Active Directory Users and Computers

Active Directory Users and Computers is a Microsoft Management Console (MMC) snap-in that you can use to administer and publish information in the directory.

  • Managing Users

  • Managing Groups

  • Managing Computers

  • Managing Domains

  • Managing Organizational Units

  • Troubleshooting Active Directory Users and Computers

  • Resources for Active Directory Users and Computers

  • User Interface: Active Directory Users and Computers


Managing Users

You can use Active Directory Users and Computers to create new user accounts or manage existing user accounts.

  • Understanding User Accounts

  • Create a New User Account

  • Reset a User Password

  • Copy a User Account

  • Move a User Account

  • Set Logon Hours

  • Disable or Enable a User Account

  • Map a Certificate to a User Account

  • Change a User's Primary Group

  • Delete a User Account


Understanding User Accounts

Active Directory user accounts represent physical entities, such as people. You can also use user accounts as dedicated service accounts for some applications.

User accounts are also referred to as security principals. Security principals are directory objects that are automatically assigned security identifiers (SIDs), which can be used to access domain resources. A user account primarily:

  • Authenticates the identity of a user.

    A user account enables a user to log on to computers and domains with an identity that the domain can authenticate. Each user who logs on to the network should have his or her own unique user account and password. To maximize security, avoid having multiple users sharing one account.

  • Authorizes or denies access to domain resources.

    After a user is authenticated, the user is authorized or denied access to domain resources based on the explicit permissions that are assigned to that user on the resource.

User accounts

The Users container in Active Directory Users and Computers displays the three built-in user accounts: Administrator, Guest, and HelpAssistant. These built-in user accounts are created automatically when you create the domain.

Each built-in account has a different combination of rights and permissions. The Administrator account has the most extensive rights and permissions over the domain, while the Guest account has limited rights and permissions. The following table describes each default user account on domain controllers running the Windows Server® 2008 operating system.

Default user account Description

Administrator

The Administrator account has full control of the domain. It can assign user rights and access control permissions to domain users as necessary. Use this account only for tasks that require administrative credentials. We recommend that you set up this account with a strong password.

The Administrator account is a default member of the following Active Directory groups: Administrators, Domain Admins, Enterprise Admins, Group Policy Creator Owners, and Schema Admins. The Administrator account can never be deleted or removed from the Administrators group, but it can be renamed or disabled. Because the Administrator account is known to exist on many versions of Windows, renaming or disabling this account will make it more difficult for malicious users to try to gain access to it.

The Administrator account is the first account that is created when you set up a new domain with the Active Directory Domain Services Installation Wizard.

Important

When the Administrator account is disabled, it can still be used to gain access to a domain controller with Safe Mode.

Guest

People who do not have an actual account in the domain can use the Guest account. A user whose account is disabled (but not deleted) can also use the Guest account. The Guest account does not require a password.

You can set rights and permissions for the Guest account just like any user account. By default, the Guest account is a member of the built-in Guests group and the Domain Guests global group, which allows a user to log on to a domain. The Guest account is disabled by default, and we recommend that it stay disabled.

HelpAssistant (installed with a Remote Assistance session)

The primary account for establishing a Remote Assistance session. This account is created automatically when you request a Remote Assistance session. It has limited access to the computer. The HelpAssistant account is managed by the Remote Desktop Help Session Manager service. This account is automatically deleted if no Remote Assistance requests are pending.

Securing user accounts

If built-in account rights and permissions are not modified or disabled by a network administrator, they can be used by a malicious user (or service) to illegally log on to a domain using the Administrator account or Guest account. A good security practice for protecting these accounts is to rename or disable them. Because it retains its SID, a renamed user account retains all its other properties, such as its description, password, group memberships, user profile, account information, and any assigned permissions and user rights.

To obtain the security advantages of user authentication and authorization, use Active Directory Users and Computers to create an individual user account for each user who will participate in your network. You can then add each user account (including the Administrator account and Guest account) to a group to control the rights and permissions that are assigned to the account. When you have accounts and groups that are appropriate for your network, you ensure that you can identify users that log on to your network and that they have access only to the permitted resources.

You can help defend your domain from attackers by requiring strong passwords and implementing an account lockout policy. Strong passwords reduce the risk of intelligent password guessing and dictionary attacks on passwords. An account lockout policy decreases the possibility of an attacker compromising your domain through repeated logon attempts. An account lockout policy determines how many failed logon attempts a user account can have before it is disabled.

Account options

Each Active Directory user account has a number of account options that determine how someone logging on with that particular user account is authenticated on the network. You can use the options in the following table to configure password settings and security-specific information for user accounts.

Account option Description

User must change password at next logon

Forces a user to change his or her password the next time that the user logs on to the network. Enable this option when you want to ensure that the user will be the only person that knows the password.

User cannot change password

Prevents a user from changing his or her password. Enable this option when you want to maintain control over a user account, such as a Guest account or temporary account.

Password never expires

Prevents a user password from expiring. We recommend that service accounts have this option enabled and use strong passwords.

Store passwords using reversible encryption

Allows a user to log on to a Windows network from Apple computers. If a user is not logging on from an Apple computer, do not enable this option.

Account is disabled

Prevents a user from logging on with the selected account. Many administrators use disabled accounts as templates for common user accounts.

Smart card is required for interactive logon

Requires that a user possess a smart card to log on to the network interactively. The user must also have a smart card reader attached to their computer and a valid personal identification number (PIN) for the smart card. When this option is enabled, the password for the user account is automatically set to a random and complex value and the Password never expires account option is set.

Account is trusted for delegation

Allows a service running under this account to perform operations on behalf of other user accounts on the network. A service running under a user account (otherwise known as a service account) that is trusted for delegation can impersonate a client to gain access to resources on the computer where the service is running or to resources on other computers. In a forest that is set to the Windows Server 2008 functional level, this option is on the Delegation tab. It is available only for accounts that have been assigned service principal names (SPNs), as set with the Windows Server 2008 setspn command. (open a command window, and then type setspn). This is a security-sensitive capability; assign it cautiously.

This option is available only on domain controllers running Windows Server 2008 where the domain functionality is set to Windows 2000 mixed or Windows 2000 native. On domain controllers running Windows Server 2008 where the domain functional level is set to the Windows Server 2008 forest functional Level, use the Delegation tab in the user properties dialog box to configure delegation settings. The Delegation tab appears only for accounts that have an assigned SPN.

Account is sensitive and cannot be delegated

You can use this option if the account, for example a Guest or temporary account, cannot be assigned for delegation by another account.

Use DES encryption types for this account

Provides support for the Data Encryption Standard (DES). DES supports multiple levels of encryption, including Microsoft Point-to-Point Encryption (MPPE) Standard (40-bit), MPPE Standard (56-bit), MPPE Strong (128-bit), Internet Protocol security (IPsec) DES (40-bit), IPsec 56-bit DES, and IPsec Triple DES (3DES

Do not require Kerberos preauthentication

Provides support for alternative implementations of the Kerberos protocol. However, use caution when you enable this option, because Kerberos preauthentication provides additional security and requires time synchronization between the client and the server.

InetOrgPerson accounts

Active Directory Domain Services (AD DS) provides support for the InetOrgPerson object class and its associated attributes as defined in Request for Comments (RFC) 2798. The InetOrgPerson object class is used in several non-Microsoft, Lightweight Directory Access Protocol (LDAP) and X.500 directory services to represent people in an organization.

Support for InetOrgPerson makes migration from other LDAP directories to AD DSmore efficient. The InetOrgPerson object is derived from the user class. It can function as a security principal just like the user class. For information about creating an inetOrgPerson user account, see Create a New User Account.

When the domain functional level is set to the Windows Server 2008, you can set the userPassword attribute on InetOrgPerson and user objects as being the effective password, just as you can with the unicodePwd attribute.


Create a New User Account

To manage domain users, create user accounts in Active Directory Domain Services (AD DS). In contrast, to manage users that are specific to one computer, create local user accounts. For more information, see Create a local user account (http://go.microsoft.com/fwlink/?LinkID=58123).

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Creating a new user account

  • Using the Windows interface

  • Using a command line

To create a new user account using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, right-click the folder in which you want to add a user account.

    Where?

    • Active Directory Users and Computers/domain node/folder

  3. Point to New, and then click User.

    For interoperability with other directory services, you can click InetOrgPerson instead. For more information about InetOrgPerson, see Understanding User Accounts.

  4. In First name, type the user's first name.

  5. In Initials, type the user's initials.

  6. In Last name, type the user's last name.

  7. Modify Full name to add initials or reverse the order of first and last names.

  8. In User logon name, type the user logon name, click the user principal name (UPN) suffix in the drop-down list, and then click Next.

    If the user will use a different name to log on to computers running Microsoft® Windows® 95, Windows 98, or Windows NT® operating systems, you can change the user logon name as it appears in User logon name (pre-Windows 2000) to the different name.

