"alidated write to DNS attribute" on OUs rather than Domai..

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

We've got different DNS prefixes from the AD domain name (w2k), and would
like to work around the errors in the system event log (xp).

This article (http://support.microsoft.com/kb/258503/EN-US/) describes how
to change the permissions on the domain, but I'd prefer to change this on
an OU by OU basis. Does anyone know if this is possible, or is it
genuinely only a property of the domain?

I noticed that the LDAP error is a constraint violation, so I can
understand that it's a property of the domain, rather than simply a
permission issue on the computer account objects.

Cheers,

Kenny.

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Kenneth,

This is best done on a domain-wide scope. If you really want to go in there
and make the changes manually or script that, it may be possible, but
certainly not supported and not available in the GUI.

If you go the granular route, let us know how it works out and test it
thoroughly before pushing into production.
--
Ryan Hanisco
MCSE, MCDBA
Flagship Integration Services

"Kenneth MacDonald" <K.MacDonald@ed.ac.uk> wrote in message
newsan.2005.02.14.16.53.17.279026@ed.ac.uk...
> We've got different DNS prefixes from the AD domain name (w2k), and would
> like to work around the errors in the system event log (xp).
>
> This article (http://support.microsoft.com/kb/258503/EN-US/) describes how
> to change the permissions on the domain, but I'd prefer to change this on
> an OU by OU basis. Does anyone know if this is possible, or is it
> genuinely only a property of the domain?
>
> I noticed that the LDAP error is a constraint violation, so I can
> understand that it's a property of the domain, rather than simply a
> permission issue on the computer account objects.
>
> Cheers,
>
> Kenny.
>

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

The subject should of course start "Validated ..."

Cheers,

Kenny.

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

On Mon, 14 Feb 2005 11:21:21 -0600, Ryan Hanisco wrote:

> Kenneth,
>
> This is best done on a domain-wide scope. If you really want to go in there
> and make the changes manually or script that, it may be possible, but
> certainly not supported and not available in the GUI.
>
> If you go the granular route, let us know how it works out and test it
> thoroughly before pushing into production.

The exact same GUI is available in the security property tab as for
domains.

However, it didn't seem to work for me, so I was looking for confirmation
on whether it really would *only* work on domains or not.

Thanks for your advice on testing, though

Cheers,

Kenny.