Insufficient Rights to Modify LDAP Policy?

[jwgoerlich]

I have two domains in a single forest. The domain controllers are all
Win2000 SP4 computers. I have two DCs per domain. The domain and
forest is running at the Win2000 Native level. All four DCs are on the
same LAN.

One DC is having LDAP/Intersite Messaging problems. Though Win2003 is
not part of the mix, this error appears to be covered under Microsoft
Article 834317, "You receive LDAP bind errors after you run Dcpromo to
install the first Windows Server 2003 computer in a domain"
http://support.microsoft.com/?kbid=834317

I am attempting to set MaxRecieveBuffer back to the default value,
10485760. This is the prescribed workaround. Strangely, I cannot reset
the value on the affected DC (or the other DC in that domain). I can,
however, set the value in the two domain controllers that are working.

The working domain is the root domain and the broken one is a child.
In both cases, I am using the domain Administrator account.

The error I am getting is as follows:

ldap policy: set maxreceivebuffer to 10485760
ldap policy: commit changes

*** Error: ldap_modify of attribute ldapAdminLimits failed with
0x32(50 (Insufficient Rights).
Ldap extended error message is 00002098: SecErr: DSID-03150646,
problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
Win32 error returned is 0x2098(Insufficient access rights to perform
the operation.))

Any suggestions on what is wrong, or what rights are needed? The
rights appear to be neither file nor registry related, as I have tried
this while monitoring with Sysinternal's tools.

Any and all tips appreciated,

J Wolfgang Goerlich

 

[Joe Richards [MVP]]

I just skimmed your post but from the sound of the error in updating I had one
question... Are you using an ID that is a domain admin in the parent or the
child? The parent domain admin ID probably doesn't have the necessary rights.

 

[jwgoerlich]

Are you using an ID that is a domain admin in the parent or the child?

Good question. I am using the domain adminsistrator. Parent admin for
the root domain, child admin for the child domain.

J Wolfgang Goerlich

 

[Joe Richards [MVP]]

I went poking around, it appears that the info for this is maintained in the
following object

cn=default query policy,cn=query-policies,cn=directory service,cn=windows
nt,cn=services,cn=configuration,dc=rootdomain,dc=com

Check the ACL on that object. Since it is in the config container, it probably
requires the parent admin ID. However, you should only have to change this once
for the forest as it is a global configuration setting it appears. You could
only get different values for specific servers by using different policies for
the different servers and that is such a poorly documented thing, I doubt many
people are doing it. Obvioulsy if you look at the parent container of the above
object if there are more than one policy you might possibly have a different
policy configured for different DCs but again, I doubt it.

joe