Make a note of any user that is logged in error 7041 because that is the user that needs to be added to the ‘Logon as a service’ in the Default Domain Controllers Policy. Depending on the version of your server it can be only domain\ServerAdmin$ but sometimes we see also domain\MediaAdmin$ . If you see both you need to add both of them to the ‘Logon as a Service’ permission in the Default Domain Controllers Policy. Here is how we fix that. From the Server Manager click Tools and then start Group Policy Management Choose the Default Domain Controllers Policy, right-click and choose Edit Use the screenshot to drill down to User Right Assignments in the Computer Configuration. Double-click Log on as a Service and add the accounts you see in the 7041 error as shown above and check ‘Define these policy settings’. We have set Log on as a service for that user. Do not get confused by the other settings as this server was part of a migration from SBS 2003 to Windows Server 2016 with the Essentials Experience role added where this problem occurred. Open an elevated command prompt Type gpupdate /force Start the Post-Deployment configuration wizard again to configure Windows Server Essentials. And this should now finish without problems.