|
server
newsgroups
|
|||||||||||||||||||||||
|
|||||||||||||||||||||||
ADAM - group membershipHello,
I have installed an ADAM instance on a member server of an Active Directory Domain. However, when I try to add a local machine user or a domain user to the 'Readers' group in ADAM, when I click apply, it gives me an error "A directory service error has occured" and doesn't allow me to add the local/domain users. However, I am able to add the ADAM users to the readers group comfortably. Any idea why this is happening? Your valuable inputs are apprciated. Thanks, Gib I assume you are trying to use ADSI Edit to do this, right? I actually
don't use ADSI Edit, just ldp.exe, but I can tell you how to add Windows principals to ADAM groups that way. Just edit the member attribute and use the SID DN syntax. For example, you can add the Windows built in Authenticated Users SID to the readers role with: <SID=S-1-5-11> You can put any built-in, domain or local machine in and ADAM will automatically create the appropriate foreign security principal. AD does that too, btw. HTH, Joe K. -- Show quoteHide quoteJoe Kaplan-MS MVP Directory Services Programming Co-author of "The .NET Developer's Guide to Directory Services Programming" http://www.directoryprogramming.net -- "Gibraltar" <Gibral***@discussions.microsoft.com> wrote in message news:E022329B-5E93-4EFD-A245-3D7B53718D9D@microsoft.com... > Hello, > I have installed an ADAM instance on a member server of an Active > Directory > Domain. However, when I try to add a local machine user or a domain user > to > the 'Readers' group in ADAM, when I click apply, it gives me an error "A > directory service error has occured" and doesn't allow me to add the > local/domain users. However, I am able to add the ADAM users to the > readers > group comfortably. Any idea why this is happening? Your valuable inputs > are > apprciated. > > Thanks, > Gib Thanks Joe but I get the same error when I try through ldap too.
I right clicked on Roles and clicked on Modify. In the Edit, I put Attribute as Member and the values: <SID=S-1-5-11> as you advised but it gives the following error. Error:Modify:Operations Error.<1> Server Error:00002095:SvcErr:DSID-032A08FC,problem 5012(DIR_ERROR),data 61 Error 0x2095 A Directory service error has occured. Please help me. Show quoteHide quote "Joe Kaplan" wrote: > I assume you are trying to use ADSI Edit to do this, right? I actually > don't use ADSI Edit, just ldp.exe, but I can tell you how to add Windows > principals to ADAM groups that way. Just edit the member attribute and use > the SID DN syntax. For example, you can add the Windows built in > Authenticated Users SID to the readers role with: > > <SID=S-1-5-11> > > You can put any built-in, domain or local machine in and ADAM will > automatically create the appropriate foreign security principal. AD does > that too, btw. > > HTH, > > Joe K. > > -- > Joe Kaplan-MS MVP Directory Services Programming > Co-author of "The .NET Developer's Guide to Directory Services Programming" > http://www.directoryprogramming.net > -- > "Gibraltar" <Gibral***@discussions.microsoft.com> wrote in message > news:E022329B-5E93-4EFD-A245-3D7B53718D9D@microsoft.com... > > Hello, > > I have installed an ADAM instance on a member server of an Active > > Directory > > Domain. However, when I try to add a local machine user or a domain user > > to > > the 'Readers' group in ADAM, when I click apply, it gives me an error "A > > directory service error has occured" and doesn't allow me to add the > > local/domain users. However, I am able to add the ADAM users to the > > readers > > group comfortably. Any idea why this is happening? Your valuable inputs > > are > > apprciated. > > > > Thanks, > > Gib > > > Did you try that on the roles container or one of the group objects in the
