Understanding DNs, RDNs, and CNs
Distinguished names (DNs) are a kind of path to an object in Active
Directory. Each object in Active Directory has a completely unique
DN. The user James Fine has the DN CN=James Fine,OU=User
Accounts,DC=contoso,DC=com.
You can see what is happening: the DN is a path, starting at the
object and working up to the top level domain in the contoso.com DNS
namespace. CN means common name. You learned
about this property earlier: When you create a user, the Full Name box
is used to create the CN of the user object. As you know, OU means
organizational unit. And DC means
domain component.
The portion of the DN prior to the first OU or container is
called the relative distinguished name, or
RDN. In the case of James Fine, the RDN of the object is
CN=James Fine. Not every RDN is a CN. The DN of the User Accounts OU
is OU=User Accounts,DC=contoso,DC=com. The RDN of the User Accounts OU
is, therefore, OU=User Accounts.
Because the DN of an object must be unique within the directory
service, the RDN of an object must be unique within its container.
That’s why if you hire a second James Fine, and if both user objects
need to be in the same OU, you will have to give that user a different
CN. The same logic applies to files in a folder: you cannot have two
files with identical names in a single folder.
You will encounter DNs regularly as you work with Active
Directory, just as you encounter file paths regularly if you work with
files and folders. It’s very important to be able to read them and
interpret them.
Finding Objects by Using Dsquery
Windows provides command-line utilities that perform
functionality similar to that of user interface tools, such as the
Active Directory Users And Computers snap-in. Many of those commands
begin with the letters DS, so they are often
referred to as the DS commands. DSQuery can locate objects in Active
Directory.
DSQuery, like other DS commands, is well documented. Type
dsquery.exe /? to learn its syntax and
usage.
You use most DS commands by specifying the object type you want
the command to work against. For example, you would type dsquery user to look for a user, whereas
DSQuery computer, DSQuery group, and
DSQuery ou would query for their respective
object types.
If you use the DSQuery objectType command
by itself, it returns the distinguished names of all the objects of
the type specified by objectType in the domain.
To prevent a runaway query, DSQuery limits itself to 100 results. You
can use the -limit switch to specify how many
results you want returned. Use -limit 0 to return
all objects.
Following the objectType specifier, you can
use switches to indicate the criteria for the query. For example, each
object can be located by its name, with the -name
switch. Most objects can be queried based on the description
(-desc). Security principals can be located based
on their pre–Windows 2000 logon name (-samid). To
learn which properties may be queried, use dsquery objecttype /?. For example,
type dsquery user /?.
For example, if you want to locate the user named Tony Krijnen,
you would enter this command: dsquery user -name
“Tony Krijnen”. After the property switch, -name
in this case, you can enter the criteri. Criteria are not case
sensitive.
DSQuery can perform searches using wildcards, such as the
asterisk (*), which represents zero or more characters. The following
command retrieves all users whose names start with
Jam:
dsquery user -name"Jam*"
The DSQuery command returns matching objects with their DNs by default, as you can see in
Figure 10.
If DNs are not the results you would like to see, add the
-o switch to the DSQuery command. You can add
-o samid, for example, to return the results as
pre–Windows 2000 logon names, or -o upn to return
the list as user logon names, also called user principal
names or UPNs.
Finally, you can limit the scope of the search performed by
DSQuery by adding the DN of an OU or container after the
objectType element of the command. For example,
the following command searches for users whose names begin with
Dan, but only in the Admins OU:
dsquery user"ou=Admins,dc=contoso,dc=com" -name "Dan*"
By default, the search includes all sub-OUs of the base. You can
use the -base parameter to limit the search
further—for example, to only the specified OU without its
sub-OUs.
Practice Creating and Locating Objects in Active
Directory
Practice Creating and Locating Objects in Active
Directory
In this practice, you create and then locate objects in
Active Directory. You create OUs, users, groups, and computers,
and then you create a saved query and customize the view of that
saved query. The objects you create in this practice will be used
in other practices in this training kit.
EXERCISE 1 Create Organizational
Units
The default Users and Computers containers are provided to
facilitate the setup of and migration to an Active Directory
domain. It is recommended that you create OUs that reflect your
administrative model and that you use these OUs to create and
manage objects in your directory service. In this exercise, you
create OUs for the example domain, contoso.com. These OUs will be
used in practices and exercises later in this training kit.
