JSI Tip 10226. The 'netdom query /domain: OU' command errors with 'The requested API is not supported on the remote server' on a Windows Server 2003 SP1 domain controller?

When you run the netdom query /domain: OU on a Windows Server 2003 SP1 (Service Pack 1) domain controller to query the domain for a list of OUs (Organizational Units) where you have permission to create computer objects, you receive one or both of the following:

The requested API is not supported on the remote server

The command failed to complete successfully

Attack surface reduction code in SP1 prevents the above command from working on a domain controller.

To workaround this behavior, run the query on a member server or on a Windows XP domain member.