  9. In Password and Confirm password, type the user's password, and then select the appropriate password options.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • A new user account with the same name as a previously deleted user account does not automatically assume the permissions and group memberships of the previously deleted account because the security identifier (SID) for each account is unique. If you want to duplicate a deleted user account, you must recreate all permissions and memberships manually.

  • When you create a new user account, the full name attribute is created in the FirstNameLastName format by default. The full name attribute also governs the display name format that is shown in the global address list. You can change the display name format by using ADSI Edit. If you change the display name format, the full name format will also change. For more information, see article 250455 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=4441).

Additional references

  • Managing Users

To create a new user account using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsadd user <UserDN> [-samid<SAMName>] -pwd {<Password>|*}

Parameter | Description
<UserDN> | Specifies the distinguished name of the user object to be added.
-samid | Sets <SAMName> value.
<SAMName> | Specifies the Security Accounts Manager (SAM) name as the unique SAM account name for this user (for example, Linda). If the SAM name is not specified, dsadd attempts to create the SAM account name using up to the first 20 characters from the common name (CN) value of UserDN.
-pwd | Sets <Password> value.
<Password> | Specifies the password to be used for the user account. If this parameter is set to *, you are prompted for a user password.

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsadd user /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • A new user account with the same name as a previously deleted user account does not automatically assume the permissions and group memberships of the previously deleted account because the security SID for each account is unique. If you want to duplicate a deleted user account, you must recreate all permissions and memberships manually.

Additional references

  • Managing Users


Reset a User Password

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Creating a new user account

  • Using the Windows interface

  • Using a command line

To reset a user password using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click Users.

    Where?

    • Active Directory Users and Computers/domain node/Users

    Or, click the folder that contains the user account.

  3. In the details pane, right-click the user whose password you want to reset, and then click Reset Password.

  4. Type and then confirm the password.

  5. If you want to require the user to change this password at the next logon process, select the User must change password at next logon check box.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • Services that are authenticated with a user account must be reset if the password for the service's user account is changed.

Additional references

  • Managing Users

To reset a user password by using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsmod user <UserDN> -pwd <NewPassword> -mustchpwd {yes|no}

Parameter | Description
<UserDN> | Specifies the distinguished name of the user for which the password will be reset.
-pwd | Sets the <NewPassword>.
<NewPassword> | Specifies the password that will replace the current user password.
-mustchpwd | Sets the pwdExpired flag.
{yes|no} | Specifies the value of the pwdExpired flag.

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsmod user /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • If a password is not assigned, the first time that the user tries to log on (using a blank password), a logon message appears that says "You are required to change your password at first logon." After the user changes the password, the logon process continues.

  • Services that are authenticated with a user account must be reset if the password for the service's user account is changed.

Additional references

  • Managing Users


Copy a User Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To copy a user account

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click Users.

    Where?

    • Active Directory Users and Computers/domain node/Users

  3. In the details pane, right-click the user account that you want to copy, and then click Copy.

  4. In First name, type the user's first name.

  5. In Last name, type the user's last name.

  6. Modify Full name to add initials or reverse the order of the first and last names.

  7. In User logon name, type the user logon name, click the user principal name (UPN) suffix in the drop-down list, and then click Next.

    If the user will use a different name to log on to computers running Windows 95, Windows 98, or Windows NT, you can change the user logon name as it appears in User logon name (pre-Windows 2000) to the different name.

  8. In Password and Confirm password, type the user's password, and then select the appropriate password options.

    If the user account from which the new user account was copied was disabled, click Account is disabled to enable the new account.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • After you create the user account, you can edit the user account properties to enter additional user account information.

  • Only the most commonly used attributes, such as logon hours, workstation restrictions, and account expiration restrictions are transferred to the copied user by default.

  • You can modify which default attributes are carried over to a newly copied user or specify additional attributes that will be copied to the new user. To do this, open the Active Directory Schema snap-in, view the desired attribute properties, and select (or clear) the Attribute is copied when duplicating user check box. You can modify or add only the attributes that are instances of the user class.

    If the Active Directory Schema snap-in is not installed, you can install it. For more information, click Start, click Help and Support, and then search for the topic "Active Directory Schema" which contains information about how to install, secure, and view the Active Directory Schema snap-in.

Additional references

  • Managing Users


Move a User Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Moving a user account

  • Using the Windows interface

  • Using a command line

To move a user account using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click Users.

    Where?

    • Active Directory Users and Computers/domain node/Users

    Or, click the folder that contains the user account.

  3. In the details pane, right-click the user that you want to move, and then click Move.

  4. In the Move dialog box, click the folder to which you want to move the user account.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

You cannot use Active Directory Users and Computers to move user accounts between domains. To move a user account between domains, use the Active Directory Migration Tool (ADMT), one of the Active Directory support tools. For more information, see ADMT v3 Migration Guide (http://go.microsoft.com/fwlink/?LinkId=82740).

Additional references

  • Managing Users

To move a user account using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsmove <UserDN> [-newparent<ParentDN>]

Parameter | Description
<UserDN> | Specifies the distinguished name of the user object to be added.
-newparent | Sets the <ParentDN> value.
<ParentDN> | Specifies the new location to which you want to move the user object. The new location is specified as the distinguished name of the new parent node.

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following, and then press ENTER:

dsmove /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Managing Users


Set Logon Hours

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To set logon hours using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click Users.

    Where?

    • Active Directory Users and Computers/domain node/Users

  3. Right-click the user account, and then click Properties.

  4. On the Account tab, click Logon Hours, and then set the permitted or denied logon hours for the user.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • To modify the logon hours for multiple users, press and hold down CTRL, and then click each user. Right-click the selected users, and then click Properties. On the Account tab, click Logon Hours, and then set the permitted or denied logon hours for the user.

Additional references

  • Managing Users


Disable or Enable a User Account

  • To prevent a particular user from logging on for security reasons, you can disable user accounts rather than deleting them.

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Disabling or enabling a user account

  • Using the Windows interface

  • Using a command line

To disable or enable a user account using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click Users.

    Where?

    • Active Directory Users and Computers/domain node/Users

    Or, click the folder that contains the user account.

  3. In the details pane, right-click the user.

  4. Depending on the status of the account, do one of the following:

    • To disable the account, click Disable Account.

    • To enable the account, click Enable Account.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • By creating disabled user accounts with common group memberships, you can use disabled user accounts as account templates to simplify user account creation.

Additional references

  • Managing Users

To disable or enable a user account using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsmod user <UserDN> -disabled {yes|no}

Parameter | Description
<UserDN> | Specifies the distinguished name of the user object to be added.
-disabled | Sets the value of UF_ACCTDISABLED in userAccountControl.
{yes|no} | Specifies whether the user account is disabled for logon (yes) or not (no).

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsmod user /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • By creating disabled user accounts with common group memberships, you can use disabled user accounts as account templates to simplify user account creation.

Additional references

  • Managing Users


Map a Certificate to a User Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To map a certificate to a user account

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. On the View menu, select Advanced Features.

  3. In the console tree, click Users.

    Where?

    • Active Directory Users and Computers/domain node/Users

    Or, click the folder that contains the user account.

  4. In the details pane, right-click the user to which you want to map a certificate, and then click Name Mappings.

  5. In the Security Identity Mapping dialog box, on the X.509 Certificates tab, click Add.

  6. Type the name and path of the .cer file that contains the certificate that you want to map to this user account, and then click Open.

  7. Do one of the following:

    • To map the certificate to one account (one-to-one mapping), confirm that both the Use Issuer for alternate security identity check box and the Use Subject for alternate security identity check box are selected.

    • To map any certificate that has the same subject to the user account, regardless of the issuer of the certificate (many-to-one mapping), clear the Use Issuer for alternate security identity check box, and confirm that the Use Subject for alternate security identity check box is selected.

    • To map any certificate that has the same issuer to the user account, regardless of the subject of the certificate (many-to-one mapping), clear the Use Subject for alternate security identity check box, and confirm that the Use Issuer for alternate security identity check box is selected.

Additional considerations

  • To perform this procedure, you must be a member of either the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • The certificate that you are mapping to a user account must be in Distinguished Encoding Rules (DER) or Base64 encoded binary format.

  • Another way to bring up Security Identity Mapping dialog box is to right-click a user account, and then click Name Mappings.

Additional references

  • Managing Users


Change a User's Primary Group

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To change a user's primary group

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click Users.

    Where?

    • Active Directory Users and Computers/domain node/Users

    Or, click the folder that contains the user account.

  3. In the details pane, right-click the user that you want to change, and then click Properties.

  4. On the Member Of tab, click the group that you want to set as the user's primary group, and then click Set Primary Group.

Additional considerations

  • To perform this procedure, you must be a member of either the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • The user's primary group applies only to users who log on to the network through Services for Macintosh or who run Portable Operating System Interface for UNIX (POSIX)–compliant applications. Unless you are using these services, there is no need to change the primary group from Domain Users, which is the default value.

  • Setting the user's primary group membership to a value other than Domain Users may adversely affect performance because all users in the domain are members of Domain Users. If the user's primary group is set to another group, it may cause the group membership to exceed the supported maximum number of members.

