Sorry, this:
"...There will be instances whereby there are different connections for
different connections, especially in multi-site multi-domain
environments..."
Should read:
"...There will be instances whereby there are different connections for
different *partitions*, especially in multi-site multi-domain
environments..."
--
Paul Williams
http://www.msresource.net
http://forums.msresource.net
"ptwilliams" <***@hotmail.com> wrote in message news:%***@TK2MSFTNGP10.phx.gbl...
The permissions you need to set depend on your replication topology. But
most connection objects piggy bank together. That is, the enterprise
partitions usually tag along with the domain partitions. There will be
instances whereby there are different connections for different connections,
especially in multi-site multi-domain environments, where the GC has to pull
from either another GC or a domain partition, etc. So, as Glen stated, the
best 'catch all' is to set these on all partitions.
I guess, in 2003, you also have to take the application partitions into
consideration as well.
--
Paul Williams
http://www.msresource.net
http://forums.msresource.net
"Glenn L" <the.only(delete)@gmail dot com> wrote in message news:***@TK2MSFTNGP10.phx.gbl...
There are specific ACLs you must set on each partition
(domain,config,schema) to allow a non admin to force replication.
They are:
replicate directory changes
replicate directory changes all
replication synchronization
I am not sure which one you need to set or if they all need to be set. You
will need to test this out to figure out which ones are required. Make it
easy on yourself and enable them all.
You should also consider the "Monitor Active Directory Replication" ACL so
the delegated user can utilize repadmin and replmon to monitor replication
status.
--
Glenn L
CCNA, MCSE 2000/2003 + Security
Post by Allen Firouz"You do have the ability to delegate the administration of the actual
replication object in Active Directory, but I don't believe, in Sites and
Services, [there is] the ability to delegate the ability for a
non-administrative user to actually force the replication. So in other words,
they may be able to manage the schedule around that replication connection or
the frequency, but not actually force the replication connection itself."
-Allen Firouz
(excerpt from Technet Webcast transcript)
Post by Tim KalligonisI need to delegate the ability to force AD replication between sites to a
specific group of Admins. I haven't found and KB articles telling me what I
need to delegate to do this.
All I want them to be able to do is choose "replicate now" and nothing else
within Sites and Services.
I have tried delegating Full Control on Site Replication Service objects,
but it isn't enough. They are still not able to force replication.
Can anyone point me in the right direction or know exactly which items I
need to delegate?
Thanks,
Tim