Unable to create an OU in a managed domain

Question

Hello,

I have Adaxes installed in one forest (domain.com) and we have a 1 way forest trust with another forest (ca.domain.com). I have made the Adaxes service account in domain.com a member of the BUILTIN\administrators group in ca.domain.com and have it added as a managed domain in the Adaxes Admin Console.

I'm able to view objects normally, I'm able to create the OU in the console.

However when I try to create an OU using the New-AdmOrganizationalUnit cmdlet using this command:

New-AdmOrganizationalUnit -Server ca.domain.com -Path "OU=Customers,DC=ca,DC=domain,DC=com" -Name NewTestCustomer

I get the following error:

New-AdmOrganizationalUnit : A local error has occurred.   
At line:20 char:1  
+ New-AdmOrganizationalUnit -Server ca.domain.com -Path "OU=Customers,DC=ca,DC ...  
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
 + CategoryInfo : NotSpecified: (:) \[New-AdmOrganizationalUnit\], DirectoryComException  
 + FullyQualifiedErrorId : Softerra:Adaxes:PowerShellModule:Commands:NewAdmOrganizationalUnitCommand:ProcessRecord,Softerra.Adaxes.PowerShellModule.Commands.NewAdmOrganizationalUnitCommand  

Any thoughts on how to run scripts in a managed domain? I also tried this command:

Get-AdmOrganizationalUnit -Filter 'Name -like "*"' -Server ca.domain.com

I get the same error. Could someone help me understand what I'm doing wrong?

Comments

This link in the FAQ seems to indicate I don't need the trust:

Do I have to create a trust between two domains to manage them with the same Adaxes service?

Does this only apply to the administrative console? Or to the cmdlets as well?

Answer 1

Hello,

The thing is that when using Adaxes cmdlets, operations on AD objects can be performed either via Adaxes Service, or by directly accessing Active Directory domain controllers. When performing operations directly, the AD is accessed using the credentials of the currently logged in user. When operation are performed via Adaxes service, the AD is accessed using the account specified for the respective domain.

The reason for your issue is that you access the AD directly, and the currently logged in user account does not have sufficient permissions to access the OUs in the child domain. By 'permissions' we mean native AD permissions, not Adaxes Security Roles. To perform operations via Adaxes service, you need to specify the -AdaxesService parameter when calling Adaxes cmdlets, for example:

New-AdmOrganizationalUnit -Server ca.domain.com -Path "OU=Customers,DC=ca,DC=domain,DC=com" -Name NewTestCustomer -AdaxesService adaxesserver.domain.com

OR

Get-AdmOrganizationalUnit -Filter 'Name -like "*"' -Server ca.domain.com -AdaxesService localhost

Comments

Thanks for the help.

That did the trick!