Additional references

  • Managing Users


Delete a User Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Deleting a user account

  • Using the Windows interface

  • Using a command line

To delete a user account using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click Users.

    Where?

    • Active Directory Users and Computers/domain node/Users

    Or, click the folder that contains the user account.

  3. In the details pane, right-click the user account, and then click Delete.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • After a user account has been deleted, all permissions and memberships that are associated with that user account are permanently deleted. Because the security identifier (SID) for each account is unique, a new user account with the same name as a previously deleted user account does not automatically assume the permissions and memberships of the previously deleted account. If you want to duplicate a deleted user account, you must recreate all permissions and memberships manually.

Additional references

  • Managing Users

To delete a user account using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsrm <ObjectDN>

Parameter | Description
<ObjectDN> | Specifies the distinguished name of the user object to be deleted.

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsrm /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • After a user account has been deleted, all permissions and memberships that are associated with that user account are permanently deleted. Because the SID for each account is unique, a new user account with the same name as a previously deleted user account does not automatically assume the permissions and memberships of the previously deleted account. If you want to duplicate a deleted user account, you must recreate all permissions and memberships manually.

Additional references

  • Managing Users


Managing Groups

You can use Active Directory Users and Computers to create new groups or manage existing groups.

  • Understanding Group Accounts

  • Create a New Group

  • Add a Member to a Group

  • Convert a Group to Another Type

  • Change Group Scope

  • Delete a Group

  • Find Groups in Which a User is a Member

  • Assign User Rights to a Group in AD DS


Understanding Group Accounts

A group is a collection of user and computer accounts, contacts, and other groups that can be managed as a single unit. Users and computers that belong to a particular group are referred to as group members.

Groups in Active Directory Domain Services (AD DS) are directory objects that reside in a domain and in organizational unit (OU) container objects. AD DS provides a set of default groups at installation. It also provides an option to create groups.

You can use groups in AD DS to:

  • Simplify administration by assigning permissions on a shared resource to a group, rather than to individual users. Assigning permissions to a group assigns the same access to the resource to all members of that group.

  • Delegate administration by assigning user rights once to a group through Group Policy. You can then add members to the group that you want to have the same rights as the group.

  • Create e-mail distribution lists.

Groups are characterized by their scope and their type. The scope of a group determines the extent to which the group is applied within a domain or forest. The group type determines whether you can use a group to assign permissions from a shared resource (for security groups) or use a group for e-mail distribution lists only (for distribution groups).

There are also groups for which you cannot modify or view the memberships. These groups are referred to as special identities. They represent different users at different times, depending on the circumstances. For example, the Everyone group is a special identity that represents all current network users, including guests and users from other domains.

The following sections provide additional information about group accounts in AD DS.

Understanding default groups

Default groups, such as the Domain Admins group, are security groups that are created automatically when you create an Active Directory domain. You can use these predefined groups to help control access to shared resources and delegate specific domain-wide administrative roles.

Many default groups are automatically assigned a set of user rights that authorize members of the group to perform specific actions in a domain, such as logging on to a local system or backing up files and folders. For example, a member of the Backup Operators group has the right to perform backup operations for all domain controllers in the domain.

When you add a user to a group, the user receives the following:

  • All the user rights that are assigned to the group

  • All the permissions that are assigned to the group on any shared resources

Default groups are located in the Builtin container and the Users container. The default groups in the Builtin container have a group scope of Builtin Local. Their group scope and group type cannot be changed. The Users container contains groups that are defined with global scope and groups that are defined with domain local scope. You can move groups that are located in these containers to other groups or OUs within the domain, but you cannot move them to other domains.

For more information about default groups, see the Active Directory Domain Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=88626).

Understanding group scope

Groups are characterized by a scope that identifies the extent to which the group is applied in the domain tree or forest. There are three group scopes: domain local, global, and universal.

Understanding domain local groups

Members of domain local groups can include other groups and accounts from Windows Server 2003, Windows 2000, Windows NT, and Windows Server 2008 domains. Members of these groups can be assigned permissions only within a domain.

Groups with domain local scope help you define and manage access to resources within a single domain. These groups can have the following as their members:

  • Groups with global scope

  • Groups with universal scope

  • Accounts

  • Other groups with domain local scope

  • A mixture of any of the above

For example, to give five users access to a particular printer, you can add all five user accounts in the printer permissions list. If, however, you later want to give the five users access to a new printer, you again have to specify all five accounts in the permissions list for the new printer.

With a little planning, you can simplify this routine administrative task by creating a group with domain local scope and assigning it permission to access the printer. Put the five user accounts in a group with global scope and add this group to the group that has domain local scope. When you want to give the five users access to a new printer, assign the group with domain local scope permission to access the new printer. All members of the group with global scope automatically receive access to the new printer.

Understanding global groups

Members of global groups can include other groups and accounts only from the domain in which the group is defined. Members of these groups can be assigned permissions in any domain in the forest.

Use groups with global scope to manage directory objects that require daily maintenance, such as user and computer accounts. Because groups with global scope are not replicated outside their own domain, you can change accounts in a group having global scope frequently without generating replication traffic to the global catalog.

Although rights and permissions assignments are valid only within the domain in which they are assigned, by applying groups with global scope uniformly across the appropriate domains, you can consolidate references to accounts with similar purposes. This simplifies and rationalizes group management across domains. For example, in a network with two domains, Europe and UnitedStates, if there is a group with global scope called GLAccounting in the UnitedStates domain, there should also be a group called GLAccounting in the Europe domain (unless the accounting function does not exist in the Europe domain).

Important

We strongly recommend that you use global groups or universal groups instead of domain local groups when you specify permissions on domain directory objects that are replicated to the global catalog.

Understanding universal groups

Members of universal groups can include other groups and accounts from any domain in the domain tree or forest. Members of these groups can be assigned permissions in any domain in the domain tree or forest.

Use groups with universal scope to consolidate groups that span domains. To do this, add the accounts to groups with global scope and nest these groups within groups having universal scope. When you use this strategy, any membership changes in the groups that have global scope do not affect the groups with universal scope.

For example, in a network with two domains, Europe and UnitedStates, and a group that has global scope called GLAccounting in each domain, create a group with universal scope called UAccounting that has as its members the two GLAccounting groups, UnitedStates\GLAccounting and Europe\GLAccounting. You can then use the UAccounting group anywhere in the enterprise. Any changes in the membership of the individual GLAccounting groups will not cause replication of the UAccounting group.

Do not change the membership of a group with universal scope frequently. Any changes to the membership of this type of group cause the entire membership of the group to be replicated to every global catalog in the forest.

Understanding group types

There are two types of groups in AD DS: distribution groups and security groups. You can use distribution groups to create e-mail distribution lists and security groups to assign permissions to shared resources.

You can use distribution groups only with e-mail applications (such as Microsoft Exchange Server 2007) to send e-mail to collections of users. Distribution groups are not security enabled, which means that they cannot be listed in discretionary access control lists (DACLs). If you need a group for controlling access to shared resources, create a security group.

When they are used with care, security groups provide an efficient way to assign access to resources on your network. By using security groups, you can:

  • Assign user rights to security groups in AD DS.

    User rights are assigned to a security group to determine what members of that group can do within the scope of a domain (or forest). User rights are automatically assigned to some security groups at the time that AD DS is installed to help administrators define a person's administrative role in the domain. For example, a user who is added to the Backup Operators group in Active Directory has the ability to back up and restore files and directories on each domain controller in the domain.

  • Assign permissions to security groups on resources.

    Permissions are different from user rights. Permissions determine who can access a shared resource, and they determine the level of access, such as Full Control. You can use security groups to manage access and permissions to a shared resource. Some permissions that are set on domain objects are automatically assigned to allow various levels of access to default security groups, such as the Account Operators group or the Domain Admins group.

Like distribution groups, security groups can also be used as e-mail entities. Sending an e-mail message to the group sends the message to all the members of the group.

Special identities

In addition to the groups in the Users container and Builtin container, servers running Windows Server 2008 or Windows Server 2003 include several special identities. For convenience, these identities are generally referred to as groups. These special groups do not have specific memberships that can be modified. However, they can represent different users at different times, depending on the circumstances. The following groups represent special identities:

  • Anonymous Logon

    This group represents users and services that access a computer and its resources through the network without using an account name, password, or domain name. On computers running Windows NT and earlier, the Anonymous Logon group is a default member of the Everyone group. On computers running Windows Server 2008 or Windows Server 2003, the Anonymous Logon group is not a member of the Everyone group by default.

  • Everyone

    This group represents all current network users, including guests and users from other domains. Whenever a user logs on to the network, the user is added automatically to the Everyone group.

  • Network

    This group represents users who are currently accessing a given resource over the network, as opposed to users who access a resource by logging on locally at the computer where the resource is located. Whenever a user accesses a given resource over the network, the user is added automatically to the Network group.

