RE: [ActiveDir] Exchange/AD bug or poor design?

[Ken Cornetet]

Title: Message

Correct - more or less. My code does LDAP calls to modify the group (DL) membership directly to a DC in the domain that contains the group.   GCs have read/write copies of objects (most attributes) in their domain, but read-only for other domains. You can't modify objects via LDAP to the GC (port 3268), but the NSPI protocol that Outlook uses presumably can do updates to the GC - as long as the object being updated belongs to the GC's domain.   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Salandra, Justin A. Sent: Thursday, March 18, 2004 1:52 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] Exchange/AD bug or poor design? Isn’t the Global Catalog read-only to begin with, aren’t you updating AD and then AD publishes this information to the GC?   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Ken Cornetet Sent: Thursday, March 18, 2004 1:17 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] Exchange/AD bug or poor design?   We handled it by writing a perl CGI program to do DL management. Our environment is fairly simple, though - all users in one domain, DLs in another. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Thommes, Michael M. Sent: Thursday, March 18, 2004 11:57 AM To: Active Directory Mailing List (E-mail) Subject: [ActiveDir] Exchange/AD bug or poor design? Hi All,     I know that some of you think the Exchange/AD is the best thing since "sliced bread" <wink> based on past exchanges/rants on this mailing list, and I wonder about the following:   In multi-domain environments, the global catalog server that you select may not be in the same domain as Active Directory group objects. Therefore, users cannot update group membership because the local global catalog server has a read-only copy of the group.  from: How to configure a specific GC: http://support.microsoft.com/default.aspx?scid=kb;EN-US;319206   Since an Outlook client can choose any of the available GCs in the enterprise, when a user tries to update a group membership, obviously it's going to fail if connected to a GC that has a read-only copy.  So the fixup, according to the KB article, is to specify a particular GC.  But by specifying a particular GC, all of a sudden I have lost the redundancy that AD gives me!  Catch-22!  Is this an Exchange design flaw?  How are others handling this problem?  TIA! Mike Thommes