The group policy client is disabled and I can not enter the second domain controller, what to do???

Question

Active Directory

Good evening!
Maybe someone can suggest a solution to the problem.
The situation is this. There is DC1 on Windows Server 2012, as I was told it was somehow crookedly migrated from WinServ 2008. DC1 in all FSMO roles is the master.
I want to make a second DC on Windows Server 2016, when I promote it to a domain controller, I have an error

On DC1 in the group policies for Default Domain Controllers Policy, in Allowing trust in computer and user accounts during delegation, I have Administrators and domain admin.

But when viewing local policies on DC1 through gpedit.msc in Allowing trust in computer and user accounts during delegation, I have EMPTY

when executing the gpupdate / Forse command on DC1 issues:

The rsop.msc command issues:


Dcgpofix /ignoreschema /Target:DC - wrote that everything went well, but nothing has changed.

When loading the OS, an error appears


The services on DC1 The Group Policy Client is disabled and how to enable it is not clear


. Did this article, it did not help, especially since the keys in the registry were already
https://social.technet.microsoft.com/Forums/ru- EN/...

Tell me where to start? How to fix the policies so that they apply

Most likely, something was damaged in the policies during the migration, and now that's it.
I think if the policy is corrected, the second DC will be entered into the domain without problems.

I would be very grateful for any help)

Answer 1

did you run adprep /domainprep?
What are the functional levels of the forest/domain now?
Did you check the other prerequisites?
https://docs.microsoft.com/en-us/windows-server/id...
And another offtopic question, but on topic. What climbed then - if you do not understand?