  • Interactive

    This group represents all users who are currently logged on to a particular computer and who are accessing a given resource that is located on that computer, as opposed to users who access the resource over the network. Whenever a user accesses a given resource on the computer to which they are currently logged on, the user is added automatically to the Interactive group.

Although the special identities can be assigned rights and permissions to resources, the memberships cannot be modified or viewed. Group scopes do not apply to special identities. Users are assigned automatically to these special identities whenever they log on or access a particular resource.

Understanding where groups can be created

In AD DS, groups are created in domains. You use Active Directory Users and Computers to create groups. With the necessary permissions, you can create groups in the root domain of the forest, in any other domain in the forest, or in an OU.

Besides the domain in which it is created, a group is also characterized by its scope. The scope of a group determines the following:

  • The domain from which members can be added

  • The domain in which the rights and permissions that are assigned to the group are valid

Choose the particular domain or OU where you create a group based on the administration that is required for the group. For example, if your directory has multiple OUs, each of which has a different administrator, you may want to create groups with global scope within those OUs so that the administrators can manage group membership for users in their respective OUs. If groups are required for access control outside the OU, you can nest the groups in the OU into groups with universal scope (or other groups with global scope) that you can use elsewhere in the forest.

If the domain functional level is set to Windows 2000 native or higher, the domain contains a hierarchy of OUs, and administration is delegated to administrators at each OU, it may be more efficient to nest groups with global scope. For example, if OU1 contains OU2 and OU3, a group with global scope in OU1 can have as its members groups with global scope in OU2 and OU3. In OU1, the administrator can add or remove group members from OU1, and the administrators of OU2 and OU3 can add or remove group members for accounts from their own OUs without having administrative rights for the group with global scope in OU1.

Note

You can move groups within a domain. However, only groups with universal scope can be moved from one domain to another. The rights and permissions that are assigned to a group with universal scope are lost when the group is moved to another domain, and new assignments must be made.


Create a New Group

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Creating a new group account

  • Using the Windows interface

  • Using a command line

To create a new group account using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, right-click the folder under which you want to create a new group.

    Where?

    • Active Directory Users and Computers/domain node/folder

  3. Point to New, and then click Group.

  4. Type the name of the new group.

    By default, the name that you type is also entered as the pre–Windows 2000 name of the new group.

  5. In Group scope, click one of the options.

    For more information, see the section "Understanding group scope" in Understanding Group Accounts.

  6. In Group type, click one of the options.

    For more information, see the section "Understanding group types" in Understanding Group Accounts.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • To add a group, you can also click the folder in which you want to add the group, and then click the new group icon on the toolbar.

  • If the domain in which you are creating the group is set to the domain functional level of Windows 2000 mixed, you can select only the Security group type with Domain local or Global scopes.

Additional references

  • Managing Groups

To create a new group account using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsadd group <GroupDN> -samid<SAMName> -secgrp {yes|no} -scope {l|g|u}

Parameter | Description
<GroupDN> | Specifies the distinguished name of the group object to be added.
-samid | Sets the <SAMName> value.
<SAMName> | Specifies the Security Accounts Manager (SAM) name as the unique SAM account name for the group (for example, Operators).
-secgrp | Sets the value for the group type.
{yes|no} | Specifies whether the group that you want to add is a security group (yes) or a distribution group (no).
-scope | Sets the value for the group scope.
{l|g|u} | Specifies whether the scope of the group that you want to add is domain local (l), global (g), or universal (u).

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsadd group /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • If the domain in which you are creating the group is set to the domain functional level of Windows 2000 mixed, you can select only the Security group type with Domain local or Global scopes.

Additional references

  • Managing Groups


Add a Member to a Group

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Adding a member to a group

  • Using the Windows interface

  • Using a command line

To add a member to a group using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click the folder that contains the group to which you want to add a member.

    Where?

    • Active Directory Users and Computers/domain node/folder that contains the group

  3. In the details pane, right-click the group, and then click Properties.

  4. On the Members tab, click Add.

  5. In Enter the object names to select, type the name of the user, group, or computer that you want to add to the group, and then click OK.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • In addition to users and computers, group members can include contacts and other groups.

  • Another way to add members to a group is to select the desired object and then click the Adds the selected objects to a group you specify toolbar icon. You can also drag a member object to a group, or right-click the object, and then click Add to a group.

  • When you administer a domain, security principals in the parent domain or other trusted domains are not visible on the Member Of tab in a domain user's properties. The only domain accounts that you can add or view are the present domain groups. Only domain groups in the present domain are shown, even if the member belongs to other trusted domain groups.

Additional references

  • Managing Groups

To add a member to a group using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsmod group <GroupDN> -addmbr <MemberDN>

Parameter | Description
<GroupDN> | Specifies the distinguished name of the group object to which you want to add the object.
-addmbr | Sets <MemberDN> value.
<MemberDN> | Specifies the distinguished name of the object that you want to add to the group.

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsmod group /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • In addition to users and computers, group members can include contacts and other groups.

Additional references

  • Managing Groups


Convert a Group to Another Type

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Converting a group to another group type

  • Using the Windows interface

  • Using a command line

To convert a group to another group type using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click the folder that contains the group that you want to convert to another group type.

    Where?

    • Active Directory Users and Computers/domain node/folder that contains the group

  3. In the details pane, right-click the group, and then click Properties.

  4. On the General tab, under Group type, click the group type.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • To convert a group, the domain functional level must be set to Windows 2000 native or higher. Groups cannot be converted when the domain functional level is set to Windows 2000 mixed.

Additional references

  • Managing Groups

To convert a group to another group type using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsmod group  <GroupDN> -secgrp {yes|no}

Parameter | Description
<GroupDN> | Specifies the distinguished name of the group object for which you want to change the group type.
-secgrp | Sets the group type value.
{yes|no} | Specifies that the group type is set to security group (yes) or distribution group (no).

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsmod group /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • To convert a group, the domain functional level must be set to Windows 2000 native or higher. Groups cannot be converted when the domain functional level is set to Windows 2000 mixed.

Additional references

  • Managing Groups


Change Group Scope

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Changing group scope

  • Using the Windows interface

  • Using a command line

To change group scope using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click the folder that contains the group for which you want to change the group scope.

    Where?

    • Active Directory Users and Computers/domain node/folder that contains the group

  3. In the details pane, right-click the group, and then click Properties.

  4. On the General tab, under Group scope, select the group scope.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • You can change group scopes only when the domain functional level is set to Windows 2000 native or higher.

  • Changing the scope of a group from universal to domain local can only be done on a global catalog server. An error message appears if the domain controller is not a global catalog server.

Additional references

  • Managing Groups

To change group scope using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsmod group <GroupDN> -scope {L|G|U}

Parameter | Description
<GroupDN> | Specifies the distinguished names of the group object to which the scope will be changed.
{L|G|U} | Specifies that the scope of the group is set to local (L), global (G) or universal (U). If the domain functional level is still at Windows 2000 mixed, the universal scope is not supported. Also, it is not possible to convert a domain local group to a global group or a global group to a domain local group.

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsmod group /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • You can change group scopes only when the domain functional level is set to Windows 2000 native or higher.

  • Changing the scope of a group from universal to domain local can only be done on a global catalog server. An error message appears if the domain controller is not a global catalog server.

Additional references

  • Managing Groups


Delete a Group

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Deleting a group account

  • Using the Windows interface

  • Using a command line

To delete a group account using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click the folder that contains the group that you want to delete.

    Where?

    • Active Directory Users and Computers/domain node/folder that contains the group

  3. In the details pane, right-click the group, and then click Delete.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • Deleting a group is a permanent operation.

Additional references

  • Managing Groups

To delete a group account using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsrm <GroupDN>

Parameter | Description
<GroupDN> | Specifies the distinguished name of the group object to be deleted.

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsrm /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Deleting a group is a permanent operation.

Additional references

  • Managing Groups


Find Groups in Which a User is a Member

There is no minimum group membership required to complete this procedure.

Finding a groups in which a user is a member

  • Using the Windows interface

  • Using a command line

To find groups in which a user is a member using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click Users.

    Where?

    • Active Directory Users and Computers/domain node/Users

    Or, click the folder that contains the user account whose group membership you want to view.

  3. In the details pane, right-click a user account, and then click Properties.

  4. Click the Member Of tab.

Additional considerations

  • Performing this task does not require you to have administrative credentials. Therefore, as a security best practice, consider performing this task as a user without administrative credentials.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • The Member Of tab for a user displays a list of groups in the domain in which the user's account is located. Active Directory Domain Services (AD DS) does not display groups that reside in trusted domains where the user is a member.

Additional references

  • Managing Groups

To find groups in which a user is a member using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

dsget user <UserDN> -memberof

Parameter | Description
-memberof | Specifies group membership.
<UserDN> | Specifies the distinguished name of the user object for which you want to display group membership.

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsget user /?

Additional considerations

  • Performing this task does not require you to have administrative credentials. Therefore, as a security best practice, consider performing this task as a user without administrative credentials.

