Dcpromo.exe - "Failed to modify the necessary properties for the machine account. Access is denied."

When you run Dcpromo.exe to create a replica domain controller, you receive the "Failed to modify the necessary properties for the machine account. Access is denied." error message.

SYMPTOMS
When you run Dcpromo.exe to create a replica domain controller, you may receive the following error message in Dcpromo.exe: Failed to modify the necessary properties for the machine account. Access is denied.

Examination of the Dcpromoui.log file indicates that the initial part of the promotion was successful (this is also verified because the computer becomes a member server in the domain), but that the promotion to domain controller did not succeed because Dcpromo.exe could not modify the machine account.

CAUSE
This problem can occur if the account that is used for the promotion operation has not been assigned the "Delegation Privilege" right. Or, if this right has been assigned, the policy has not propagated yet, possibly because of replication latency. By default, only members in the Administrators group have the "Delegation Privilege" right.

RESOLUTION

To resolve this problem, use an account in the Administrators group, or add the appropriate account to the Administrators group. To grant this right to another user or group, set the delegation privilege on the Group Policy object:

1. In the Active Directory Users and Computers snap-in, edit the Default Domain Controllers Policy on the Domain Controllers Organizational Unit.
2. Double-click Computer Configuration, click Windows Settings, click Security Settings, click Local Policies, and then click User Rights Assignment.
3. Under Enable Computer and User Accounts to be trusted for Delegation, add the appropriate account or group.
4. Apply the policy using one of the following methods:

• At a command prompt, type gpupdate /force (Windows 2000 Server - secedit /refreshpolicy machine_policy /enforce).
• In the Sites and Services snap-in (Dssite.msc), use the Replicate Now feature to force replication from the domain controller on which the policy was changed to the other domain controllers in the domain.
  

To apply the updated policy, restart the domain controller.
http://support.microsoft.com/?kbid=232070
or
http://support.microsoft.com/?kbid=250874