Answer to my question below: I'm missing an ACE for ms-DS-Az-Admin-Manager… but what's interesting is that I'm using the Schema GUID from MSDN and for some reason that different from what I have in production (verified using ADFind to dump all the Classes ObjectGUID in the Schema). I asked someone who implemented the Schema here why and they said they ran across the same issue and it was told it wasn't a big deal…..I disagree, since if that was the case my code would be working and this note wouldn’t exist. Anyone seen this before?
-Brandon
_____________________________________________
From: Bernier, Brandon (.)
Sent: Tuesday, August 15, 2006 1:24 PM
To: 'ActiveDir@mail.activedir.org'
Subject: ADSIEdit unable to enumerate list of objects that a group can create
OK..I'm probably doing something silly here but I need more insight on how ADSIEdit enumerates what object types you can create..
The scenario is I have 1 OU and in that OU I have a Group that I've ACL'd to create/delete ms-DS-Az-Admin-Manager objects and mod some attributes on it in that OU . So I bind up as a User in this Group using ADSIEdit and try to create a instance of this object, well that list is empty..so I can't create jack. What am I missing? I'll write a quick little _vbscript_ to test that out, but in the meantime what gives? Thanks!
-Brandon
