Whenever you create an object in Active Directory,
the default security descriptor
defined in the schema for the object’s class is
applied to the object. This default security descriptor may reference
specific groups, such as
Admins, but it is not specific to a domain. This
makes a lot of sense for domain-naming contexts, where the
Admins group in question
would be the one defined in the domain. For application partitions,
which don’t contain a
Admins group, it is not so straightforward. Which
Admins group do you use? To work around this
issue, you can set a default security descriptor reference domain for
an application partition by setting the
msDS-SDReferenceDomain attribute of the
Open ADSI Edit.
Connect to the Configuration naming context of the forest the application partition is in if it is not already present in the left pane.
Expand the Configuration naming context and click on the Partitions container.
In the right pane, right-click on the
object that represents the application partition and select
Under Attributes, select the
> ntdsutil "dom man" conn "co to se <
DomainControllerName>" q "set nc ref domain[RETURN] <
DomainDN>" q q
' This code sets the SD reference domain for the specified ...