Error Installing CRM 2013 and Funny Resolution: Action Microsoft.Crm.Setup.Server.GrantConfigDBDatabaseAccessAction failed

I ran into an interesting error the other day installing Microsoft Dynamics CRM  2013 for a client. The error was:

 Microsoft.Crm.Setup.Server.GrantConfigDBDatabaseAccessAction failed.

Windows NT user or group 'domainname\SQLAccessGroup {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}' not found. Check the name again.

We searched high and low for someone else experiencing the same error and we found several blogs and threads where people had resolved this for CRM 2011 and CRM 4.0 by a variety of different means.

Here are some examples and a quick blurb about the resolutions (that I think are all false).

1 http://crm2011andsilverlight.blogspot.com/2011/11/action-microsoftcrmsetupservergrantconf.html - resolution: exit SQL Server Management Studio on all boxes.

2 http://weblogs.asp.net/pabloperalta/archive/2011/09/01/microsoft-crm-setup-server-grantconfigdbdatabaseaccessaction-failed-windows-nt-user-or-group-mydomain-sqlaccessgroup-not-found-check-the-name-again.aspx - resolution: close remote desktop on the SQL Server

3 http://blog.expertsoftware.co.uk/post/2010/05/04/CRM-4-Install-and-SQL-Error-15401.aspx resolution: clear Kerberos tickets on the SQL server, reset some passwords, etc....

4 http://social.microsoft.com/Forums/en-US/65543208-6263-45d0-9801-237c0767a4da/crm-2011-rtm-install-error?forum=crm resolution: make sure the user is a member of all the created AD security groups on the CRM Install

5 http://nishantrana.wordpress.com/2013/05/07/fixed-microsoft-crm-setup-server-grantconfigdbdatabaseaccessaction-failed-windows-nt-user-or-group-sqlaccessgroup-not-found-in-crm-2011/ resolution: close SQL Management Studio and disconnect your remote desktop session.

 6 http://blog.aggregatedintelligence.com/2012/11/crm-2011-action-microsoftcrmsetupserver.html - resolution: delete your AD groups created by the install????


One thing you will notice pretty quickly is that there isn't any real rhyme or reason to these solutions and some of them seem pretty nonsensical, but if you read the comments, these posts did seem to help a lot of people (except number 6), but why????

Let's discuss that quickly...

Upon further examination I have determined that while they may all work, they are not really the solution.

The real reason this is happening in most of these cases is Active Directory replication delays where there is more than 1 domain controller in an active-active scenario.

The real solution is waiting 5 minutes when you get this error and hit retry.  Basically the server install is creating the active directory groups against one domain controller and then it is hitting the other domain controller to perform another action shortly after before the synchronization is finished between the domain controllers.  :). So absolutely anything that takes a few minutes or restarts a server or causes an update on the domain controller would work.  That's why there is no cohesiveness between the resolutions.

- Happy Tuesday!!

-