хочу добавить новый атрибут с помощью ldif скрипта

dn: CN=User-Access-Level,CN=Schema,CN=Configuration,DC=vzdc,DC=com
changetype: add
objectClass: top
objectClass: attributeSchema
cn: User-Access-Level
distinguishedName:
CN=User-Access-Level,CN=Schema,CN=Configuration,DC=vzdc,DC=com
instanceType: 4
attributeID: 1.2.840.113556.1.4.7000.170
attributeSyntax: 2.5.5.10
isSingleValued: TRUE
showInAdvancedViewOnly: TRUE
adminDisplayName: User-Access-Level
oMSyntax: 4
lDAPDisplayName: ual
name: User-Access-Level
objectGUID:: UDvX174f4ki38A2UZcCeeA==
schemaIDGUID:: cEYHd51N0hGvLQDAT7liTg==
objectCategory: CN=Attribute-Schema,CN=Schema,CN=Configuration,DC=vzdc,DC=com

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
—

на вин 2003 получаю ошибку

C:\>ldifde -i -f newattr.ldf -v
Connecting to "vzclear.vzdc.com"
Logging in as current user using SSPI
Importing directory from file "newattr.ldf"
Loading entries
1: CN=User-Access-Level,CN=Schema,CN=Configuration,DC=vzdc,DC=com

Add error on line 1: Unwilling To Perform
The server side error is "The modification was not permitted for security reasons."
0 entries modified successfully.
An error has occurred in the program
No log files were written. In order to generate a log file, please
specify the log file path via the -j option.

тот же скрипт и та же команда на вин2000 успешно отрабатывает
подскажите пожалуйста в чем проблема ?