In a locked-down Active Directory environment where permissions inheritance is disabled, domain preparation does not set the necessary ACEs on the containers holding Users or InetOrgPerson objects within the domain. In this situation, you must run the Grant-CsOuPermission cmdlet on each container that has User or InetOrgPerson objects for which permissions inheritance is disabled. If you have a central forest topology, you must also perform this procedure on the container that holds Contact objects. The ObjectType parameter specifies the object type. The OU parameter specifies the organizational unit.

This cmdlet adds the required ACEs directly on the specified containers and the User or InetOrgPerson objects within the container.

You need user rights equivalent to DomainAdmins group membership to run this cmdlet. If the authenticated user ACEs have also been removed in the locked-down environment, you must grant this account read-access ACEs on the relevant containers in the forest root domain as described in Authenticated User Permissions Are Removed or use an account that is a member of the EnterpriseAdmins group.

1. Log on to a computer joined to the domain with an account that is a member of the DomainAdmins group or that has equivalent user rights.

2. Open the Communications Server Management Shell console, and then run:

   	Copy Code
   Grant-CsOuPermission -ObjectType <User | InetOrgPerson | Contact | AppContact> -OU <DN name for the OU container relative to the domain root container DN> [Domain <Domain FQDN>]

   If you do not specify the Domain parameter, the value defaults to the local domain.

   For example:

   	Copy Code
   Grant-CsOuPermission -ObjectType User -OU usersOU

3. In the log file, look for <Success> Execution Result at the end of each task to verify that the permissions were set, and then close the log window. Or, you can run the following command to determine whether the permissions were set:

   	Copy Code
   Get-CsOuPermission -ObjectType <type of object> -OU <DN name for the OU container relative to the domain root container DN> [Domain <Domain FQDN>]

   You can also run the following cmdlet to test permissions:

   	Copy Code
   Test-CsOuPermission -ObjectType <type of object> -OU <DN name for the OU container relative to the domain root container DN> [Domain <Domain FQDN>]

In a locked-down Active Directory environment where permissions inheritance is disabled, domain preparation does not set the necessary ACEs on the containers that hold Computer objects within the domain. In this situation, you must run the Grant-CsOuPermission cmdlet on each container that has computers running Communications Server with permissions inheritance is disabled. The ObjectType parameter specifies the object type.

This procedure adds the required ACEs directly on the specified containers.

You need user rights equivalent to DomainAdmins group membership to run this cmdlet. If the authenticated user ACEs have also been removed, you must grant this account read-access ACEs on the relevant containers in the forest root domain as described in Authenticated User Permissions Are Removed or use an account that is a member of the EnterpriseAdmins group.

1. Log on to the domain computer with an account that is a member of the DomainAdmins group or that has equivalent user rights.

2. Open the Communications Server Management Shell console, and then run:

   	Copy Code
   Grant-CsOuPermission -ObjectType <Computer> -OU <DN name for the computer OU container relative to the domain root container DN> [Domain <Domain FQDN>]

   If you do not specify the Domain parameter, the value defaults to the local domain.

   For example:

   	Copy Code
   Grant-CsOuPermission -ObjectType Computer -OU computersOU

3. In the log file, look for <Success> Execution Result at the end of each task and verify that there are no errors, and then close the log. Or, you can run the following command to determine whether the permissions were set:

   	Copy Code
   Get-CsOuPermission -ObjectType <type of object> -OU <DN name for the OU container relative to the domain root container DN> [Domain <Domain FQDN>]

   You can also run the following cmdlet to test permissions:

   	Copy Code
   Test-CsOuPermission -ObjectType <type of object> -OU <DN name for the OU container relative to the domain root container DN> [Domain <Domain FQDN>]

   Note:

   If you run domain preparation on the forest root domain in a locked-down Active Directory environment, be aware that Communications Server requires access to the Active Directory Schema and Configuration containers. If the default authenticated user permission is removed from the Schema or the Configuration containers in AD DS, only members of the Schema Admins group or Enterprise Admins group are permitted to access this container. Because Setup.exe, Communications Server Management Shell cmdlets, and Communications Server Control Panel require access to these containers, Setup and installation of the administrative tools fails unless the user running installation has user rights equivalent to Schema Admins and Enterprise Admins group membership. To remedy this situation, you must grant RTCUniversalGlobalReadOnly group access to the Schema and Configuration containers.