[MS-DFSRH]: DFS Replication Helper Protocol Specification

distinguishedName: MUST be the distinguished name of the Active Directory object that isbeing deleted. The distinguished name of any object in Active Directory can be used. Theformat of the distinguished name is specified in [RFC2251] section 4.1.3.Return Values: The method MUST return:• 0 on success.• For LDAP protocol failures:• If the LDAP error is LDAP_OPERATIONS_ERROR, dfsrHelperLdapErrorBase + the serversideerror code.• For all other LDAP errors, dfsrHelperLdapErrorBase + the LDAP return code. For moreinformation, see [LDAP-ERR].• For all other failures, an implementation-specific nonzero HRESULT error code, as specifiedin [MS-ERREF] section 2.1, between 0x80000000 and 0xFFFFFFFF. For protocol purposes,all nonzero values MUST be treated as equivalent failures.After receiving this message, the server MUST check whether the caller has sufficient rights toperform the operation. The implementation SHOULD perform a platform-specific check to verify thatthe rights are appropriate for the deletion of Active Directory objects.• If the user does not have sufficient rights, the server MUST fail the operation immediately andreturn the dfsrHelperErrorNotLocalAdmin error code as its response to the client.• If the server fails to perform this check because of an implementation-specific failure, the serverMUST fail the operation immediately and return an appropriate error as its response to theclient.If the check succeeds and the server can verify that the user has sufficient rights, the server MUSTproceed to the next steps of the method.After the server receives this message, it MUST validate the parameters:• Verify that domainControllerName and distinguishedName are not NULL and are not emptystrings.• If parameter validation fails, the server MUST fail the operation immediately and return anappropriate error as its response to the client.If both the security check and the parameter validation succeed, the server MUST create a newLDAP command to delete an existing Active Directory object with the specified distinguished name.The server MUST execute this LDAP command against the domain controller that is specified indomainControllerName and check the return value of the LDAP protocol.If the LDAP protocol returns LDAP_SUCCESS, the server MUST return zero to the caller to indicatethe success of the call; otherwise, if the LDAP protocol returned any return code other thanLDAP_SUCCESS, the server MUST return the following error code to the caller:• If the error is LDAP_OPERATIONS_ERROR, the server gets the server-side error code of the LDAPoperation and MUST return dfsrHelperLdapErrorBase + the server-side error code to the caller.• For all other LDAP errors, the server MUST return dfsrHelperLdapErrorBase + the LDAP returncode to the caller.[MS-DFSRH] – v20080207DFS Replication Helper Protocol SpecificationCopyright © 2008 Microsoft Corporation.Release: Thursday, February 7, 200855 / 81