[MS-DFSRH]: DFS Replication Helper Protocol Specification

MethodModifyObjectDescriptionAdd, delete, or modify attributes of an Active Directory object with the specifieddistinguished name.Opnum: 53.1.5.2.1 CreateObject Method (Opnum 3)The CreateObject method MUST execute an LDAP command under machine security credentials tocreate an Active Directory object with a specified distinguished name and attributes.HRESULT CreateObject([in] BSTR domainControllerName,[in] BSTR distinguishedName,[in] SAFEARRAY(_AdAttributeData)* attributes,[in] BSTR verifyNameDomainControllerName);domainControllerName: MUST be the FQDN of the domain controller to which the methodsends the LDAP request.distinguishedName: MUST be the distinguished name of the Active Directory object that isbeing created. The distinguished name of any object in Active Directory can be used. Theformat of the distinguished name is specified in [RFC2251] section 4.1.3.attributes: The safe array of attributes that MUST be created for the new object. As an inputparameter, the SAFEARRAY is created by the client.verifyNameDomainControllerName: If the attributes of the object refer to an object inanother domain, the client MUST specify the domain controller in that domain that will be usedto verify the reference. The LDAP_SERVER_VERIFY_NAME_OID control will be added to theLDAP command. If this parameter does not specify a domain controller that can be contactedto validate these references, the method MUST fail and return an LDAP protocol failure.The LDAP control is specified in [MS-ADTS] section 3.1.1.3.4.1.16.Return Values: The method MUST return:• 0 on success.• For LDAP protocol failures:• If the LDAP error is LDAP_OPERATIONS_ERROR, dfsrHelperLdapErrorBase + the serversideerror code.• For all other LDAP errors, dfsrHelperLdapErrorBase + the LDAP return code. For moreinformation, see [LDAP-ERR].• For all other failures, an implementation-specific nonzero HRESULT error code, as specifiedin [MS-ERREF] section 2.1, between 0x80000000 and 0xFFFFFFFF. For protocol purposes,all nonzero values MUST be treated as equivalent failures.When the server receives this message, it MUST check whether the caller has sufficient rights toperform the operation. The implementation SHOULD perform a check to verify that the rights areappropriate for the creation of Active Directory objects.[MS-DFSRH] – v20080207DFS Replication Helper Protocol SpecificationCopyright © 2008 Microsoft Corporation.Release: Thursday, February 7, 200853 / 81