DFS Replication without permissions in Active Directory

Question

Hi all,

I would like to setup DFS Replication to a few of our teams servers. Unfortunately, we do not have any other than read permissions in our Active Directory so I am failing to create the replication group.
In order to request the creation of this AD object, I tried to lookup what exactly would be needed but I couldn't find any detailed information.
The systems that would be included into the DFS replication are Windows Server 2012 & Windows Server 2016.

Any idea what would be needed to be setup in AD so that I am able to create the group?

Thanks in advance and kind regards
Melanie

Answer 1

Hi,

1,To grant a user or a group to create the DFS-Replication group, we can do this through the DFS management console:
Open DFS Management
Right click Replication as following:

Then click add, type the username, or group you want to grant the create replication group permission as following:

Then click apply.

2,Or you can delegate DFS replication through the ADUC,

Start Active Directory Users and Computers.
Right-click the Domain\System\DFSR-GlobalSettings node, and then click Properties.
Click the Security tab, and then click Advanced.
Grant the desired users or groups the Create All Child objects permission, and then select This object only in the Apply onto area.

For more delegation details, you can refer to:
https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/delegating-dfs-replication

Answer 2

Then this one may help.
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754770(v=ws.10)

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 3

Something here may help.
https://learn.microsoft.com/en-us/windows-server/storage/dfs-replication/dfsr-overview

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 4

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 5

Thanks a lot to both of you, I will need to check further with our AD team now to see whether it would be possible to grant me the permission.