Unable to log in after promoting 2025 server

Hi Brian,

Based on your issue description, it sounds like something is affecting that specific account post-promotion. The followings are a few potential causes of the issue.

1. Token Bloat – When a server is promoted to a domain controller, certain accounts may get additional security groups assigned. If the affected account has too many security group memberships, the access token may exceed system limits, leading to resource exhaustion.
2. Permission Changes – The account used for the promotion might have had specific permissions that were altered during the domain controller promotion process. Domain controllers handle authentication differently, and some privileges might not transfer as expected.
3. Kerberos Tickets & Authentication Issues – If the account had cached credentials or existing authentication tickets before the promotion, they might not align correctly after the change.
4. Service Dependencies – If the account has dependencies on specific services that behave differently on a domain controller, it might trigger insufficient resource errors.

Have you ever tried using other user accounts belonging to Enterprise or Domain Admin group to perform the promotion to Windows Server 2025 to see if the issue happens like the previous affected account used to perform the same promotion task.