3.2.5.1.2 DN Discovery

The client attempts to discover the policy target DN to be used to query for the GPOs, as specified in section 2.2.1. The DN for the root of the domain is extracted from the fully qualified distinguished name for the requested account by parsing the Unicode string until an RDN beginning with 'DC=' is found. The DN of domain naming context (domain NC) is stored in abstract element Policy Target Domain DN. If the computer's account is to be used, the computer account name MUST be specified in DS_NT4_ACCOUNT_NAME format. If the user account is to be used, the discovery is done under impersonation of the policy target, and the user account name MUST be specified in DS_NT4_ACCOUNT_NAME format. If this message is invalid, as specified in section 2.2, policy application MUST be terminated and an event logged using an implementation-specific mechanism, as defined in section 3.2.5.1.