Additional references

  • Managing Groups


Assign User Rights to a Group in AD DS

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To assign user rights to a group in Active Directory

  1. To open Group Policy Management, click Start, click Run, type gpmc.msc, and then click OK.

  2. In the console tree, right-click Default Domain Controllers Policy, and then click Edit.

    Where?

    • Domains/Current Domain Name/Group Policy objects/Default Domain Controllers Policy

  3. In the console tree, click User Rights Assignment.

    Where?

    • Windows Settings/Security Settings/Local Policies/User Rights Assignment

  4. In the details pane, double-click the user right that you want to assign.

  5. Click Add User or Group.

    If the button appears dimmed, select the Define these policy settings check box.

  6. Type the name of the group to which you want to assign this right.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or the Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • To perform this procedure, you must first install Group Policy Management as a feature in Server Manager.

Additional references

  • Managing Groups


Managing Computers

You can use Active Directory Users and Computers to create new computer accounts or manage existing computer accounts.

  • Understanding Computer Accounts

  • Create a New Computer Account

  • Add a Computer Account to a Group

  • Delete a Computer Account

  • Manage a Remote Computer

  • Move a Computer Account

  • Reset a Computer Account

  • Disable or Enable a Computer Account


Understanding Computer Accounts

Every computer running Windows NT, Windows 2000, Windows XP, or Windows Vista or a server running Windows Server 2003 or Windows Server 2008 that joins a domain has a computer account. Like user accounts, computer accounts provide a means for authenticating and auditing access to the network and to domain resources. Each computer account must be unique.

Note

Computers running Windows 95 and Windows 98 do not have advanced security features. Therefore, they are not assigned computer accounts.

You can add, disable, reset, and delete user and computer accounts with Active Directory Users and Computers. You can also create a computer account when you join a computer to a domain.

When the domain functional level is set to Windows Server 2008, a new lastLogonTimestamp attribute is used to track the last logon time of a user or computer account. This attribute is replicated within the domain, and it can provide you with important information regarding the history of a user or computer.

Understanding computer names

Each computer account that is created in Active Directory Domain Services (AD DS) has a relative distinguished name, a pre–Windows 2000 computer name (Security Accounts Manager (SAM) account name), a primary Domain Name System (DNS) suffix, a DNS host name, and a service principal name (SPN). The administrator enters the computer name when he or she creates the computer account. This computer name is used as the Lightweight Directory Access Protocol (LDAP) relative distinguished name.

AD DS suggests the pre–Windows 2000 name using the first 15 bytes of the relative distinguished name. The administrator can change the pre–Windows 2000 name at any time.

The DNS name for a host is called a full computer name. This is a DNS fully qualified domain name (FQDN). The full computer name is a concatenation of the computer name (the first 15 bytes of the SAM account name of the computer account without the "$" character) and the primary DNS suffix (the DNS domain name of the domain in which the computer account exists). This name is listed on the Computer Name tab in System Properties in Control Panel.

By default, the primary DNS suffix portion of the FQDN for a computer must be the same as the name of the Active Directory domain where the computer is located. To allow different primary DNS suffixes, a domain administrator may build a restricted list of allowed suffixes by creating the msDS-AllowedDNSSuffixes attribute in the domain object container. The domain administrator creates and manages this attribute with Active Directory Service Interfaces (ADSI) or LDAP.

The SPN is a multivalue attribute. It is usually built from the DNS name of the host. The SPN is used in the process of mutual authentication between the client and the server hosting a particular service. The client finds a computer account based on the SPN of the service to which it is trying to connect. Members of the Domain Admins group can modify the SPN.


Create a New Computer Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Creating a new computer account

  • Using the Windows interface

  • Using a command line

To create a new computer account using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, right-click Computers.

    Where?

    • Active Directory Users and Computers/domain node/Computers

    Or, right-click the folder in which you want to add the computer.

  3. Point to New, and then click Computer.

  4. Type the computer name.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • By default, members of the Account Operators group can create computer accounts in the Computers container and in new organizational units (OUs).

  • By default, Authenticated Users in a domain are assigned the Add workstations to a domain user right, and they can create up to 10 computer accounts in the domain.

  • There are two additional ways to give a user or group permission to add a computer to the domain:

    • Use a Group Policy object to assign the Add Computer User permission

    • On the OU, assign the user or group the Create Computer Objects permission

  • If the computer using the account that you are creating is a pre–Windows 2000 computer, select the Assign this computer account as a pre–Windows 2000 computer check box.

Additional references

  • Managing Computers

To create a new computer account using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsadd computer <ComputerDN>

Parameter | Description
<ComputerDN> | Specifies the distinguished name of the computer that you want to add. The distinguished name specifies the directory location.

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsadd computer /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • By default, members of the Account Operators group can create computer accounts in the Computers container and in new OUs.

  • By default, Authenticated Users in a domain are assigned the Add workstations to a domain user right, and they can create up to 10 computer accounts in the domain.

  • There are two additional ways to give a user or group permission to add a computer to the domain:

    • Use a Group Policy object to assign the Add Computer User permission

    • On the OU, assign the user or group the Create Computer Objects permission

Additional references

  • Managing Computers


Add a Computer Account to a Group

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Adding a computer account to a group

  • Using the Windows interface

  • Using a command line

To add a computer account to a group using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click Computers.

    Where?

    • Active Directory Users and Computers/domain node/Computers

    Or, click the folder in which the computer is located.

  3. In the details pane, right-click the computer, and then click Properties.

  4. On the Member Of tab, click Add.

  5. In Enter the object names to select, type the name of a group that you want this computer to be a member of, and then click OK.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • When you view users, computers, and groups as containers, you can add a computer to a group by dragging it onto the desired group.

  • By adding a computer to a group, you can assign permissions to all the computer accounts in that group and you can filter Group Policy settings on all the accounts in that group.

Additional references

  • Managing Computers

To add a computer account to a group using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsmod group <GroupDN> -addmbr <ComputerDN>

Parameter | Description
<GroupDN> | Specifies the distinguished names of the group object to which you want to add the computer object.
-addmbr | Sets the <ComputerDN> value.
<ComputerDN> | Specifies the distinguished name of the computer to be added to the group. The distinguished name specifies the directory location.

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsmod group /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • By adding a computer to a group, you can assign permissions to all of the computer accounts in that group and filter Group Policy settings on all accounts in that group.

Additional references

  • Managing Computers


Delete a Computer Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Deleting a computer account

  • Using the Windows interface

  • Using a command line

To delete a computer account using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click Computers.

    Where?

    • Active Directory Users and Computers/domain node/Computers

    Or, click the folder in which the computer is located.

  3. In the details pane, right-click the computer, and then click Delete.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • You can also delete a computer account by disjoining the computer from the domain.

  • After a computer account is deleted, all permissions and memberships that are associated with that computer account are permanently deleted. Because the security identifier (SID) for each account is unique, a new computer account with the same name as a previously deleted computer account does not inherit the permissions and memberships of the previously deleted account. To duplicate a deleted computer account, you must recreate all permissions and memberships manually.

Additional references

  • Managing Computers

To delete a computer account using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsrm computer <ComputerDN>

Parameter | Description
<ComputerDN> | Specifies the distinguished name of the computer that you want to delete. The distinguished name specifies the directory location.

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsrm computer /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • You can also delete a computer account by disjoining the computer from the domain.

  • After a computer account is deleted, all permissions and memberships that are associated with that computer account are permanently deleted. Because the SID for each account is unique, a new computer account with the same name as a previously deleted computer account does not inherit the permissions and memberships of the previously deleted account. To duplicate a deleted computer account, you must recreate all permissions and memberships manually.

Additional references

  • Managing Computers


Manage a Remote Computer

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To manage a remote computer

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click Computers.

    Where?

    • Active Directory Users and Computers/domain node/Computers

    Or, click the folder that contains the computer that you want to manage.

  3. In the details pane, right-click the computer, and then click Manage.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • Clicking Manage starts Computer Management, which you can use to administer remote computers. You must have administrative credentials on the local computer to view certain information or to modify computer properties with Computer Management.

Additional references

  • Managing Computers


Move a Computer Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To move a computer account

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click Computers.

    Where?

    • Active Directory Users and Computers/domain node/Computers

    Or, click the folder that contains the computer that you want to move.

  3. In the details pane, right-click the computer, and then click Move.

  4. In the Move dialog box, click the domain node.

  5. Click the folder to which you want to move the computer, and then click OK.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • You cannot use Active Directory Users and Computers to move computer accounts between domains. To move a computer account between domains, use the Active Directory Migration Tool (ADMT), one of the Active Directory support tools. For more information, see ADMT v3 Migration Guide (http://go.microsoft.com/fwlink/?LinkId=82740).

  • Members of the Account Operators group can move computer accounts to organizational units (OUs) but not to default containers, such as the Builtin or Computers containers. However, Account Operators cannot move computer accounts into the Domain Controllers OU, but they can move computer accounts from the Domain Controllers OU.

