Replicating from New Domain Controller to Existing One Returns 'Access Denied'; Log Shows Error 16650 (285836)

SYMPTOMS

When you use Dcpromo.exe to create a new domain controller replica in a forest consisting of a single domain and one existing domain controller, you may receive an "Access Denied" error message when you use Dssite.msc to replicate from the new domain controller to the existing one. In addition, the new domain controller's Directory Service log may record Error 16650.

CAUSE

This behavior can occur when the existing domain controller was previously a Microsoft Windows NT Server 4.0-based primary domain controller (PDC) that was upgraded to be a Windows 2000-based domain controller. In this situation, the "Access this computer from the network" user right is granted only to the following groups:

Administrators
Backup Operators
Domain Users

However, it should also be granted to the Enterprise Admins group.

RESOLUTION

To resolve this behavior, grant the Enterprise Admins group the user right "Access this computer from the network", and then refresh the security policy. Follow these steps:

In Active Directory Users and Computers, click the Domain Controllers object.
Right-click the domain controller name, and then click Properties.
In the domain controller's Properties dialog box, click the Group Policy tab.
Click Default Domain Controllers Policy, and then click Edit.
Navigate to Computer Configuration\Windows Settings\Security Settings\Local Policy\User Rights Assignment, and then double-click Access this computer from the network.
Add the Enterprise Admins group to the list of groups to be granted this user right.
To refresh the security policy, type the following at a command prompt and then press ENTER:

SECEDIT.EXE /refreshpolicy MACHINE_POLICY /ENFORCE