ADS changes using JNDI

[Brandon McCombs]

Does anyone know whether ADS (win2k3) lets a user modify a group's scope
or type programmatically when using JNDI? It seems that it doesn't
based on the code I've setup. I'm using the following values to make the
mods as appropriate:

//groupType attribute values
public static final String GLOBAL_DIST_GROUP = "2";
public static final String GLOBAL_SEC_GROUP = "-2147483646";
public static final String DOMAIN_LOCAL_DIST_GROUP = "4";
public static final String DOMAIN_LOCAL_SEC_GROUP = "-2147483644";
public static final String UNIVERSAL_DIST_GROUP = "8";
public static final String UNIVERSAL_SEC_GROUP = "-2147483640";

//sAMAccountType attribute values
public static final String GLOBAL_DIST_TYPE = "268435457";
public static final String GLOBAL_SEC_TYPE = "268435456";
public static final String DOMAIN_LOCAL_DIST_TYPE = "536870913";
public static final String DOMAIN_LOCAL_SEC_TYPE = "536870912";
public static final String UNIVERSAL_DIST_TYPE = "268435457";
public static final String UNIVERSAL_SEC_TYPE = "268435456";

I did notice that when using the ADUC snap-in it will warn a user when
changing a group's type from security to distribution (since the group
could already be involved in some ACLs) but no such warning occurs for
scope changes but through JNDI I can't change either one. Thanks for
any tips (I searched using Google and didn't find anything regarding this).

I've asked this in the active directory group but never got a response.


thanks
brandon