Additional references

  • Managing Computers


Reset a Computer Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Resetting a computer account

  • Using the Windows interface

  • Using a command line

To reset a computer account using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click Computers.

    Where?

    • Active Directory Users and Computers/domain node/Computers

    Or, click the folder that contains the computer that you want to reset.

  3. In the details pane, right-click the computer, and then click Reset Account.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

Additional references

  • Managing Computers

To reset a computer account using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsmod computer <ComputerDN> -reset

Parameter | Description
<ComputerDN> | Specifies the distinguished name of one or more computer objects that you want to reset.
-reset | Resets the specified computer object.

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsmod computer /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Managing Computers


Disable or Enable a Computer Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Disabling or enabling a computer account

  • Using the Windows interface

  • Using a command line

To disable or enable a computer account using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, click Computers.

    Where?

    • Active Directory Users and Computers/domain node/Computers

    Or, click the folder that contains the computer account that you want to enable or disable.

  3. In the details pane, right-click the desired computer account, and then do one of the following:

    • To disable the account, click Disable Account.

    • To enable the account, click Enable Account.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • When you disable a computer account, the computer cannot authenticate to the domain until it has been enabled.

Additional references

  • Managing Computers

To disable or enable a computer account using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsmod computer <ComputerDN> -disabled {yes|no}

Parameter | Description
<ComputerDN> | Specifies the distinguished names of the computer account that you want to disable or enable.
-disabled | Sets the disabled (yes) or the enabled (no) value for the specified computer account.
{yes|no} | Specifies whether the computer account is disabled for log on (yes) or not (no).

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following, and then press ENTER:

dsmod computer /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or the Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • When you disable a computer account, the computer account cannot authenticate to the domain until it has been enabled.

Additional references

  • Managing Computers


Managing Domains

You can use Active Directory Users and Computers to connect to a specific domain or domain controller and view or manage the directory information for that domain or domain controller.

  • Understanding Domains

  • Manage a Different Domain

  • Manage the Domain Using a Different Domain Controller


Understanding Domains

Domains are units of replication. All the domain controllers in a particular domain can receive changes and replicate those changes to all the other domain controllers in the domain. Each domain in Active Directory Domain Services (AD DS) is identified by a Domain Name System (DNS) domain name. Each domain requires one or more domain controllers. If your network requires more than one domain, you can easily create multiple domains.

One or more domains that share a common schema and global catalog are referred to as a forest. The first domain in a forest is referred to as the forest root domain. If multiple domains in the forest have contiguous DNS domain names, the structure is referred to as a domain tree.

A single domain can span multiple physical locations or sites and contain millions of objects. Site structure and domain structure are separate and flexible. A single domain can span multiple geographical sites, and a single site can include users and computers that belong to multiple domains.

A domain provides several benefits:

  • You can organize objects.

    You do not have to create separate domains merely to reflect your company's organization of divisions and departments. Within a domain, you can use organizational units (OUs) for this purpose. Using OUs helps you manage the accounts and resources in the domain. You can then assign Group Policy settings and place users, groups, and computers into the OUs. Using a single domain greatly simplifies administrative overhead. For more information, see Managing Organizational Units.

  • You can publish resources and information about domain objects.

    A domain stores information only for objects that are located in that domain. Therefore, by creating multiple domains you are partitioning or segmenting the directory to better serve a disparate user base. When you use multiple domains, you can scale AD DS to accommodate your administrative and directory publishing requirements.

  • Delegating authority eliminates the need for a number of administrators with broad administrative authority.

    By using delegated authority in conjunction with Group Policy objects and group memberships, you can assign an administrator rights and permissions to manage objects in an entire domain or in one or more OUs within the domain.

  • Security policies and settings (such as user rights and password policies) do not cross from one domain to another.

    Each domain has its own security policies and trust relationships with other domains. However, the forest is the final security boundary.

  • Each domain stores only the information about the objects that are located in that domain.

    By partitioning the directory this way, AD DS can scale to very large numbers of objects.


Manage a Different Domain

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To manage a different domain

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, right-click Active Directory Users and Computers, and then click Change Domain.

  3. Type the domain name.

    Or, click Browse, and then select a domain from the list.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • If you select the Save this domain setting for the current console check box, Active Directory Users and Computers attempts to connect to the domain that you specify in the Domain field each time that you open Active Directory Users and Computers.

  • The domain name includes the names of all the domain's parent domains. For example, the domain "sales" can have the full name sales.contoso.com.

Additional references

  • Managing Domains


Manage the Domain Using a Different Domain Controller

There is no minimum group membership required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To manage the domain using a different domain controller

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, right-click Active Directory Users and Computers, and then click Change Domain Controller.

  3. Click a domain controller in the list.

    Or, click the <Type a Domain Controller name or an IP Address here> field, and then type the name of a domain controller.

Additional considerations

  • Performing this task does not require you to have administrative credentials. Therefore, as a security best practice, consider performing this task as a user without administrative credentials. However, you must have the appropriate administrative credentials to manage the domain that you select.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • By default, domain controllers are configured in the Domain Controllers organizational unit (OU) when they are first created.

  • If you select the Save this setting for the current console check box, Active Directory Users and Computers attempts to connect to the domain controller that you specify each time that you open Active Directory Users and Computers.

Additional references

  • Managing Domains


Managing Organizational Units

You can use Active Directory Users and Computers to create new organizational units (OUs) and containers or manage existing OUs and containers.

  • Understanding Organizational Units

  • Create a New Organizational Unit

  • Delete an Organizational Unit

  • Move an Organizational Unit

  • Delegate Control of an Organizational Unit


Understanding Organizational Units

A particularly useful type of directory object that is contained within domains is the organizational unit (OU). OUs are Active Directory containers into which you can place users, groups, computers, and other OUs. An OU cannot contain objects from other domains.

An OU is the smallest scope or unit to which you can assign Group Policy settings or delegate administrative authority. Using OUs, you can create containers within a domain that represent the hierarchical, logical structures in your organization. You can then manage the configuration and use of accounts and resources based on your organizational model.

OUs can contain other OUs. You can extend a hierarchy of OUs as necessary to model your organization's hierarchy within a domain. Using OUs helps you minimize the number of domains that are required for your network.

You can use OUs to create an administrative model that you can scale to any size. A user can have administrative authority for all OUs in a domain or for a single OU. An administrator of an OU does not have to have administrative authority for any other OUs in the domain.


Create a New Organizational Unit

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Creating a new organizational unit

  • Using the Windows interface

  • Using a command line

To create a new organizational unit using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, right-click the domain name.

  3. Point to New, and then click Organizational Unit.

  4. Type the name of the organizational unit (OU).

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • To add an OU, you can also click the domain or folder in which you want to add the OU, and then click the Create a new organizational unit in the current container icon on the toolbar.

Additional references

  • Managing Organizational Units

To create a new organizational unit using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsadd ou <OrganizationalUnitDN>

Parameter | Description
<OrganizationalUnitDN> | Specifies the distinguished name of the OU to be added.

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsadd ou /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

Additional references

  • Managing Organizational Units


Delete an Organizational Unit

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Deleting an organizational unit

  • Using the Windows interface

  • Using a command line

To delete an organizational unit using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, right-click the organizational unit (OU) that you want to delete.

    Where?

    • Active Directory Users and Computers/domain node/organizational unit

  3. Click Delete.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • If the selected OU contains other objects, Active Directory Users and Computers prompts you to either continue or cancel the deletion. If you continue the deletion, all objects in the OU will also be deleted.

Additional references

  • Managing Organizational Units

To delete an organizational unit using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsrm <OrganizationalUnitDN> [-subtree]

Parameter | Description
<OrganizationalUnitDN> | Specifies the distinguished name of the OU to be deleted.
-subtree | Specifies that all objects that the selected OU contains must be deleted as well.

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsrm /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Attempting to delete an OU containing other objects results in an error unless the -subtree option is used. With the -subtree option, dsrm deletes both the selected OU and any objects that it contains.

Additional references

  • Managing Organizational Units


Move an Organizational Unit

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Moving an organizational unit

  • Using the Windows interface

  • Using a command line

To move an organizational unit using the Windows interface

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, right-click the organizational unit (OU) that you want to move.

    Where?

    • Active Directory Users and Computers/domain node/organizational unit

  3. Click Move, and then click the folder to which you want to move the OU.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

  • Active Directory Users and Computers can only move OUs within the same domain. To move OUs between domains, use the Active Directory Migration Tool (ADMT). For more information, see ADMT v3 Migration Guide (http://go.microsoft.com/fwlink/?LinkId=82740).

Additional references

  • Managing Organizational Units

To move an organizational unit using a command line

  1. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    dsmove <OuDN> [-newparent <ParentDN>] -pwd {<Password>|*}

Parameter | Description
<OuDN> | Specifies the distinguished name of the OU object to be moved.
<ParentDN> | Specifies the new location to which you want to move the OU object. The new location is specified as the distinguished name of the new parent node.
-newparent | Sets <ParentDN> value.
-pwd | Specifies to use either a password or a * to log on to a remote server. If you type *, you are prompted for a password.
<Password> | Specifies the Domain Administrator password.

