Managing Users in Active Directory Domain Services

1 Managing Users in Active Directory Domain Services To give you an overview of this presentation, the presenters, highlights only the following topics: Create and Administer user Accounts Configure user Object Attributes Automate user Account Creation In Windows Server 2008 Active Directory , it available in three different objects that are used to represent individual Users in the Directory : 1. Two of these, the user object and the inetorgPerson object, are security principals that can be used to assign access to resources. 2. The third object, the contact object, which is not a security principal and is used primarily for e-mail. A user object can have over 250 attributes created by the system and even more created by your organization. In this way, Windows Server 2008 Active Directory is very different than the more limited local security database found on member servers, Windows workstations, and some Linux computers.

2 In local Security database, user object have a very few attributes, such as passwords and home Directory . Because Active Directory can provide additional attributes for objects, Active Directory is useful as a Directory service in addition to simplify being a database for storing authentication information. For example, Active Directory can become the primary location for most user information. The Directory can become the place where all user information, such as telephone numbers, address, and organizational information is stored. When Users learn how to search Active Directory , they will be able to find almost any information about other Users that they are given permission to view. user accounts stored in the Directory are the fundamental component of identity. Because of their importance, knowledge of user accounts and the tasks related to support them is critical to the success of server administrator.

3 Create and Administer user Accounts What is user Account? A user account is an object that Enables authentication of a user with attributes, including a user logon name and password Is a security principal with a security identifier (SID) that can be assigned permissions to resources A user account can be stored In Active Directory , where it enables logon to the Domain and can be assigned permissions to resources anywhere in the Domain Domain user accounts are administered with Active Directory snap-ins and commands In the local security accounts manager (SAM) database of a member computer, where it enables logon to the local computer and can be assigned permissions to local resources Local user accounts are administered with the Local Users and Groups snap-in and the net local user command 1|P ag e Using the Windows interface 1. Open Active Directory Users and Computers.

4 2. In the console tree, right-click the folder in which you want to add a user account. Where? Active Directory Users and 3. Point to New, and then click user . 4. In First name, type the user 's first name. 5. In Initials, type the user 's initials. 6. In Last name, type the user 's last name. 7. Modify Full name to add initials or reverse order of first and last names. 8. In user logon name, type the user logon name, click the UPN suffix in the drop-down list, and then click Next. If the user will use a different name to log on to computers running Windows 95, Windows 98, or Windows NT, then you can change the user logon name as it appears in user logon name (pre-Windows 2000) to the different name. 9. In Password and Confirm password, type the user 's password, and then select the appropriate password options. See the example given Figure How to create a user in graphical interface.

5 Notes: Figure 1. How to create a user in graphical interface To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or the Enterprise Admins group in Active Directory , or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure. For more information, see Default local groups, Default groups, and Using Run as. 2|P ag e Using a command line 1. Open Command Prompt. Type: dsadd user "UserDN" samid pre-Windows 2000 logon name pwd { password | * } mustchpwd yes UserDN. Distinguished name of user to create -samid. Required for new account Pre-Windows 2000 logon name. The downlevel logon name that can be used in the logon format Domain \username and that becomes %username%. -pwd password. The desired initial password Asterisk (*) will prompt you to enter it at the command prompt, so that the plain text password is not entered with the command -mustchpwd { yes | no }.

6 user must change password at next logon Figure 2. Create a user using dsadd command For example: Just type: dsadd user cn=asanglitan, ou=HR, ou=AsiaUsers, dc=fcc, dc=com samid asanglitan pwd P@ssw0rd mustchpwd yes. You will see the result of the operation succeed or not By default, the result set is presented as the distinguished names (DNs) of each object, but you can use the o parameter with modifiers such as dn, rdn, upn, or samid to receive the results as DNs, relative DNs, user principal names (UPNs), or pre-Windows 2000 logon names (security accounts manager [SAM] IDs). Most of the DS commands take two modifiers after the command itself: the object type and the object's DN. Import Users with CSVDE. Open Notepad: the following two lines. Each of the following bullets represents one line of text. Do not include the bullets in the Notepad document.

7 2. Save the file to drive E: 3. Open a command prompt. 4. Type csvde -i -f and press Enter. 3|P ag e Figure Users with CSVDE. The Users are imported. If you encounter any errors, examine the text file for typographical problems. Open the Active Directory Users And Computers snap-in and confirm that the Users were created successfully. If you have had the Active Directory Users And Computers snap-in open during this exercise, you might have to refresh your view to see the newly created accounts. Examine the accounts to confirm that first name, last name, user principal name, and pre- Windows 2000 logon name are populated. Figure 4. Users are imported Note: The -i parameter specifies import mode; without it, the default mode of CSVDE is export. The -f parameter identifies the file name to import from or export to. The -k parameter is useful during import operations because it instructs CSVDE to ignore errors including Object Already Exists, Constraint Violation, and Attribute Or Value Already Exists.

8 The import file itself is a comma-delimited text file (.csv or .txt) in which the first line defines the imported attributes by their Lightweight Directory Access Protocol (LDAP) attribute names. Each object follows, one per line, and must contain exactly the attributes listed on the first line. This file , when imported by the CSVDE command, will create a user object for Jhon Rico in the Finance OU. The user logon names, last name and first name, are configured by the file. You cannot use the CSVDE to import passwords, and without a password, the user account will be disabled initially. After you have reset the password, you can enable the object. Importing Users with LDIFDE. You can also use to import or export Active Directory objects, including Users . The Lightweight Directory Access Protocol Data Interchange Format (LDIF) is a draft Internet standard for file format that can be used to perform batch operations against directories that conform to the LDAP standards.

9 LDIF supports both import and export operations as well as batch operations that modify objects in the Directory . The LDIFDE. command implements these batch operations by using LDIF files. The LDIF file format consists of a block of lines that, together, constitute a single operation. Multiple operations in a single file are separated by a blank line. Each line comprising an operation consists of an attribute name followed by a colon and the value of the attribute. Let's do it in your virtual machine! Open Notepad: the following lines. Each of the following bullets represents one line of text. Do not include the bullets in the Notepad document. 2. Save the file to drive E: 4|P ag e 3. Open a command prompt. 4. Type ldifde -i -f -k and press Enter. The most common switches for LDIFDE. command are: -i Turn on import mode. Without this parameter, LDIFDE exports information - f Filename.

10 The file which to import -k ignore error and continue processing if Constraint Violation or Object Already Exist or errors. Figure 5. Importing Users using LDIFDE. Note: You should understand that both CSVDE. and LDIFDE are able to import and export objects by using their respective file formats. Both commands are in the export mode by default and require the -i parameter to specify import mode. Only LDIFDE is capable of modifying existing objects or removing objects. Neither command enables you to import a user 's password. Only Dsadd supports specifying the password. If you import Users with CSVDE or LDIFDE, the accounts will be disabled until you reset their passwords and enable the accounts 5|P ag e Figure 6. Users are imported Rename user Account In Active Directory Users and Computers: the user , and then click Rename. 2. Type the new common name (CN), and press Enter.