-
Log on to SERVER01 as Administrator. -
Open the Active Directory Users And Computers
snap-in. -
Expand the domain node, contoso.com. -
Right-click the domain node, point to New, and then
click Organizational Unit. -
Type the name of the organizational unit: User Accounts. -
Confirm that the Protect Container From Accidental
Deletion check box is selected. -
Click OK. -
Right-click the OU and choose Properties. -
In the Description box, type
Non-administrative user
identities. -
Click OK. -
Repeat steps 2–10 to create the following OUs.
EXERCISE 2 Create
Users
Now that you have created OUs in the contoso.com domain, you
are ready to populate the directory service with objects. In this exercise, you create several users
in two of the OUs you created in Exercise 1, “Create
Organizational Units.” You use a procedure similar to the procedure listed
in the Creating a User Object section. For each user, create a complex, secure
password. Remember the passwords you assign—you will be logging on
as these user accounts in other exercises and practices in this
training kit.
-
Log on to SERVER01 as Administrator and open the
Active Directory Users And Computers
snap-in. -
In the console tree, expand the domain node,
contoso.com, and click the User Accounts OU. -
Right-click the User Accounts OU, point to New, and then
click User.
The New Object – User dialog box appears. -
In First Name, type the user’s first name: Dan. -
In Last Name, type the user’s last name: Holme. -
In User Logon Name, type the user’s logon name: dholme. -
In the User Logon Name (Pre–Windows 2000) text box, type
the pre–Windows 2000 logon name: dholme. -
Click Next. -
Enter an initial password for the user in the Password and
Confirm Password boxes.
The default password policy for an Active Directory domain requires a password of
seven or more characters. Additionally, the password must
contain three of four character types: uppercase (A–Z),
lowercase (a–z), numeric (0–9), and nonalphanumeric (for
example, ! @ # $ %). The password cannot contain any of the
user’s name or logon name attributes.
Many training resources suggest using a generic password
such as P@ssw0rd. You may use a generic password for the
practices in this training kit; however, it is recommended
that you create unique passwords, even in a practice, so that you are using best practices
even in a lab environment. -
Select the User Must Change Password At Next Logon check
box. -
Click Next. -
Review the summary and click Finish. -
Right-click the user object you created and choose
Properties. -
Examine the attributes that can be configured in the
Properties dialog box. Do not change any of the user’s
properties at this time. -
Click OK. -
Repeat steps 3–12 and create the following users in the
User Accounts OU.
-
James Fine -
Barbara Mayer -
Barbara Moreland
-
First name: Barbara -
Last name: Moreland -
Full name: Barbara Moreland -
User logon name: bmoreland -
Pre–Windows 2000 logon name: bmoreland
Remember the password you assign to these users; you
will be logging on as these user accounts in other exercises
and practices in this training kit. -
Repeat steps 3–12 and create a user account for yourself
in the User Accounts OU. For the user logon name, use your
first initial and last name—for example, dholme for Dan Holme.
Create a complex, secure password. -
Repeat steps 3–12 and create an administrative account
for yourself in the Admins OU. This account will be given
administrative privileges in Exercise 5 of this lesson. Create
the user object in the Admins OU rather than in the User
Accounts OU. For the user logon name, use your first initial
and last name, followed by _admin—for
instance, dholme_admin for Dan Holme’s administrative account.
Create a complex, secure password.
EXERCISE 3 Create
Computers
Computer accounts should be created before joining machines
to the domain. In this exercise, you create several computers in
two of the OUs you created in Exercise 1. These computer
objects will be used in practices and exercises
later in this training kit.
-
Log on to SERVER01 as Administrator and open the
Active Directory Users And Computers
snap-in. -
In the console tree, expand the domain node,
contoso.com, and then click the Servers OU. -
Right-click the Servers OU, point to New, and then click
Computer.
The New Object – Computer dialog box appears. -
In the Computer Name box, type the computer’s name:
FILESERVER01.
Your entry automatically populates the Computer Name
(Pre–Windows 2000) box. -
Do not change the name in the Computer Name (Pre–Windows
2000) box. -
Take note of the account specified in the User Or Group
Field text box. Do not change the value at this time. -
Do not select the check box labeled Assign This Computer
Account As A Pre-Windows 2000 Computer. -
Click OK. -
Right-click the computer and choose Properties. -
Examine the properties that are available for a
computer. Do not change any attributes at this time. -
Click OK. -
Repeat steps 3–8 to create computer objects for the following computers: -
Repeat steps 3–8 and create the following computers in
the Clients OU rather than in the Servers OU.
