[MS-DFSRH]: DFS Replication Helper Protocol Specification

If the user does not have sufficient rights, the server MUST fail the operation immediately andreturn the dfsrHelperErrorNotLocalAdmin error code as its response to the client.If the server fails to perform this check because of an implementation-specific failure, the serverMUST fail the operation immediately and return an appropriate error as its response to the client.If the check succeeds and the server can verify that the user has sufficient rights, the server MUSTproceed to the next steps of the method.After it receives this message, the server MUST validate the parameters:• Verify that domainControllerName and distinguishedName are not NULL and are not emptystrings.• Verify that attributes are not NULL and present a valid one-dimensional safe array. SAFEARRAY isas specified in [MS-DCOM]. For more information, see [SAFEARRAY].If parameter validation fails, the server MUST immediately fail the operation and return anappropriate error as its response to the client.If both the security check and the parameter validation succeed, the server MUST create a newLDAP command for creating a new Active Directory object that has the specified distinguished nameand attributes.If the verifyNameDomainControllerName parameter is not NULL or is an empty string, the serverMUST append the LDAP_SERVER_VERIFY_NAME_OID control to the LDAP command. The value ofthe verifyNameDomainControllerName parameter MUST be passed to this control as a value. If forany reason this control cannot be created or appended to the command, the server MUST fail theoperation immediately and return the dfsrHelperErrorCreateVerifyServerControl error code as itsresponse to the client.Otherwise, the server MUST execute the LDAP command against the domain controller that isspecified in domainControllerName and check the return value of the LDAP protocol.If the LDAP protocol returns LDAP_SUCCESS, the server MUST return zero to the caller to indicatethe success of the call; otherwise, if the LDAP protocol returned any return code other thanLDAP_SUCCESS, the server MUST return the following error code to the caller:• If the error is LDAP_OPERATIONS_ERROR, the server gets the server-side error code of the LDAPoperation and MUST return dfsrHelperLdapErrorBase + the server-side error code to the caller.• For all other LDAP errors, the server MUST return dfsrHelperLdapErrorBase + the LDAP returncode to the caller.3.1.5.2.2 DeleteObject Method (Opnum 4)The DeleteObject method MUST execute an LDAP command under machine security credentials todelete an Active Directory object with a specified distinguished name.HRESULT DeleteObject([in] BSTR domainControllerName,[in] BSTR distinguishedName);domainControllerName: MUST be the FQDN of the domain controller to which the methodsends the LDAP command.[MS-DFSRH] – v20080207DFS Replication Helper Protocol SpecificationCopyright © 2008 Microsoft Corporation.Release: Thursday, February 7, 200854 / 81