How to roll up WSUS and make it a backup domain controller (the main one rotates on 2008r2)?

Question

Windows Server

Greetings colleagues.
Already brains put cancer. Maybe you can give some good advice.
We have 2012r2 standard. The task to roll WSUS and to make it the reserve domain controller (the main turns on 2008r2).
I tried to drive it into the domain first, I put WSUS, the internal database does not start.
Okay, I think, I put the vus on a clean system, everything works, as soon as I drive the car into the domain, the vus immediately drops.
In general, with song and dance, I sort of understood the problem, GPO cut access for nt service\mssql$microsoft##wid,

FCB::Open failed: не удалось открыть файл C:\Windows\WID\Data\master.mdf для номера файла 1. Ошибка ОС: 5(Отказано в доступе.).

if the service starts under the local system, the internal database service starts but does nothing.
In general, who can come across? Where to conduct excavations, the logs will immediately say not informative errors.

Answer 1

GPO Default Domain Policy
Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignments says NT SERVICE \ ALL SERVICES
Add stupidly NT SERVICE \ MSSQL $ MICROSOFT # # WID does not give the system says "I can not find such a user"

Answer 2

here's another.
previously the domain scheme was 2000 (Windows was 2003), then 2003 was demoted, the scheme was transferred to 2008r2