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsmov /?

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or the Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Active Directory Users and Computers can move OUs only within the same domain. To move OUs between domains, use ADMT. For more information, see ADMT v3 Migration Guide (http://go.microsoft.com/fwlink/?LinkId=82740).

Additional references

  • Managing Organizational Units


Delegate Control of an Organizational Unit

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To delegate control of an organizational unit

  1. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.

  2. In the console tree, right-click the organizational unit (OU) for which you want to delegate control.

    Where?

    • Active Directory Users and Computers/domain node/organizational unit

  3. Click Delegate Control to start the Delegation of Control Wizard, and then follow the instructions in the wizard.

Additional considerations

  • To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • Another way to open Active Directory Users and Computers is to click Start, click Run, and then type dsa.msc.

Additional references

  • Managing Organizational Units


Troubleshooting Active Directory Users and Computers

What problem are you having?

  • Cannot add or remove a domain.

  • Changes to group memberships are not taking effect.

  • Receiving "Domain not found," "Server not available," or "RPC server is unavailable" error messages.

Cannot add or remove a domain.

Cause: The domain naming master is not available. This may be caused by a network connectivity problem or an Active Directory Installation Wizard failure. It may also be caused by a failure of the computer holding the domain naming operations master role (also known as flexible single master operations or FSMO). Or, the user who is attempting to add or remove the domain does not have the necessary administrative credentials.

Solution: Identify the computer holding the domain naming master role by using the command netdom query fsmo, and then repair or replace the domain naming master computer. It may be necessary to seize the domain naming master role. Or, resolve the network connectivity problem. If this does not help solve the issue, see article Q223787 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=4441).

Changes to group memberships are not taking effect.

Cause: The infrastructure operations master is not available. This may be caused by a network connectivity problem. It may also be caused by a failure of the computer holding the infrastructure master role. Or, the user who is attempting to change group membership does not have the necessary administrative credentials.

Solution: Identify the computer holding the infrastructure master role by using the command netdom query fsmo, and then repair or replace the computer holding the infrastructure master role. It may be necessary to seize the infrastructure master role. Or, resolve the network connectivity problem. If this does not help solve the issue, see article Q223787 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=4441).

Receiving "Domain not found," "Server not available," or "RPC server is unavailable" error messages.

Cause: Name registration or name resolution problem.

Solution: Verify that Domain Name System (DNS) is available and functioning correctly. Run the Netdiag /debug command on the server in question. This will evaluate the registration of NetBIOS, DNS, and services. If this does not help solve the issue, see article Q265706 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=4441).


Resources for Active Directory Users and Computers

The following links provide more information related to Active Directory Users and Computers:

  • For information about creating a local user account, see Create a local user account (http://go.microsoft.com/fwlink/?LinkID=58123).

  • For information about the Active Directory Migration Tool (ADMT), see ADMT v3 Migration Guide (http://go.microsoft.com/fwlink/?LinkId=82740).

  • For information about default groups, see the Active Directory Domain Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=88626).


User Interface: Active Directory Users and Computers

  • <Object> Properties - Object tab

  • User Properties - Profile Tab

  • User Properties - Account Tab

  • Computer Properties - Delegation tab

  • Read-only Domain Controller Properties - Password Replication Policy Tab

  • Advanced Password Replication Policy Dialog Box - Policy Usage Tab

  • Advanced Password Replication Policy Dialog Box - Resultant Policy Tab

  • Prepopulating passwords

  • New Object - Organizational Unit Dialog Box

  • Change <Domain> or <Forest> Dialog Box

  • Change Domain Controllers Dialog Box

  • Raise Domain Functional Level Dialog Box

  • Delegation of Control Wizard


<Object> Properties - Object tab

Item Details

Protect object from accidental deletion check box

Select this option to update the security descriptor of the object and, potentially, its parent to deny all administrators or users of this domain and domain controller the ability to delete this object.

Note

In Active Directory Users and Computers, the Object tab is visible only when Advanced Features is selected on the View menu.

Note

This setting does not provide protection against accidental deletion of a subtree that contains the protected object. Therefore, we recommend that you enable this setting for all of the protected object's containers up to the domain naming context head.


User Properties - Profile Tab

Item Details

Profile path

Provides a space for you to type the profile path, for example, \\servername\sharefolder\user name.

Logon script

Provides a space for you to type the location of the logon script.

Local path

Specifies that the home folder is located on a local path. In the space provided, type the path location.

Connect

Select this option to choose a network path to connect to a home folder. You can select and configure the network path as follows:

  • Click the arrow in the drop-down list, and then select a drive letter.

  • In the To box, you can specify that the home folder is located on a network. To specify a network path for the home folder, you must first create the shared resource and set permissions that allow the user access. You can do this using shared folders on another computer.


User Properties - Account Tab

Control Details

User logon name

The text box on the left provides a space for you to type the account name for this user. This is the name that the user will use to log on to an Active Directory domain.

The drop-down list on the right lists the available user principal name (UPN) suffixes that may be used to create the user logon name. The list contains the full Domain Name System (DNS) name of the current domain, the full DNS name of the root domain of the current forest, and any alternative UPN suffixes that are created with Active Directory Domains and Trusts.

User logon name (pre–Windows 2000)

The read-only text box on the left displays the domain name that is used by computers running pre–Windows 2000 operating systems. This name will also be used in the pre–Windows 2000 syntax for domainname\username user logon.

The text box on the right provides a space for you to type the user's pre–Windows 2000 logon name. This user name is in the pre–Windows 2000 format, which is domainname\username.

Logon Hours

Click to change the hours that this selected object can log on to the domain. By default, domain logon is allowed 24 hours a day, 7 days a week. Note that this control does not affect the user's ability to log on locally to a computer using a local computer account instead of a domain account.

Log On To

Click to specify workstation logon restrictions that will allow this user to log on only to specified computers in the domain. By default, a user is able to log on at any workstation computer that is joined to the domain. Note that this control does not affect the user's ability to log on locally to a computer using a local computer account instead of a domain account.

Unlock account

Allows you to unlock user accounts that become locked because of too many failed logon attempts.

Notes
  • When the current domain controller indicates the selected user account as "not locked," this control is enabled only if the domain functional level is set to Windows Server 2008. In other words, only Windows Server 2008 domain controllers allow you to "force unlock" user accounts. This feature is particularly useful when user accounts get locked on Read Only Domain Controllers (RODCs) and the lockout information is not replicating to other domain controllers. Note, however, that the unlock operation can be performed only on a writable domain controller.
  • When the current domain controller indicates the selected user account as "locked," the check box text reads Unlock account. This account is currently locked out on this Active Directory Domain Controller.

Account options

The following are the Active Directory user account options:

  • User must change password at next logon

  • User cannot change password

  • Password never expires

  • Store password using reversible encryption

  • Account is disabled

  • Smart card is required for interactive logon

  • Account is sensitive and cannot be delegated

  • User Kerberos DES encryption types for this account

  • This account supports Kerberos AES 128 bit encryption

  • This account supports Kerberos AES 256 bit encryption

  • Do not require Kerberos preauthentication

Note

The Kerberos AES encryption options (both the 128-bit option and the 256-bit option) are available only when the domain functional level is set to Windows Server 2008 or Windows Server 2003. Advanced Encryption Standard (AES) is a new encryption algorithm that has been standardized by the National Institute of Standards and Technology (NIST). It is expected to be widely used in the next several years. For more information about Kerberos authentication, see Kerberos Explained (http://go.microsoft.com/fwlink/?LinkId=85494).

Account expires

Sets the account expiration policy for this user. You can select between the following options:

  • Use Never to specify that the selected account will never expire. This option is the default for new users.

  • Select End of, and then select a date if you want to have the user's account expire on a specified date.


Computer Properties - Delegation tab

Item Details

Do not trust this computer for delegation

Specifies that no delegation of any services is allowed on this computer.

Trust this computer for delegation to any service (Kerberos only)

Specifies that the delegation of services on this computer is allowed only with the Kerberos protocol.

Note

The Kerberos version 5 (V5) authentication protocol is the primary security protocol for authentication in a domain. It verifies the identity of the user and the system.

Trust this computer for delegation to specified services only

Specifies that only certain selected services are allowed to be delegated on this computer. If the Use Kerberos only option is selected, delegation is allowed only with the Kerberos protocol. If Use any authentication protocol option is selected, delegation is allowed with any available authentication protocol.

Expanded check box

When option is selected, it lists all service principle names (SPN) that are associated with the service that is selected for delegation.

Add

Click to select services to which delegated credentials can be presented.

Remove

Click to remove services from the list of services to which delegated credentials can be presented.


