3.1.1.8.9 member

1. If all of the following conditions are true, the subsequent constraint MUST be satisfied:

   1. Conditions:

      1. The value contains a SID-only dsname value.

      2. The dsname value does not resolve to an existing object in the domain NC.

      3. The server is in a DC configuration, and the domain prefix of the SID value is not equal to any domain SID in the forest; or the server is in a non-DC configuration, and the value is different than the account domain security identifier.

   2. Constraint:

      1. A new object with the following characteristics MUST be created with the following attributes and values. The dsname value added to the member attribute MUST reference this object.

         Attribute	Value
         objectClass	foreignSecurityPrincipal
         objectSid	The SID value of the new dsname value.
         distinguishedName	The parent MUST be the well-known object container for foreign principal objects. (More information about this container is specified in [MS-ADTS] section 6.1.1.4.) There is no constraint on the relative distinguished name (RDN) value.
         ntSecurityDescriptor	The default security descriptor for foreignSecurityPrincipal objects; the Owner and Group fields of the security descriptor value MUST be the Domain Admins SID from the domain in which the object is created.

2. If the groupType is GROUP_TYPE_SECURITY_ACCOUNT, all of the following constraints MUST be satisfied:

   1. If the domain is in mixed mode, the member values MUST refer to user objects (or objects derived from user).

   2. If the domain is in native mode, the member values MUST satisfy at least one of the following criteria:

      1. The member value refers to a user account.

      2. The member value refers to a group account whose groupType is GROUP_TYPE_SECURITY_ACCOUNT.

3. If the groupType is GROUP_TYPE_SECURITY_RESOURCE, all of the following constraints MUST be satisfied:

   1. If the domain is in mixed mode, the member values MUST either refer to user objects (or objects derived from user) or refer to group objects whose groupType is GROUP_TYPE_SECURITY_ACCOUNT.

   2. If the domain is in native mode, the constraint shown above is relaxed to include member values that refer to group objects whose groupType is GROUP_TYPE_SECURITY_RESOURCE.

4. If the groupType contains the GROUP_TYPE_UNIVERSAL_GROUP, each member value MUST satisfy at least one of the following conditions:

   1. The value refers to a user object (or an object derived from user).

   2. The value refers to a group object (or an object derived from group) with a groupType attribute that contains GROUP_TYPE_ACCOUNT_GROUP or GROUP_TYPE_UNIVERSAL_GROUP.