Re: Change Naming Attribute (RDN) from CN to UID

Tech-Archive recommends: Speed Up your PC by fixing your registry

You cannot change the RDN attribute. You can however set yourself up a policy you follow that says you set the cn to something unique such as the sAMAccountName. This is very common in large orgs.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


Tomasz Onyszko wrote:
Craig Gilmour wrote:
All,
for various reasons I want to be able to change the naming attribute of a user from the standard CN to another attribute such as UID (or samAccountName for that matter). This is because CN will hold a friendly name (Firstname Lastname) that will not be unique across the organisation, and it is possible the user may be in the same container. I need to do this for both AD and ADAM. Does anyone know if this is possible or not?


Do You want to do it for existing users - sure it is possible with script or tools. Here You will find example how to rename user using VBScript:
http://techtasks.com/code/viewbookcode/1572,

You can use pari adfind.exe and admod.exe to do this as well:
www.joeware.net/win/free/tools/admod.htm
www.joeware.net/win/free/tools/adfind.htm

adfind -b "OU=Employees OU,DC=W2k,DC=PL" -s subtree -f "(&(objectClass=user)(objectCategory=person))" samaccountname -adcsv | admod -rename {{samaccountname}}

(I know - fancy new feature)

.

Relevant Pages

  • Re: How to change the minimum password length in a Windows 2003 se
    ... Joe Richards Microsoft MVP Windows Server Directory Services ... Peter wrote: ... I'm not familiar with OU but I guess adding a GPO to OU will apply the policy to all the objects belonged to that OU. ...
    (microsoft.public.windows.server.security)
  • Re: Password Policy at Domain Level Problem
    ... You can do so by looking at the metadata on ... >>The part about the policy going back to 180 days means either some other ... >>Joe Richards Microsoft MVP Windows Server Directory Services ...
    (microsoft.public.windows.server.active_directory)
  • Re: Unknown Objects prevent replication
    ... Yeah that still doesn't sound right, I have yet to have seen a case where an object didn't have an objectGuid and it is impossible to have a DN without an RDN since the DN isn't a stored value, it is built from the RDN; AD is a flat structure internally, not hierarchical. ... Joe Richards Microsoft MVP Windows Server Directory Services ...
    (microsoft.public.win2000.active_directory)
  • Re: change of Account policy in Domain security policy
    ... When users are forced in some other way to have to change their password then it will go into affect for them, changing the length policy will not force them to change their passwords. ... Joe Richards Microsoft MVP Windows Server Directory Services ... If I change it to 8 characters, what will be the impact to the current users whose password is less than 8 characters? ...
    (microsoft.public.windows.server.active_directory)
  • Re: AD User Accounts
    ... It is derived from the RDN of the object ... >>> I have a script that reads user information from an Excel ... >> attribute, called displayName, actually corresponds to what was called ... >> sAMAccountName ...
    (microsoft.public.scripting.vbscript)