Active Directory Administrative Center

Network administrators can use Active Directory® Administrative Center in the Windows Server® 2008 R2 operating system to administer and publish information in the directory.

Active Directory Administrative Center is built on Windows PowerShell™ command-line interface technology. It provides an enhanced Active Directory data management experience and a rich graphical user interface (GUI).

You can use Active Directory Administrative Center to perform common Active Directory object management tasks through both data-driven navigation and task-oriented navigation.

  • Managing Users

  • Managing Groups

  • Managing Computers

  • Managing Domains and Domain Controllers

  • Managing Organizational Units

  • Locating Active Directory Objects in Active Directory Administrative Center

  • User Interface: Active Directory Administrative Center

For more information about Active Directory Administrative Center, see What's New in AD DS: Active Directory Administrative Center (http://go.microsoft.com/fwlink/?LinkID=131022).


Managing Users

You can use Active Directory Administrative Center to create new user accounts or manage existing user accounts.

  • Understanding User Accounts

  • Create a New User Account

  • Reset the Password of a User Account

  • Move a User Account

  • Modify the Logon Hours of a User Account

  • Change a User's Primary Group

  • Disable or Enable a User Account

  • Delete a User Account


Understanding User Accounts

Active Directory user accounts represent physical entities, such as people. You can also use them as dedicated service accounts for some applications.

User accounts are also referred to as security principals. Security principals are directory objects that are automatically assigned security identifiers (SIDs), which can be used to access domain resources. A user account primarily:

  • Authenticates the identity of a user.

    A user account enables a user to log on to computers and domains with an identity that the domain can authenticate. Each user who logs on to the network should have his or her own unique user account and password. To maximize security, avoid having multiple users sharing one account.

  • Authorizes or denies access to domain resources.

    After a user is authenticated, the user is authorized or denied access to domain resources based on the explicit permissions that are assigned to that user on the resource.

User accounts

The Users container in Active Directory Administrative Center contains three built-in user accounts: Administrator, Guest, and HelpAssistant. These built-in user accounts are created automatically when you create the domain.

Each built-in account has a different combination of rights and permissions. The Administrator account has the most extensive rights and permissions over the domain. The Guest account has limited rights and permissions. The following table describes each default user account on domain controllers running Windows Server 2008 R2.

Default user account Description

Administrator

The Administrator account has full control of the domain. It can assign user rights and access control permissions to domain users as necessary. Use this account only for tasks that require administrative credentials. We recommend that you set up this account with a strong password.

The Administrator account is a default member of the following Active Directory groups: Administrators, Domain Admins, Enterprise Admins, Group Policy Creator Owners, and Schema Admins.

The Administrator account can never be deleted or removed from the Administrators group, but it can be renamed or disabled. Because the Administrator account is known to exist on many versions of Windows, renaming or disabling this account will make it more difficult for malicious users to try to gain access to it.

The Administrator account is the first account that is created when you set up a new domain with the Active Directory Domain Services Installation Wizard.

Important

When the Administrator account is disabled, it can still be used to gain access to a domain controller in Safe Mode.

Guest

People who do not have an actual account in the domain can use the Guest account. A user whose account is disabled (but not deleted) can also use the Guest account. The Guest account does not require a password.

You can set rights and permissions for the Guest account just like any user account. By default, the Guest account is a member of the built-in Guests group and the Domain Guests global group, which allows a user to log on to a domain. The Guest account is disabled by default, and we recommend that it stay disabled.

HelpAssistant (installed with a Remote Assistance session)

The HelpAssistant account is the primary account for establishing a Remote Assistance session. This account is created automatically when a Remote Assistance session is requested. It has limited access to the computer. The Remote Desktop Help Session Manager service manages the HelpAssistant account. This account is deleted automatically if no Remote Assistance requests are pending.

Securing user accounts

If a network administrator does not modify the rights and permissions of built-in accounts, a malicious user (or service) can use them to illegally log on to a domain by using the Administrator account or Guest account. A good security practice for protecting these accounts is to rename or disable them. Because it retains its SID, a renamed user account retains all its other properties, such as its description, password, group memberships, user profile, account information, and any assigned permissions and user rights.

To obtain the security advantages of user authentication and authorization, use the Active Directory Administrative Center to create an individual user account for each user who will participate in your network. You can then add each user account (including the Administrator account and Guest account) to a group to control the rights and permissions that are assigned to the account. When you have accounts and groups that are appropriate for your network, you ensure that you can identify users that log on to your network and that they have access only to the permitted resources.

You can help defend your domain from attackers by requiring strong passwords and implementing an account lockout policy. Strong passwords reduce the risk of intelligent password guessing and dictionary attacks on passwords. An account lockout policy decreases the possibility of an attacker compromising your domain through repeated logon attempts. An account lockout policy determines how many failed logon attempts a user account can have before it is disabled.

InetOrgPerson accounts

Active Directory Domain Services (AD DS) provides support for the InetOrgPerson object class and its associated attributes, as defined in Request for Comments (RFC) 2798. The InetOrgPerson object class is used in several non-Microsoft, Lightweight Directory Access Protocol (LDAP) and X.500 directory services to represent people in an organization.

Support for InetOrgPerson makes migration from other LDAP directories to AD DS more efficient. An InetOrgPerson object is derived from the user class. It can function as a security principal, just like an object from the user class. For information about creating an inetOrgPerson user account, see Create a New User Account.