Read-only Domain Controller Properties - Password Replication Policy Tab

Item | Details
Groups, users and computers | Displays all accounts names in the Password Replication Policy account list of this read-only domain controller (RODC). Password Replication Policy is a mechanism that is designed to improve the efficiency of subsequent server logons by the same account. The Password Replication Policy setting indicates whether the password caching for a given account is allowed or explicitly denied.
Advanced | Click to view the advanced Password Replication Policy settings on this RODC.
Add | Click to add account names to the Password Replication Policy account list for this RODC.
Remove | Click to remove account names from the Password Replication Policy account list for this RODC.


Advanced Password Replication Policy Dialog Box - Policy Usage Tab

Item Details

Display users and computers that meet the following criteria pull-down menu

The following are the criteria that accounts on this read-only domain controller (RODC) can meet:

  • Accounts whose passwords are stored on this Read-only Domain Controller

  • Accounts that have been authenticated to this Read-only Domain Controller

Note

Periodically, you should review whose accounts have been authenticated to an RODC. This information can help you plan updates that you intend to make to the existing Password Replication Policy. For example, look at which user and computer accounts have authenticated to an RODC so that you can add those accounts to the Allowed List in advance.

Users and computers

Displays the list of accounts that meet the criteria selected in the previous pull-down menu.

Objects retrieved

Displays the number of listed accounts that meet the criteria selected in the previous pull-down menu.

Export

Click to export the generated account list to another location.

Prepopulate Passwords

Click to prepopulate the password of any account for which password caching is allowed on this RODC.


Advanced Password Replication Policy Dialog Box - Resultant Policy Tab

Item | Details
Add | Click to add an account name for which you want to determine the Password Replication Policy setting on this read-only domain controller (RODC) to the account list view.
Refresh | Click to refresh the results that are displayed in the account list view.
Clear | Click to clear the results that are displayed in the account list view.


Prepopulating passwords

Credential Cashing

Credential caching is the storage of user or computer credentials. By default, a Windows Server 2008 read-only domain controller (RODC) does not store user credentials or computer credentials except for its own computer account and a special krbtgt account for that RODC. You must explicitly allow any other credentials to be cached on that RODC.

Password Replication Policy

When you initially deploy an RODC, you must configure the Password Replication Policy on the writable domain controller that will be its replication partner. The Password Replication Policy acts as an access control list (ACL). It determines whether an RODC should be permitted to cache a password. After the RODC receives an authenticated user or computer logon request, it refers to the Password Replication Policy to determine if the password for the account should be cached. Subsequent logons by the same account can then be performed more efficiently.

Password Replication Policy Allowed and Denied Lists

Two new built-in groups are introduced in Windows Server 2008 Active Directory domains to support RODC operations. These new built-in groups are the Domain RODC Password Replication Allowed Group and the Domain RODC Password Replication Denied Group. These groups help implement a default Allowed List and a Denied List for the RODC Password Replication Policy.

By default, the Domain RODC Password Replication Denied Group contains the following members:

  • Enterprise Domain Controllers

  • Enterprise Read-Only Domain Controllers

  • Group Policy Creator Owners

  • Domain Admins

  • Cert Publishers

  • Enterprise Admins

  • Schema Admins

  • Domain-wide krbtgt account

By default, the Denied List attribute contains the following security principals, all of which are built-in groups:

  • Domain RODC Password Replication Denied Group

  • Account Operators

  • Server Operators

  • Backup Operators

  • Administrators

Expiration of cached passwords

After an RODC caches a password for a user, the password remains in the Active Directory database until one of the following conditions occurs:

  • The user changes the password. In this case, the password is not purged from the cache, but it is no longer valid.

  • The Password Replication Policy for the RODC in question changes so that the user's password should no longer be cached. In addition, the user tries to access a noncacheable resource by using a ticket-granting ticket (TGT) that the RODC issues.

Clearing cached passwords

There is no mechanism in Windows Server 2008 to clear the cached password for a given user on an RODC. In the event that an RODC is compromised, reset the passwords that are currently cached, and then rebuild the RODC.


New Object - Organizational Unit Dialog Box

Item Details

Name

Provides a space for you to type the name of the organizational unit (OU).

Protect container from accidental deletion

When this option is selected, it updates the security descriptor of the object and, potentially, its parent, which denies all administrators or users of this domain and domain controller the ability to delete this object.

Note

In Active Directory Users and Computers, the Object tab is visible only when Advanced Features is selected on the View menu.

Note

This setting does not provide protection against accidental deletion of a subtree that contains the protected object. Therefore, we recommend that you enable this setting for all the protected object's containers up to the domain naming context head.


Change <Domain> or <Forest> Dialog Box

Control Details

Domain

Displays the fully qualified domain name (FQDN) of the domain that is the current focus of the selected snap-in. To change the focus of the Active Directory snap-in to another domain, type the full Domain Name System (DNS) name of the domain here.

Note

In Active Directory Sites and Services and Active Directory Domains and Trusts, this control is called Root Domain.

Browse

Displays a list of domains that are contained in the domain tree or forest. You can change the focus of the Active Directory snap-in to the selected domain.

Note

This button is available only in the Active Directory Users and Computers Change Domain dialog box.

Save this domain setting for the current console

Specifies whether to save the current domain focus for the selected Active Directory snap-in. If you select this option, the next time that you open the console, the console will focus on the domain that is listed here.


Change Domain Controllers Dialog Box

Item Details

Any writable Domain Controller

Select this option to find any available domain controller that is writable in the currently selected domain.

This Domain Controller or AD LDS instance

Select this option to either type the computer name or IP address for a domain controller or an Active Directory Lightweight Directory Services (AD LDS) instance or select a domain controller from the list of domain controllers that are registered in the currently selected domain.

Look in this domain

Lists all available domains in the given forest.

Note

This pull-down menu is not visible in Active Directory Users and Computers.

<Type a Directory Server name[:port] here>

To connect to a domain controller, type in the computer name or IP address of a server that hosts this domain controller.

To connect to an AD LDS instance, type the computer name and the port number of a server that hosts this AD LDS instance.

Save this setting for the current console

Specifies whether to save the current domain controller focus for the given console. If you select this option, the next time that you open this console it will focus on the domain that is listed here.


Raise Domain Functional Level Dialog Box

Item Details

Domain name

Specifies the name of the selected domain.

Current domain functional level

Specifies the current setting of the domain functional level.

Note

After this option is set to a certain value, the domain functional level cannot be rolled back or lowered. For example, if the domain functional level is set to Windows Server 2008, it cannot be rolled back to Windows Server 2003 or Windows Server 2000. Also, if the domain functional level is set to Windows Server 2003, it cannot be rolled back to Windows Server 2000.

The functional level of a domain or forest defines only the set of Windows operating systems that can run on domain controllers and the set of available features. It does not define the client operating systems that are supported in the forest.


Delegation of Control Wizard

  • Tasks to Delegate

  • Active Directory Object Type

  • Permissions


Tasks to Delegate

Item Details

Delegate the following common tasks

The following are common tasks that you can select to delegate control of them:

  • Create, delete, and manage user accounts

  • Reset user passwords and force password change at next logon

  • Read all user information

  • Modify the membership of a group

  • Join a computer to a domain

  • Manage Group Policy links

  • Generate Resultant Set of Policy (Planning)

  • Generate Resultant Set of Policy (Logging)

  • Create, delete, and manage inetOrgPerson accounts

  • Reset inetOrgPerson passwords and force password change at next logon

  • Read all inetOrgPerson information

Create a custom task to delegate

Select this option to create a custom task if the task that you want to delegate does not appear in the list of common tasks.


Active Directory Object Type

Control | Details
This folder, existing objects in this folder, and creation of new objects in this folder | Select this option if you want to delegate full control of this folder and all its existing object contents, as well as any future objects that it might contain.
Only the following objects in the folder | Select this option if you want to delegate control of only selected types of objects in this folder. The types of objects that are available are determined by the Active Directory schema. For more information about specific object types, see Active Directory Domain Services Reference (http://go.microsoft.com/fwlink/?LinkId=80181).
Create selected objects in this folder check box | Select this check box to create objects of the types that are selected in the object type list.
Delete selected objects in this folder check box | Select this check box to remove objects of the types that are selected in the object type list.


Permissions

Control Details

Show these permissions

Select among the following check boxes:

  • General. This is the default view. When you select this check box, the list of permissions displays only the core permissions that are common to all the selected objects on the previous wizard page. These permissions include Full Control, Read, Write, Read All Properties, and Write All Properties.

  • Property-specific. Select this check box to update the listed permissions to include properties that are specific to the types of objects that you selected on the previous wizard page. For example, if you selected account objects, any properties that are specific to the account object type, such as Read adminDescription and Write adminDescription, appear in the permissions list.

  • Creation/deletion of specific child objects. Select this check box to update the listed permissions to include properties that are specific to the creation and deletion of child objects for the object types that you selected on the previous wizard page.

Permissions

You can delegate control by using the check boxes that correspond to each of the available permissions. For example, to delegate full control over the object types that you selected previously in the wizard, select the Full Control check box. For more information, see Best practices for assigning permissions on Active Directory objects (http://go.microsoft.com/fwlink/?LinkID=63971).