 [3392:4160] Error + FullyQualifiedErrorId : UnauthorizedAccessMay 25 12:35:36.775 [3392:4160] Info Event: The domain controller demotion has failed. Details: AuthorizationManager check failed.May 25 12:35:36.775 [3392:4160] Info + CategoryInfo : SecurityError: (:) [], ParentContainsErrorRecordExceptionMay 25 12:35:36.775 [3392:4160] Info + FullyQualifiedErrorId : UnauthorizedAccessMay 25 12:35:36.775 [3392:4160] Info Enter OperationProcessor::Save -
Cause
All scripts are signed by QUEST certificate and can be verified using followng command on RMAD host:
PS C:\Program Files\Quest\Recovery Manager for Active Directory Forest Edition> Get-AuthenticodeSignature .\DemoteDc.ps1If Quest Certificate is not trusted by your system server will not allow to execute it -
Resolution
Add Quest Certificate to the Trusted Publishers Certificates in GPO settings Computer Configuration -> Settings -> Windows settings -> Security Settings-> Public Key Policies / Trusted Publishers Certificates