Active Directory Cookbook

17.8. Setting the Reference Domain for an Application Partition

Problem

Whenever you create an object in Active Directory, the default security descriptor defined in the schema for the object’s class is applied to the object. This default security descriptor may reference specific groups, such as Domain Admins, but it is not specific to a domain. This makes a lot of sense for domain-naming contexts, where the Domain Admins group in question would be the one defined in the domain. For application partitions, which don’t contain a Domain Admins group, it is not so straightforward. Which domain’s Domain Admins group do you use? To work around this issue, you can set a default security descriptor reference domain for an application partition by setting the msDS-SDReferenceDomain attribute of the partition’s crossRef object.

Solution

Using a graphical user interface

1. Open ADSI Edit.

2. Connect to the Configuration naming context of the forest the application partition is in if it is not already present in the left pane.

3. Expand the Configuration naming context and click on the Partitions container.

4. In the right pane, right-click on the crossRef object that represents the application partition and select Properties.

5. Under Attributes, select the msDS-SDReferenceDomain attribute.

Using a command-line interface

> ntdsutil "dom man" conn "co to se <DomainControllerName>" q "set nc ref domain[RETURN]
<AppPartitionDN> <DomainDN>" q q

Using VBScript

' This code sets the SD reference domain for the specified ...