JSI Tip 1237. Access Denied while promoting a BDC?

If you upgraded any domain controller to Service Pack 4 (SP4), you must do the promotion from an SP4 domain controller.

In general, in an environment where you have mixed SP4/SPx levels on your domain controllers, domain administration should be performed from an SP4 domain controller.