[MS-DFSRH]: DFS Replication Helper Protocol Specification

3.1.5.2.3 ModifyObject Method (Opnum 5)The ModifyObject method MUST execute an LDAP command under machine security credentials toadd, delete, or modify attributes of an Active Directory object with a specified distinguishedname.HRESULT ModifyObject([in] BSTR domainControllerName,[in] BSTR distinguishedName,[in] SAFEARRAY(_AdAttributeData)* attributes);domainControllerName: MUST be the FQDN of the domain controller to which the methodsends the LDAP request. The format of the distinguished name is specified in [RFC2251]section 4.1.3.distinguishedName: MUST be the distinguished name of the Active Directory object beingmodified. The distinguished name of any object in Active Directory MAY be used.attributes: MUST be the safe array of attributes that are to be added, modified, or deleted.Return Values: The method MUST return:• 0 on success.• For LDAP protocol failures:• If the LDAP error is LDAP_OPERATIONS_ERROR, dfsrHelperLdapErrorBase + the serversideerror code.• For all other LDAP errors, dfsrHelperLdapErrorBase + the LDAP return code. For moreinformation, see [LDAP-ERR].• For all other failures, an implementation-specific nonzero HRESULT error code, as specifiedin [MS-ERREF] section 2.1, between 0x80000000 and 0xFFFFFFFF. For protocol purposes,all nonzero values MUST be treated as equivalent failures.After the server receives this message, it MUST check whether the caller has sufficient rights toperform the operation. The implementation SHOULD perform a platform-specific check to verify thatthe rights are appropriate for the modification of Active Directory objects.• If the user does not have sufficient rights, the server MUST fail the operation immediately andreturn the dfsrHelperErrorNotLocalAdmin error code as its response to the client.• If the server fails to perform this security check because of an implementation-specific failure,the server MUST fail the operation immediately and return an appropriate error as its response tothe client.If the security check succeeds and the server can verify that the user has sufficient rights, theserver MUST proceed to the next steps of the method.When the server receives this message, it MUST validate the parameters:• Verify that domainControllerName and distinguishedName are not NULL and are not emptystrings.[MS-DFSRH] – v20080207DFS Replication Helper Protocol SpecificationCopyright © 2008 Microsoft Corporation.Release: Thursday, February 7, 200856 / 81