<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Nadia,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I will investigate this and follow-up.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Edgar<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> Bryan Burgin
<br>
<b>Sent:</b> Monday, October 07, 2013 11:25 AM<br>
<b>To:</b> Nadezhda Ivanova<br>
<b>Cc:</b> cifs-protocol@samba.org; MSSolve Case Email<br>
<b>Subject:</b> [REG113100710843173]: Question about LDAP delete operation on Administrator and other built-in accounts<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">[-dochelp; +casemail]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Hi Nadezhda,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thank you for your question. We created SR 113100710843173 to track this issue. An engineer from the Protocols will contact you soon.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Bryan<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">
<a href="mailto:nivanova.samba@gmail.com">nivanova.samba@gmail.com</a> [<a href="mailto:nivanova.samba@gmail.com">mailto:nivanova.samba@gmail.com</a>]
<b>On Behalf Of </b>Nadezhda Ivanova<br>
<b>Sent:</b> Monday, October 7, 2013 5:55 AM<br>
<b>To:</b> Interoperability Documentation Help<br>
<b>Cc:</b> <a href="mailto:cifs-protocol@samba.org">cifs-protocol@samba.org</a><br>
<b>Subject:</b> Question about LDAP delete operation on Administrator and other built-in accounts<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Hi,<o:p></o:p></p>
</div>
<p class="MsoNormal">At the I/O Lab we asked about the restrictions that apply on performing a delete operation on built-in accounts. To explain the correct behavior, Edgar kindly supplied the following references:
<br>
"<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN">3.1.1.5.5.1.1 Tombstone Requirements</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a href="http://msdn.microsoft.com/en-us/library/cc223481.aspx" target="_blank">http://msdn.microsoft.com/en-us/library/cc223481.aspx</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN">A protected object may not be deleted and transformed into a tombstone (see
<a href="http://msdn.microsoft.com/en-us/library/cc223483.aspx" target="_blank">Protected Objects (section
</a><a href="http://msdn.microsoft.com/en-us/library/cc223483.aspx" target="_blank">3.1.1.5.5.3</a><a href="http://msdn.microsoft.com/en-us/library/cc223483.aspx" target="_blank">)</a>).</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN">3.1.1.5.5.3 Protected Objects</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN"><a href="http://msdn.microsoft.com/en-us/library/cc223483.aspx" target="_blank">http://msdn.microsoft.com/en-us/library/cc223483.aspx</a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN">3.1.1.6.1.2 Protected Objects</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a href="http://msdn.microsoft.com/en-us/library/dd240058.aspx" target="_blank">http://msdn.microsoft.com/en-us/library/dd240058.aspx</a><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">…<o:p></o:p></p>
<p style="margin-left:1.0in"><span lang="EN" style="font-size:10.0pt;font-family:"Courier New"">o</span><span lang="EN" style="font-size:7.0pt">
</span><span lang="EN">well-known security principals:</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN" style="font-size:10.0pt;font-family:Wingdings">§</span><span lang="EN" style="font-size:7.0pt">
</span><span lang="EN">of class <a href="http://msdn.microsoft.com/en-us/library/cc221822.aspx" target="_blank">
user</a> with RID = DOMAIN_USER_RID_ADMIN</span><br>
<br>
"<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">However, some testing revealed that the last reference which we hoped would explain why the Administrator should not be deleted, appears to not be relevant to the case. Delete operation on any built-in account
or predefined domain rid returns LDAP error 80, and the group membership does not really affect the deletion of users or groups.<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">So after some digging, I found this:<br>
<br>
<br>
<a href="http://msdn.microsoft.com/en-us/library/cc245803.aspx">http://msdn.microsoft.com/en-us/library/cc245803.aspx</a><o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Namely: If the RID of U's <strong>
objectSid</strong> attribute value is less than 1000, an error MUST be returned.<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Could you please confirm that this is indeed the only restriction relevant to the case?<o:p></o:p></p>
</div>
<p class="MsoNormal">Best Regards,<o:p></o:p></p>
</div>
<p class="MsoNormal">Nadezhda Ivanova<o:p></o:p></p>
</div>
</div>
</body>
</html>