Delegating The Creation Of Application Directory Partitions

By Author: Anny
Total Articles: 59
Comment this article

There are two things that happen when creating an application directory partition:

Creation of the cross-reference object

Creation of the application directory partition root node

Normally only members of the Enterprise Admins group can create an application directory partition. However, it is possible for a member of the Enterprise Admins group to prepare a cross-reference object for the MCSE Exam and to delegate the rest of the process to someone with more limited permissions.

The cross-reference object for an application directory partition holds several valuable pieces of information, including the domain controllers that are to have a replica of this partition and the security descriptor reference domain. The partition root node is the Active Directory object at the root of the partition.

The Enterprise Admin can create the cross-reference object then delegate to a person or group with less permissions the right to create the application directory partition root node. Both free Cisco question papers ...
... of the cross-reference object and the application directory partition root node can be accomplished using Ntdsutil.

After using Ntdsutil to create the cross-reference object, the enterprise administrator must modify the cross-reference object's access control list to allow the delegated administrator to modify this cross-reference. This will allow the delegated administrator to create the application directory partition and modify the list of domain controllers that holds replicas of this application directory partition. The delegated administrator must use the names of the application directory partition and the domain controller name that were specified during the precreation process.

To prepare a cross-reference object:

1. Type the appropriate commands to invoke the Ntdsutil domain management

command.

2. At the domain management command prompt, type:

precreate ObjectName DomainController, where ObjectName is the distinguished name of the object you want to create, and DomainController is the DNS name of the domain controller on which the object will reside.

The security descriptor reference domain defines a domain name for the default security descriptor for objects in the application directory partition. By default, the security descriptor reference domain is the parent domain of the application directory partition. If the application directory partition is a child of another application directory partition, the default security descriptor reference domain is the security descriptor reference domain of the parent application directory partition. If the application directory partition has no parent, the forest root domain becomes the default security descriptor reference domain. You can use IT Exams to change the default security descriptor reference domain.

To set an application directory partition reference domain:

1. Type the appropriate commands to invoke the Ntdsutil domain management

command.

2. At the domain management command prompt, type:

set nc reference domain ApplicationDirectoryPartition ReferenceDomain,

where ApplicationDirectoryPartition is the distinguished name of the application directory partition for which you want to set the reference domain, and Reference-Domain is the distinguished name of the domain that you want to be the refer?ence domain for the application directory partition.

Exam Tip Know how to create and configure application directory partitions.