Maintain Active Directory Accounts

IT Certification

The most important task that network administrators need to perform is the management of Active Directory users, computers, and groups. A properly configured system ensures that only properly authenticated users and computers can logon to the network and access the resource. Windows Server 2008 provides many tools such as Server Manager and Active Directory Users and Computers to manage AD accounts.

The Active Directory Users and Computers snap-in allows you to create, modify, and delete AD objects which are nested inside Organizational Units. The Active Directory should be designed considering the security in mind. You may have separate OUs for each department that has different policies or different department with same kind of policies can be a part of just one OU.

AD objects in Server 2008 have meaningful names and include a Description column that tells you what each default object does. Each object is made up of a group of properties, which describe the object and what it can do. The properties windows of the object can be viewed by right-clicking the object and selecting Properties from the menu that appears. The most important objects of AD are Computers, Users and Groups.

The Computer object allows you to find out the computers on the network and the rights that each computer has on the network. It contains domain controllers, member servers, and workstations. However, the domain controllers are found in the Domain Controllers container. Member servers and workstations appear in the Computers container. Properties window of a computer object allows you to manage the computer object. The User object describes about the users of your organization. The properties window of each user allows you to configure the properties of the user.

There are different types of group objects in the Active Directory. For example, the security distribution group, which allows you to manage access rights for multiple users all at once. The other kind of group is the distribution group that is used solely for email distribution. Most of the maintenance tasks are performed with Active Directory Users and Computers. Some of the common tasks that you can perform with Active Directory Users and Computers include:

When you automate the creation of AD accounts, you need to create a user account template and then each time you need to create a user, you can copy the template and add the user details. The new account will be created will all the template details.

To create a user account template:
  1. Create two OUs Staff and Group and create a Marketing group in the Group OU (for this example).
  2. Click Start->Settings->Control Panel->Administrative tools->Active Directory Users and Computers.
  3. Expand the domain tree and right-click the Staff OU.
  4. Select New->User from the menu that appears, as shown in Figure 5-1.
    Figure 5-1

    The New Object –User dialog box appears, as shown in Figure 5-2.

  5. Type the template name prefixed with underscore (“_”) in the First name and then type Template in the Last name field . The underscore ensures that the template appears at the top of the list of users.
  6. Provide the user logon name prefixed with underscore and click Next.
    Figure 5-2

    The second page of the New Object –User wizard appears.

  7. Type a password in the Password field and then confirm the password by retyping the password in Confirm password field.
  8. Select Account is disabled option and then click Next and on the next page click Finish.

    The template is now ready and you can see the template appearing in the Staff OU. You can now set the other properties in the template that you want to be set in all the users that are created using this template.

  9. Double-click the template to open the properties window of the template as shown in Figure.
  10. Click Organization tab and then set the Department and the Company fields with desired values. For this example set Marketing in the Department field and Inscription in the Company field, as shown in Figure 5-3.
    Figure 5-3
  11. Click Member Of tab and then add the Marketing group to the list by clicking the Add button, as shown in Figure 5-4.
    Figure 5-4
  12. Click the Profile tab and then type the \\
    \profiles\%username% in the Profile path field, where
    is the name of your server, as shown in Figure 5-5:

    Figure 5-5
  13. Click OK to save the properties set.

You can now right-click the template and select Copy from the menu that appears to open the Copy Object –User dialog box, as shown in Figure 5-6. The dialog box allows you to create a new user with the same properties that you have set in the template. You just need to follow the initial steps that you follow in the New Object –User wizard to create a user.

Figure 5-6

Besides creating the multiple users using a template, you can also automate the task of creating users by using command line tools such as the Dsadd command and import the users from a text file using CSVDE and LDIFE commands.

To add user called Jim using Dsadd, you need to type the following command at the command prompt:

dsadd user cn=Jim,cn=users,dc=MyDomain,dc=com -disabled no

CSVDE and LDIFDE commands can be used for the bulk export and import of Active Directory objects. CSVDE allows exporting of virtually any object or attribute from the AD database whereas LDIFDE.exe exports the data into LDIF-based (LDAP Data Interchange Format) files. Another difference is that LDIFDE is primarily used to modify or delete Active Directory Objects.

Type the following command to the command prompt to import directory objects:

csvde -i -f filename -s servername:port -m -a username domain password

Type the following command to the command prompt to export directory objects:

csvde -e -f filename -s servername:port -m a username domain password

You can also use CSVDE to import users from a text file. Consider you have a text file called newusers that has values:

DN,objectClass,sAMAccountName,sn.givenName,userPrincipalName “cn=Michel.Crisp,ou=People,dc=inscription,dc=com”,user,michel.crisp,Michel,Crisp,mi “cn=Ben.Jhonson,ou=People,dc=inscription,dc=com”,user,ben.jhonson,Ben,Jhonson,ben.

You can now type the following command to import user records from the newuser.txt

Csvde –I –f newusers.txt –k

The LDIFDE.EXE does not want a typical delimited file. To create a .ldf file from which you can import user records, you need to save the text file with .ldf extension. The values in the .ldf files can be written as:

DN cn=ben jhonson, OU=people, dc=inscription,dc=com changeType: add CN: Ben Jhonson objectClass: user sAMAccountName: ben.jhonson userPrincipalName: ben.jhonson& givenName: Ben sn: Jhonson displayName:Jhonson, Ben mail: description: Sales representatives title: Sales representatives department: sales company: inscription, ltd

You can now type the following command to import user records from the newuser.ldf

Ldifde –I –f newusers.ldf -k