17.8.1 ProblemWhenever you create an object in Active Directory, the default security descriptor defined in the schema for the object's class is applied to the object. This default security descriptor may reference specific groups, such as Domain Admins, but it is not specific to a domain. This makes a lot of sense for domain-naming contexts, where the Domain Admins group in question would be the one defined in the domain. For application partitions, which don't contain a Domain Admins group, it is not so straightforward. Which domain's Domain Admins group do you use? To work around this issue, you can set a default security descriptor reference domain for an application partition by setting the msDS-SDReferenceDomain attribute of the partition's crossRef object. 17.8.2 Solution17.8.2.1 Using a graphical user interface
17.8.2.2 Using a command-line interface> ntdsutil "dom man" conn "co to se <DomainControllerName>" q "set nc ref domain[RETURN] <AppPartitionDN> <DomainDN>" q q 17.8.2.3 Using VBScript' This code sets the SD reference domain for the specified app partition ' ------ SCRIPT CONFIGURATION ------ ' DN of reference domain strRefDomainDN = "<DomainDN>" ' e.g. dc=emea,dc=rallencorp,dc=com ' Fully qualified DNS name of app partition strAppPart = "<AppPartitionFQDN>" ' e.g. app.rallencorp.com ' ------ END CONFIGURATION --------- set objRootDSE = GetObject("LDAP://RootDSE") strBase = "<LDAP://cn=Partitions," & _ objRootDSE.Get("ConfigurationNamingContext") & ">;" strFilter = "(&(objectcategory=crossRef)(dnsRoot=" & _ strAppPart & "));" strAttrs = "nCName,msDS-SDReferenceDomain,distinguishedName;" strScope = "onelevel" set objConn = CreateObject("ADODB.Connection") objConn.Provider = "ADsDSOObject" objConn.Open "Active Directory Provider" set objRS = objConn.Execute(strBase & strFilter & strAttrs & strScope) if objRS.RecordCount <> 1 then WScript.Echo "Did not find a match for application partition " & _ strAppPart WScript.Quit else objRS.MoveLast WScript.Echo "Current Reference Domain: " & _ objRS.Fields("msDS-SDReferenceDomain").Value set objCrossRef = GetObject("LDAP://" & _ objRS.Fields("distinguishedName").Value ) objCrossRef.Put "msDS-SDReferenceDomain", strRefDomainDN objCrossRef.SetInfo WScript.Echo "New Reference Domain: " & _ objCrossRef.Get("msDS-SDReferenceDomain") end if 17.8.3 DiscussionIf you don't set the msDS-SDReferenceDomain attribute for an application partition, then a certain hierarchy is followed to determine the default security descriptor domain. These are the guidelines:
17.8.4 See AlsoRecipe 10.19 for more on setting the default security descriptor for a class, Recipe 17.1 for creating an application partition, and MS KB 322669 (HOW TO: Manage the Application Directory Partition and Replicas in Windows Server 2003) |