Bug 8981 - InsufficientAccessRights to CN=DisplaySpecifiers,CN=Configuration
Summary: InsufficientAccessRights to CN=DisplaySpecifiers,CN=Configuration
Status: NEW
Alias: None
Product: Samba 4.0
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB (show other bugs)
Version: unspecified
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Andrew Bartlett
QA Contact: samba4-qa@samba.org
Depends on:
Reported: 2012-06-05 18:23 UTC by Brian Huffman
Modified: 2012-11-26 07:47 UTC (History)
1 user (show)

See Also:

Debug output (27.55 KB, text/plain)
2012-07-13 15:29 UTC, Brian Huffman
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Brian Huffman 2012-06-05 18:23:40 UTC
I'm trying to run an installer that needs to add some values under CN=user-Display,CN=40C,CN=DisplaySpecifiers,CN=Configuration and I'm getting an access error:

modifyResponse(21) insufficientAccessRights (00002098: Object CN=user-Display,CN=40C,CN=DisplaySpecifiers,CN=Configuration,DC=xmen,DC=eti has no write property access)

However, when I try to add the same value using the ADSI tool (part of the Windows AD Toolset), it works.

Unfortunately there are a lot of similar additions and adding them manually (after finding them) is a daunting task...

I'm running as the Administrator of the domain, so this should work?

Comment 1 Brian Huffman 2012-07-13 15:29:53 UTC
Created attachment 7702 [details]
Debug output

Here's some of the debug output when I attempt to run the program that makes this modification.  I've used these options: "samba -i -M single -d 10"
Comment 2 Stefan Metzmacher 2012-11-26 07:47:58 UTC
The installer doesn't run as administrator, it seems to
run as the machine account.

sids: ARRAY(5)
     sids                     : S-1-5-21-2824053618-3522172672-2706769870-1104
     sids                     : S-1-5-21-2824053618-3522172672-2706769870-515
     sids                     : S-1-1-0
     sids                     : S-1-5-2
     sids                     : S-1-5-11