When you use the Install-AddsDomain Windows Server 2012 AddsDeployment Windows PowerShell module cmdlet together with the Invoke-Command cmdlet to remotely create a new child domain, you receive the following error message:
Failed to create a trust with domain child.contoso.com on the parent domain controller dc1-full.contoso.com "Access is denied." This server has been disjoined from domain "CONTOSO".
Context : DCPromo.General.54 RebootRequired : False Status : Error
Additionally, the server is removed from the parent domain, and no child domain is created.
This issue occurs because credentials that were given to-dnsdelegationcredential contained a bad password.
To resolve this issue, follow these steps:
Rejoin the server to the parent domain to enable remote Windows PowerShell connectivity through the Invoke-Command cmdlet. (By default, this cmdlet requires the Kerberos protocol.)
Try to create the domain again. When you do this, make sure that you provide the DNS Delegation credentials by using a valid username and password.
Unlike the password for the other two credentials that are provided in this scenario, the password for the DNS delegation credential is not tested until it is actually used. However, at that point in the domain deployment, many other changes have been made, and the bad credentials cause a fatal error when they are used later.
This issue occurs only when you provide a bad password through remote Windows PowerShell invocation. If the DNS delegation is run locally, the delegation will still fail but will provide a warning that delegation was not configured and will let promotion otherwise succeed.