container like Readers? Joe K. -- Show quoteHide quoteJoe Kaplan-MS MVP Directory Services Programming Co-author of "The .NET Developer's Guide to Directory Services Programming" http://www.directoryprogramming.net -- "Gibraltar" <Gibral***@discussions.microsoft.com> wrote in message news:106505C1-7500-48C8-9F27-81FCEFB99C99@microsoft.com... > Thanks Joe but I get the same error when I try through ldap too. > I right clicked on Roles and clicked on Modify. In the Edit, > I put Attribute as Member and the values: <SID=S-1-5-11> as you advised > but > it gives the following error. > Error:Modify:Operations Error.<1> > Server Error:00002095:SvcErr:DSID-032A08FC,problem 5012(DIR_ERROR),data 61 > > Error 0x2095 A Directory service error has occured. > > Please help me. > > > "Joe Kaplan" wrote: > >> I assume you are trying to use ADSI Edit to do this, right? I actually >> don't use ADSI Edit, just ldp.exe, but I can tell you how to add Windows >> principals to ADAM groups that way. Just edit the member attribute and >> use >> the SID DN syntax. For example, you can add the Windows built in >> Authenticated Users SID to the readers role with: >> >> <SID=S-1-5-11> >> >> You can put any built-in, domain or local machine in and ADAM will >> automatically create the appropriate foreign security principal. AD does >> that too, btw. >> >> HTH, >> >> Joe K. >> >> -- >> Joe Kaplan-MS MVP Directory Services Programming >> Co-author of "The .NET Developer's Guide to Directory Services >> Programming" >> http://www.directoryprogramming.net >> -- >> "Gibraltar" <Gibral***@discussions.microsoft.com> wrote in message >> news:E022329B-5E93-4EFD-A245-3D7B53718D9D@microsoft.com... >> > Hello, >> > I have installed an ADAM instance on a member server of an Active >> > Directory >> > Domain. However, when I try to add a local machine user or a domain >> > user >> > to >> > the 'Readers' group in ADAM, when I click apply, it gives me an error >> > "A >> > directory service error has occured" and doesn't allow me to add the >> > local/domain users. However, I am able to add the ADAM users to the >> > readers >> > group comfortably. Any idea why this is happening? Your valuable inputs >> > are >> > apprciated. >> > >> > Thanks, >> > Gib >> >> >> Sorry Joe, I did it on Readers group inside the roles container.
I get the same error even if I try adding a domain user account. I am only able to add ADAM user accounts but not any other domain/machine accounts. Wht might be the reason? Everything else is fine. Thanks, Gib Show quoteHide quote "Joe Kaplan" wrote: > Did you try that on the roles container or one of the group objects in the > container like Readers? > > Joe K. > > -- > Joe Kaplan-MS MVP Directory Services Programming > Co-author of "The .NET Developer's Guide to Directory Services Programming" > http://www.directoryprogramming.net > -- > "Gibraltar" <Gibral***@discussions.microsoft.com> wrote in message > news:106505C1-7500-48C8-9F27-81FCEFB99C99@microsoft.com... > > Thanks Joe but I get the same error when I try through ldap too. > > I right clicked on Roles and clicked on Modify. In the Edit, > > I put Attribute as Member and the values: <SID=S-1-5-11> as you advised > > but > > it gives the following error. > > Error:Modify:Operations Error.<1> > > Server Error:00002095:SvcErr:DSID-032A08FC,problem 5012(DIR_ERROR),data 61 > > > > Error 0x2095 A Directory service error has occured. > > > > Please help me. > > > > > > "Joe Kaplan" wrote: > > > >> I assume you are trying to use ADSI Edit to do this, right? I actually > >> don't use ADSI Edit, just ldp.exe, but I can tell you how to add Windows > >> principals to ADAM groups that way. Just edit the member attribute and > >> use > >> the SID DN syntax. For example, you can add the Windows built in > >> Authenticated Users SID to the readers role with: > >> > >> <SID=S-1-5-11> > >> > >> You can put any built-in, domain or local machine in and ADAM will > >> automatically create the appropriate foreign security principal. AD does > >> that too, btw. > >> > >> HTH, > >> > >> Joe K. > >> > >> -- > >> Joe Kaplan-MS MVP Directory Services Programming > >> Co-author of "The .NET Developer's Guide to Directory Services > >> Programming" > >> http://www.directoryprogramming.net > >> -- > >> "Gibraltar" <Gibral***@discussions.microsoft.com> wrote