[cifs-protocol] MS-LSAD 220.127.116.11.10-12 CreateTrustedDomain* question
hongweis at microsoft.com
Wed Nov 17 12:17:58 MST 2010
As per the processing logic in 18.104.22.168.10 in MS-LSAD, the caller to LsarCreateTrustedDomainEx2 or similar functions has to be a member of the Domain Admins group to access the policy handle. The requirement for the caller's control access right is also defined in the same section. The constraint you mentioned in MS-ADTS is for LDAP Add operation. The ERROR_DS_CANT_ADD_SYSTEM_ONLY means that it is not permitted to add the attribute which is owned by the system.
Please let me know if I understand your questions correctly and if you have more questions.
From: Matthias Dieter Wallnöfer [mailto:mdw at samba.org]
Sent: Saturday, November 13, 2010 8:47 AM
To: Interoperability Documentation Help
Cc: cifs-protocol at samba.org
Subject: MS-LSAD 22.214.171.124.10-12 CreateTrustedDomain* question
Hi dochelp people,
the calls "CreateTrustedDomain*" allow to create trusted domain objects.
Now the question is: what AD security user is used to create them? It is
Since otherwise we run into the following constraint (taken from MS-ADTS
> The structural objectClass is not a Local Security Authority
> (LSA)-specific object class (section
> 126.96.36.199.2.3). If it is, Add returns unwillingToPerform /
More information about the cifs-protocol