summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthias Dieter Wallnöfer <mwallnoefer@yahoo.de>2010-01-11 22:01:42 +0100
committerMatthias Dieter Wallnöfer <mwallnoefer@yahoo.de>2010-01-14 10:58:07 +0100
commit2a05dd6fcc9ccbebeeebcb66407ae2e49d626307 (patch)
treef75f4ddc87e972b8e023ece1dce65d6cca44e441
parent71357053bb2b0695cbbf4661529fc81db3c8e4fd (diff)
downloadsamba-2a05dd6fcc9ccbebeeebcb66407ae2e49d626307.tar.gz
samba-2a05dd6fcc9ccbebeeebcb66407ae2e49d626307.tar.bz2
samba-2a05dd6fcc9ccbebeeebcb66407ae2e49d626307.zip
s4:provision_users.ldif - add the restant part of the objects needing for RODC support
RODC = Read Only Domain Controllers Compared against Windows Server 2008
-rw-r--r--source4/setup/provision_users.ldif26
1 files changed, 26 insertions, 0 deletions
diff --git a/source4/setup/provision_users.ldif b/source4/setup/provision_users.ldif
index c9baf94e3c..cb16b06ff9 100644
--- a/source4/setup/provision_users.ldif
+++ b/source4/setup/provision_users.ldif
@@ -152,6 +152,32 @@ sAMAccountName: RAS and IAS Servers
groupType: -2147483644
isCriticalSystemObject: TRUE
+dn: CN=Allowed RODC Password Replication Group,CN=Users,${DOMAINDN}
+objectClass: top
+objectClass: group
+description: Members in this group can have their passwords replicated to all read-only domain controllers in the domain.
+objectSid: ${DOMAINSID}-571
+sAMAccountName: Allowed RODC Password Replication Group
+groupType: -2147483644
+isCriticalSystemObject: TRUE
+
+dn: CN=Denied RODC Password Replication Group,CN=Users,${DOMAINDN}
+objectClass: top
+objectClass: group
+description: Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain.
+member: CN=Read-Only Domain Controllers,CN=Users,${DOMAINDN}
+member: CN=Group Policy Creator Owners,CN=Users,${DOMAINDN}
+member: CN=Domain Admins,CN=Users,${DOMAINDN}
+member: CN=Cert Publishers,CN=Users,${DOMAINDN}
+member: CN=Enterprise Admins,CN=Users,${DOMAINDN}
+member: CN=Schema Admins,CN=Users,${DOMAINDN}
+member: CN=Domain Controllers,CN=Users,${DOMAINDN}
+member: CN=krbtgt,CN=Users,${DOMAINDN}
+objectSid: ${DOMAINSID}-572
+sAMAccountName: Denied RODC Password Replication Group
+groupType: -2147483644
+isCriticalSystemObject: TRUE
+
# Add foreign security principals
dn: CN=S-1-5-4,CN=ForeignSecurityPrincipals,${DOMAINDN}