Article ID: 842560
Article Last Modified on 10/30/2006
APPLIES TO
- Microsoft Windows Server 2003, Standard Edition (32-bit x86)
SYMPTOMS
When you try to change the replication scope of an Active Directory integrated domain name system (DNS) zone, you may receive an error that is similar to the following error message:
CAUSE
This issue may occur if the system account does not have the SeSecurityPrivelige permission that is provided by the built-in administrator account.
RESOLUTION
To resolve this issue, you must add the built-in administrators group account to the manage auditing and security log user permission. The manage auditing and security log user permission is located in the default domain controller policy. After you add the built-in administrators group account, change the replication scope of the required DNS zone.
To add the built-in administrators group account to the manage auditing and security log user permission, follow these steps:
- Start the Active Directory Users and Computers snap-in.
- Right-click the Domain Controllers container, and then click Properties.
- Click the Group Policy tab, and then click Edit.
- In the left pane, expand Windows Settings, and then expand Security Settings.
- Expand Local Policies, and then click User Rights Assignment.
- In the right pane, double-click Manage auditing and security log, and then click Add User or Group.
- Click Browse, and then click Advanced.
- Click Find Now, and then click Administrators in the Search Results box.
- Click OK, click OK, click OK, and then click OK to quit Group Policy Object Editor.
- On the File menu, click Exit.
- Click OK.
- Quit the Active Directory Users and Computers snap-in.
- Change the replication scope of the Active Directory integrated DNS zone.
Keywords: kbprb KB842560
