> dsadd user "<UserDN>" -upn <UserUPN> -fn "<UserFirstName>" -ln "<UserLastName>"[RETURN] -display "<UserDisplayName>" -pwd <UserPasswd>

Transcription

1 Creating a User You want to create a user object Open the Active Directory Users and Computers (ADUC) snap-in. 2. If you need to change domains, right-click on "Active Directory Users and Computers" in 3. In the left pane, browse to the parent container of the new user, right-click on it, and select New User. 4. Enter the values for the first name, last name, full name, and user logon name fields as appropriate and click Next. 5. Enter and confirm password, set any of the password flags, and click Next. 6. Click Finish > dsadd user "<UserDN>" -upn <UserUPN> -fn "<UserFirstName>" -ln "<UserLastName>"[RETURN] -display "<UserDisplayName>" -pwd <UserPasswd> Creating a Large Number of Users You want to create a large number of user objects, either for testing purposes or to initially populate Active Directory with your employee, customer, or student user accounts The following examples will create 1,000 users in the rallencorp.com domain under the Bulk OU. The password is set, but no other attributes are configured. You can modify the examples to populate whatever attributes you need > for /L %i in (1,1,1000) do dsadd user cn=user%i,ou=bulk,dc=contoso,dc=com - pwd[return] User%i 1

2 Creating an inetorgperson User You want to create an inetorgperson object, which is the standard LDAP object class to represent users If you need to change domains, right-click on "Active Directory Users and Computers" in 3. In the left pane, browse to the parent container of the new user, right-click on it, and select New InetOrgPerson. 4. Enter first name, last name, and user logon name fields as appropriate and click Next. 5. Enter and confirm the password, set any of the password flags, and click Next. 6. Click Finish. The dsadd command does not support creating inetorgperson objects so we'll use ldifde instead. First, we need to create an LDIF file called create_inetorgperson.ldf with the following contents: dn: <UserDN> changetype: add objectclass: inetorgperson samaccountname: <UserName> useraccountcontrol: 512 Be sure to replace <UserDN> with the distinguished name of the user you want to add and <UserName> with the user's username. Then run the following command: > ldifde -i -f create_inetorgperson.ldf 2

3 Modifying an Attribute for Several Users at Once You want to modify an attribute for several users at once. 1. Open the Active Directory Users and Computers (ADUC) snap-in. 2. If you need to change domains, right-click on "Active Directory Users and Computers" in 3. In the left pane, browse to the parent container of the objects you want to modify. 4. In the right pane, highlight each object you want to modify, right-click and select Properties. 5. Check the box beside the attribute(s) you want to modify and edit the fields for the attributes. 6. Click OK. The following command sets the home directory of all users under a parent container (<ParentDN>) to be on a particular file server (<FileServer>). The user (i.e., $username$) is automatically replaced with the samaccountname for the user. > for /F "usebackq delims=""" %i in (`dsquery user "<ParentDN>" -limit 0 - scope[return] onelevel`) do dsmod user -hmdir "\\<FileServerName>\$username$" %i Moving a User You want to move a user object to a different container or OU If you need to change domains, right-click on "Active Directory Users and Computers" in 3. In the left pane, right-click on the domain and select Find. 3

4 4. Type the name of the user and click Find Now. 5. In the Search Results, right-click on the user and select Move. 6. Browse to the new parent container or OU and click on it. 7. Click OK. > dsmove "<UserDN>" -newparent "<NewParentDN>" Renaming a User You want to rename a user. 2. In the left pane, right-click on the domain and select Find. 3. Type the name of the user and click Find Now. 4. In the Search Results, right-click on the user and select Rename. 5. You can modify the Full Name, Last Name, First Name, Display Name, User Principal Name (logon name), and SAM Account Name (pre-windows 2000). 6. Click OK after you are done. The following command will rename the RDN of the user: > dsmove "<UserDN>" -newname "<NewUserName>" You can modify the UPN (-upn), First Name (-fn), Last Name (-ln), and Display Name (- display) using the dsmod user command. For example, the following command would change the user's UPN and last name: > dsmod user "<UserDN>" -upn "<NewUserUPN>" -ln "<NewUserLastName>" Copying a User 4

5 You want to copy an existing user account, which may be serving as a template, in order to create a new account. 2. In the left pane, browse to the parent container of the template user object. 3. In the right pane, right-click on the user and select Copy. 4. Enter the name information for the new user and click Next. 5. Enter a password, check any options you want enabled, and click Next. 6. Click Finish. Enabling and Disabling a User You want to enable or disable a user. 2. In the left pane, right-click on the domain and select Find. 3. Select the appropriate domain beside In. 4. Type the name of the user beside Name and click Find Now. 5. In the Search Results, right-click on the user and select Enable Account to enable or Disable Account to disable. 6. Click OK. To enable a user, use the following command: > dsmod user <UserDN> -disabled no To disable a user, use the following command: > dsmod user <UserDN> -disabled yes 5

6 Viewing a User's Group Membership You want to view the group membership of a user. 2. In the left pane, right-click on the domain and select Find. 3. Select the appropriate domain beside In. 4. Type the name of the user beside Name and click Find Now. 5. In the Search Results, double-click on the user. 6. Click the Member Of tab. 7. To view all indirect group membership (from nested groups), you'll need to double-click on each group. The following command displays the groups <UserDN> is a member of. Use the -expand switch to list nested group membership as well: > dsget user <UserDN> -memberof [-expand] Changing a User's Primary Group You want to change the primary group of a user. 2. In the left pane, right-click on the domain and select Find. 3. Select the appropriate domain beside In. 4. Type the name of the user beside Name and click Find Now. 5. In the Search Results, double-click on the user. 6. Click the Member Of tab. 7. Click on the name of the group you want to set as the primary group. 8. Click the Set Primary Group button. 9. Click OK. 6

7 Creating a Group You want to create a group. 1. Open the Active Directory Users and Computers (ADUC) snap-in. 2. If you need to change domains, right-click on Active Directory Users and Computers in the left pane, select Connect to Domain, enter the domain name and click OK. 3. In the left pane, browse to the parent container of the new group, right-click on it, and select New Group. 4. Enter the name of the group and select the group scope (global, domain local, or universal) and group type (security or distribution). 5. Click OK In the following example, <GroupDN> should be replaced with the DN of the group to create, <GroupScope> should be l, g, or u for domain local, global, and universal groups, respectively, and -secgroup should be set to yes if the group is a security group or no otherwise. Another recommended option is to set -desc for specifying a group description. > dsadd group "<GroupDN>" -scope <GroupScope> -secgrp yes no -desc "<GroupDesc>" Changing the Scope or Type of a Group You want to change the scope or type of a group. 7

8 2. If you need to change domains, right-click on Active Directory Users and Computers in 3. In the left pane, right-click on the domain and select Find. 4. Enter the name of the group you want to modify and click Find Now. 5. Double-click on the group in the results pane. 6. In the group properties dialog box, select the new scope or type and click OK. The following example changes the group scope for <GroupDN> to <NewScope>, which should be l for domain local group, g for global group, or u for universal group. > dsmod group "<GroupDN>" -scope <NewScope> The following example changes the group type for <GroupDN>. For the -secgrp switch, specify yes to change to a security group or no to make the group a distribution list. > dsmod group "<GroupDN>" -secgrp yes no 8