Forest Recovery stall after the server is rebooted into DSRM (4225722)

This can occur if the Everyone group was removed from 'Access this computer from the network' User Rights Assignment setting in the Default Domain Controllers Group Policy or if the 'Deny Access to this computer from the network' setting has been defined.

Modify the Default Domain Controllers Group Policy by adding the Everyone group, or the DSRM account you specify in the FR project, to the 'Access this computer from the network' setting:

1. Open gpmc.msc
2. Right click the Default Domain Controllers Policy and click Edit
3. Expand Policies | Windows Settings | Security Settings | Local Policy
4. Click User Rights Assignment
5. In the right hand pane confirm that 'Access this computer from the network' contains the Everyone group (or the DSRM account) and that 'Deny Access to this computer from the network' is not defined

To test that the DSRM account can access the DC from the network:

1. Reboot the DC into DSRM
2. From the FR Console server, open the Windows Event Viewer
3. Right click the top Event Viewer node and select Connect to Another Computer
4. Enter the name of the DC that was booted into DSRM
5. Check Connect as another user
6. Click Set User
7. Enter the DSRM account as servername\administrator and provide the password
8. If the DSRM account can access the DC from the network the event viewer should load the events from the DC