in message > >> news:E022329B-5E93-4EFD-A245-3D7B53718D9D@microsoft.com... > >> > Hello, > >> > I have installed an ADAM instance on a member server of an Active > >> > Directory > >> > Domain. However, when I try to add a local machine user or a domain > >> > user > >> > to > >> > the 'Readers' group in ADAM, when I click apply, it gives me an error > >> > "A > >> > directory service error has occured" and doesn't allow me to add the > >> > local/domain users. However, I am able to add the ADAM users to the > >> > readers > >> > group comfortably. Any idea why this is happening? Your valuable inputs > >> > are > >> > apprciated. > >> > > >> > Thanks, > >> > Gib > >> > >> > >> > > > I'd try to follow Joe Richards' advice then. I've never seen this behavior
and don't know what to suggest. Joe K. -- Show quoteHide quoteJoe Kaplan-MS MVP Directory Services Programming Co-author of "The .NET Developer's Guide to Directory Services Programming" http://www.directoryprogramming.net -- "Gibraltar" <Gibral***@discussions.microsoft.com> wrote in message news:C809BEC4-8F4B-4D1D-8803-6C9BDCC08115@microsoft.com... > Sorry Joe, I did it on Readers group inside the roles container. > I get the same error even if I try adding a domain user account. I am only > able to add ADAM user accounts but not any other domain/machine accounts. > > Wht might be the reason? Everything else is fine. > > Thanks, > Gib > > "Joe Kaplan" wrote: > >> Did you try that on the roles container or one of the group objects in >> the >> container like Readers? >> >> Joe K. >> >> -- >> Joe Kaplan-MS MVP Directory Services Programming >> Co-author of "The .NET Developer's Guide to Directory Services >> Programming" >> http://www.directoryprogramming.net >> -- >> "Gibraltar" <Gibral***@discussions.microsoft.com> wrote in message >> news:106505C1-7500-48C8-9F27-81FCEFB99C99@microsoft.com... >> > Thanks Joe but I get the same error when I try through ldap too. >> > I right clicked on Roles and clicked on Modify. In the Edit, >> > I put Attribute as Member and the values: <SID=S-1-5-11> as you advised >> > but >> > it gives the following error. >> > Error:Modify:Operations Error.<1> >> > Server Error:00002095:SvcErr:DSID-032A08FC,problem 5012(DIR_ERROR),data >> > 61 >> > >> > Error 0x2095 A Directory service error has occured. >> > >> > Please help me. >> > >> > >> > "Joe Kaplan" wrote: >> > >> >> I assume you are trying to use ADSI Edit to do this, right? I >> >> actually >> >> don't use ADSI Edit, just ldp.exe, but I can tell you how to add >> >> Windows >> >> principals to ADAM groups that way. Just edit the member attribute >> >> and >> >> use >> >> the SID DN syntax. For example, you can add the Windows built in >> >> Authenticated Users SID to the readers role with: >> >> >> >> <SID=S-1-5-11> >> >> >> >> You can put any built-in, domain or local machine in and ADAM will >> >> automatically create the appropriate foreign security principal. AD >> >> does >> >> that too, btw. >> >> >> >> HTH, >> >> >> >> Joe K. >> >> >> >> -- >> >> Joe Kaplan-MS MVP Directory Services Programming >> >> Co-author of "The .NET Developer's Guide to Directory Services >> >> Programming" >> >> http://www.directoryprogramming.net >> >> -- >> >> "Gibraltar" <Gibral***@discussions.microsoft.com> wrote in message >> >> news:E022329B-5E93-4EFD-A245-3D7B53718D9D@microsoft.com... >> >> > Hello, >> >> > I have installed an ADAM instance on a member server of an Active >> >> > Directory >> >> > Domain. However, when I try to add a local machine user or a domain >> >> > user >> >> > to >> >> > the 'Readers' group in ADAM, when I click apply, it gives me an >> >> > error >> >> > "A >> >> > directory service error has occured" and doesn't allow me to add the >> >> > local/domain users. However, I am able to add the ADAM users to the >> >> > readers >> >> > group comfortably. Any idea why this is happening? Your valuable >> >> > inputs >> >> > are >> >> > apprciated. >> >> > >> >> > Thanks, >> >> > Gib >> >> >> >> >> >> >> >> >> Is this ADAM R2 or SP1 or V1.0?
