Windows Server 2019 Fresh Active Directory Promotion Bugs

[ClasseJohansson]

Hi Everyone,

Anyone having issue with a fresh domain controller promotion issue? I've found quite a number of users mention about Start Menu unable to change after promoting the server to a domain controller however seems no one mention about this.

What I encounter is apart from the issue with the Start Menu, anything that relating to administrative privileges it will say "Windows cannot access the specific device path or file. You may not have the appropriate permission to access them" also the "Authenticated Users" is not inputted into the C drive and the "Windows" folder. 

The problem is still there after updating "March 1, 2019—KB4482887 (OS Build 17763.348)"

I hade this problem with windows 2016 server in the beginning, but Microsoft fixed it with some updates. Why can't they do it now with windows 2019 server?

ClasseJohansson

[#2]

The "fix" is to turn on UAC admin approval mode. AFAICT, this was never fixed in 2016, so hardly surprising it's still buggy in 2019. Shame on you, MS. 😞

Apply this to Domain Controllers via GPO:

Policies -> Windows Settings -> Security Settings -> Local Policies/Security Options -> User Account Control
Admin Approval Mode for the Built-in Administrator account: Enabled
Allow UIAccess applications to prompt for elevation without using the secure desktop: Enabled
Behavior of the elevation prompt for administrators in Admin Approval Mode: Elevate without prompting