-2147024891: General access denied error

[aileen]

I am using a webpage to allow users to update their details in our active directory. The webpage is userupdate.asp and when I login as admin, I am able to update all my details, but if I login as a standard domain user and try to update the details, then I am getting "-2147024891: General access denied error". I have followed the ms article page to sort this thing out, but it is not working for me. Any ideas?

[newtech]

When you are doing a GetInfoEx on the allowedAttributesEffective attribute, then you will get an array containing the list of attributes that the current authenticated user has access to change on the current object. I think that you are trying to set an attribute value whose rights have not been delegated as you want it to be?

[aileen]

For testing purpose, I have set the delegated rights just to use home phone number, and then got a user just to update the home phone field, and leave everything else blank but the error still happens. I will attempt the GetInfoEx that you have told and see what happens after that, i will keep you posted for same. Thanks

[Viceman]

I actually like the allowedAttributesEffective call since it tells you what you are allowed to edit instead of making you fuess. Soemtimes the bind doesnt work the way you think it did or your delegation of rights didnt. The other thing that might be going on could be a Kerberos delegation problem. To verify that you need to get the Kerberos authentication, so use IADsObjectOptions to check the mutual authentication flag, which is a very usesful diagnostic tool.