If R2/SP1: o Look at the NC head specifically at the wellKnownObjects, verify that the cn=foreignSecurityPrincipals,<NC DN> entry is there o Check to see if the actual FSP container exists. o Verify ACL on FSP container o Try to add <SID=S-1-1-0>. ACL should look something like G:\>dsacls \\sfmxp32\CN=ForeignSecurityPrincipals,CN=addressbook Access list: Effective Permissions on this object are: Allow S-1-381125554-2027555741-514 SPECIAL ACCESS READ PERMISSONS LIST CONTENTS READ PROPERTY LIST OBJECT Allow S-1-381125554-2027555741-512 FULL CONTROL Allow S-1-381125554-2027555741-514 SPECIAL ACCESS <Inherited from parent> READ PERMISSONS LIST CONTENTS READ PROPERTY LIST OBJECT Allow S-1-381125554-2027555741-512 FULL CONTROL <Inherited from parent> Permissions inherited to subobjects are: Inherited to all subobjects Allow S-1-381125554-2027555741-514 SPECIAL ACCESS READ PERMISSONS LIST CONTENTS READ PROPERTY LIST OBJECT Allow S-1-381125554-2027555741-512 FULL CONTROL Allow S-1-381125554-2027555741-514 SPECIAL ACCESS <Inherited from parent> READ PERMISSONS LIST CONTENTS READ PROPERTY LIST OBJECT Allow S-1-381125554-2027555741-512 FULL CONTROL <Inherited from parent> The command completed successfully joe -- Show quoteHide quoteJoe Richards Microsoft MVP Windows Server Directory Services Author of O'Reilly Active Directory Third Edition www.joeware.net ---O'Reilly Active Directory Third Edition now available--- http://www.joeware.net/win/ad3e.htm Gibraltar wrote: > Thanks Joe but I get the same error when I try through ldap too. > I right clicked on Roles and clicked on Modify. In the Edit, > I put Attribute as Member and the values: <SID=S-1-5-11> as you advised but > it gives the following error. > Error:Modify:Operations Error.<1> > Server Error:00002095:SvcErr:DSID-032A08FC,problem 5012(DIR_ERROR),data 61 > > Error 0x2095 A Directory service error has occured. > > Please help me. > > > "Joe Kaplan" wrote: > >> I assume you are trying to use ADSI Edit to do this, right? I actually >> don't use ADSI Edit, just ldp.exe, but I can tell you how to add Windows >> principals to ADAM groups that way. Just edit the member attribute and use >> the SID DN syntax. For example, you can add the Windows built in >> Authenticated Users SID to the readers role with: >> >> <SID=S-1-5-11> >> >> You can put any built-in, domain or local machine in and ADAM will >> automatically create the appropriate foreign security principal. AD does >> that too, btw. >> >> HTH, >> >> Joe K. >> >> -- >> Joe Kaplan-MS MVP Directory Services Programming >> Co-author of "The .NET Developer's Guide to Directory Services Programming" >> http://www.directoryprogramming.net >> -- >> "Gibraltar" <Gibral***@discussions.microsoft.com> wrote in message >> news:E022329B-5E93-4EFD-A245-3D7B53718D9D@microsoft.com... >>> Hello, >>> I have installed an ADAM instance on a member server of an Active >>> Directory >>> Domain. However, when I try to add a local machine user or a domain user >>> to >>> the 'Readers' group in ADAM, when I click apply, it gives me an error "A >>> directory service error has occured" and doesn't allow me to add the >>> local/domain users. However, I am able to add the ADAM users to the >>> readers >>> group comfortably. Any idea why this is happening? Your valuable inputs >>> are >>> apprciated. >>> >>> Thanks, >>> Gib >> >> Sounds like a DNS problem with that workstation. The firendly-name that you
get from the object picker must be resolved to a SID. Bad DNS will cause that to fail. It could be other things to, but without an error code it's hard to say. Try Joe's tip. If that also fails, it's likely DNS. -- Paul Williams Microsoft MVP - Windows Server - Directory Services http://www.msresource.net | http://forums.msresource.net  
Other interesting topics
Windows 2003 Active Directory will not start after power outage.
AD/ADAM Create User (VB.Net) DNS Record Removal GPO - clarification question Folder Redirection in Windows 2003 Server Question concerning Restricted Groups. Adding a local user account password change via IE quota on network drive (user's home folder) Active Directory 'Roll Call'/Attendance capabilities ? User authentication for RPC over HTTP - domain\username, username, username@domain |
|||||||||||||||||||||||