-
DESKTOP101 -
DESKTOP102 -
LAPTOP103
EXERCISE 4 Create
Groups
It is a best practice to manage objects in groups rather than to
manage each object individually. In this exercise, you create
several groups in two of the OUs you created in Exercise 1. These
groups will be used in practices and exercises later in this
training kit.
-
Log on to SERVER01 as Administrator and open the
Active Directory Users And Computers
snap-in. -
In the console tree, expand the domain node,
contoso.com, and then click the Groups OU. -
Right-click the Groups OU, point to New, and then click
Group.
The New Object – Group dialog box appears. -
Type the name of the new group in the Group Name text
box: Finance. -
Do not change the name in the Group Name (Pre–Windows
2000) box. -
Select the Group Type: Security. -
Select the Group Scope: Global. -
Click OK.
Group objects have several properties that are useful to
configure. These can be specified after the object has been
created. -
Right-click the group and choose Properties. -
Examine the properties available for the group. Do not
change any attributes at this time. -
Click OK. -
Repeat steps 3–8 to create the following global security
groups in the Groups OU:
-
Finance Managers -
Sales -
APP_Office 2010
-
Repeat steps 3–8 to create the following global security
groups in the Admins OU rather than in the Groups OU.
-
Help Desk -
Windows Administrators
EXERCISE 5 Add Users and Computers to
Groups
Now that you have created groups, you can add objects as members of the groups. In this exercise,
you add users and computers to groups. Along the way, you gain experience with
the Select dialog box that is used in some procedures to locate
objects in Active Directory.
-
Log on to SERVER01 as Administrator and open the
Active Directory Users And Computers
snap-in. -
Open the properties of your administrative account in
the Admins OU. -
On the Member Of tab, click Add. -
In the Select Groups dialog box, type the name Domain Admins. -
Click OK, and then click OK again to close the account
properties dialog box. -
Open the properties of the Help Desk group in the Admins
OU. -
On the Members tab, click Add. -
In the Select dialog box, type Barb. -
Click Check Names.
The Multiple Names Found box appears. -
Select Barbara Mayer and click OK. -
Click OK to close the Select dialog box. -
Click OK again to close the group properties. -
Open the properties of the APP_Office 2010 group in the
Groups OU. -
On the Members tab, click Add. -
In the Select dialog box, type DESKTOP101. -
Click Check Names.
A Name Not Found dialog box appears, indicating that the
object you specified could not be resolved. -
Click Cancel to close the Name Not Found box. -
In the Select box, click Object Types. -
Select Computers as an object type and click OK. -
Click Check Names. The name resolves now that the Select
box is including computers in its resolution. -
Click OK.
EXERCISE 6 Find Objects in Active
Directory
When you need to find an object in your domain’s directory
service, it is sometimes more efficient to use search
functionality than to click through your OU structure to browse
for the object. In this exercise, you use three interfaces for
locating objects in Active Directory.
-
Log on to SERVER01 and open the Active Directory Users
And Computers snap-in.
Open the Active Directory Users And Computers console,
or a custom console with the snap-in. Do not use Server
Manager, because the Active Directory Users And Computers
snap-in in Server Manager does not support Saved
Queries. -
Click the Find Objects In Active Directory Domain
Services toolbar button. -
Make sure the In drop-down list is set to contoso.com
(the domain name). -
In the Name box, type Barb. -
Click Find Now. -
The two users named Barbara appear in the Search
results. -
Close the Find box. -
In the Active Directory Users And Computers snap-in,
right-click the Saved Queries node, point to New, and then
then click Query. -
In the Name box, type All
Users. -
In the Description box, type Users
for the entire domain. -
Click Define Query. -
On the Users tab, in the Name box, choose Has A
Value. -
Click OK twice to close the dialog boxes.
The results of the saved query appear. Note that it
shows the users from both the User Accounts OU and the Admins
OU, as well as built-in accounts from the Users
container. -
On the View menu, click Add/Remove Columns. -
In the Available columns list, select Last Name and
click Add. -
In the Displayed columns list, select Type and click
Remove. -
Click OK. -
Drag the Last Name column heading so that it is between
Name and Description. -
Click the Last Name column heading so that users are
sorted alphabetically by last name.
|