When the domain functional level is set to Windows Server 2008 or Windows Server 2008 R2, you can set the userPassword attribute on InetOrgPerson and user objects as being the effective password, just as you can with the unicodePwd attribute.

Additional references

  • Managing Users


Create a New User Account

To manage users in a domain, create user accounts in Active Directory Domain Services (AD DS). In contrast, to manage users that are specific to one computer, create local user accounts. For more information about creating local user accounts, see Create a local user account (http://go.microsoft.com/fwlink/?LinkID=58123).

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To create a new user account using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, right-click the node in which you want to add a user account, click New, and then click User.

    Note

    For interoperability with other directory services, you can click InetOrgPerson instead. For more information about the InetOrgPerson class, see Understanding User Accounts.

  3. In Create User, in the Account section:

    • In First name, type the user's first name.

    • In Middle initials, type the user's initials.

    • In Last name, type the user's last name.

    • Modify Full name to add initials or reverse the order of the first and last names.

    • In User UPN logon, type the user’s logon name, and then click the user principal name (UPN) suffix in the drop-down list.

      If the user will use a different name to log on to computers running Microsoft® Windows® 95, Windows 98, or Windows NT® operating systems, you can change the user’s logon name as it appears in User SamAccountName logon to the different name.

    • In Password and Confirm password, type the user's password, and then select the appropriate password options.

    • To protect the user account from accidental deletion, select the Protect from accidental deletion check box.

    • Click Log on hours, and then set the permitted or denied logon hours for the user.

    • Click Log on to, and then set the permitted logon workstations for the user.

    • In Account expires, select Never or enter the account expiration date.

    • Expand Password options, Encryption options, and Other options, and then make the appropriate selections.

  4. In Create User, modify the appropriate fields in the Organization, Member Of, and Profile sections, and then click OK.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Create a New User (http://go.microsoft.com/fwlink/?LinkId=141531).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Users


Reset the Password of a User Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To reset a user password using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, select the node that contains the user account whose password you want to reset.

  3. In the management list, right-click the user whose password you want to reset, and then click Reset password.

  4. In the Reset Password dialog box, type and then confirm the password.
Note

If you want to require the user to change this password at the next logon process, select the User must change password at next log on check box.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Reset the Password of a User Account (http://go.microsoft.com/fwlink/?LinkId=141679).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

  • You can also reset a user password by using the Reset Password tile on the Active Directory Administrative Center Overview page.

Additional references

  • Managing Users


Move a User Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To move a user account using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, select the node that contains the user account that you want to move.

  3. In the management list, right-click the user account that you want to move, and then click Move.

  4. In the Move dialog box, use the column explorer to navigate to and select the container to which you want to move the user account, and then click OK.

Additional considerations

  • You cannot use Active Directory Administrative Center to move user accounts between domains. To move user accounts between domains, use the Active Directory Migration Tool (ADMT). For more information, see ADMT v3.1 Guide: Migrating and Restructuring Active Directory Domains (http://go.microsoft.com/fwlink/?LinkId=82740).

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Move a User Account (http://go.microsoft.com/fwlink/?LinkId=141690).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Users


Modify the Logon Hours of a User Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To modify logon hours for a user account using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, select the node that contains the user account whose logon hours you want to modify.

  3. In the management list, right-click the user whose logon hours you want to modify, and then click Properties.

  4. In the Account section, click Log on hours, and then set the permitted or denied logon hours for the user.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Modify the Logon Hours of a User Account (http://go.microsoft.com/fwlink/?LinkId=141694).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Users


Change a User's Primary Group

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To change a user’s primary group using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, select the node that contains the user account whose primary group you want to change.

  3. In the management list, right-click the user whose primary group you want to change, and then click Properties.

  4. In the Member Of section, click the group that you want to set as the user's primary group, and then click Set Primary Group.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Change a User's Primary Group (http://go.microsoft.com/fwlink/?LinkId=141695).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Users


Disable or Enable a User Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To disable or enable a user account using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, select the node that contains the user account whose status you want to change.

  3. In the management list, right-click the user whose status you want to change.

  4. Depending on the status of the user account, do one of the following:

    • To disable the user account, click Disable.

    • To enable the user account, click Enable.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Disable or Enable a User Account (http://go.microsoft.com/fwlink/?LinkId=141696).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Users


Delete a User Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To delete a user account using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, select the node that contains the user account that you want to delete.

  3. In the management list, right-click the user that you want to delete, and then click Delete.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Delete a User Account (http://go.microsoft.com/fwlink/?LinkId=141700).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Users


Managing Groups

You can use Active Directory Administrative Center to create new groups or manage existing groups.

  • Understanding Groups

  • Create a New Group

  • Add a Member to a Group

  • Modify Group Type or Group Scope

  • Move a Group

  • Delete a Group


Understanding Groups

A group is a collection of user and computer accounts, contacts, and other groups that you can manage as a single unit. Users and computers that belong to a particular group are referred to as group members.

Groups in Active Directory Domain Services (AD DS) are directory objects that reside in a domain and in organizational unit (OU) container objects. AD DS provides a set of default groups at installation. It also provides an option to create groups.

You can use groups in AD DS to:

  • Simplify administration by assigning permissions on a shared resource to a group, rather than to individual users. Assigning permissions to a group assigns the same access to the resource to all members of that group.

  • Delegate administration by assigning user rights once to a group through Group Policy. You can then add members to the group that you want to have the same rights as the group.

  • Create e-mail distribution lists.

Groups are characterized by their scope and their type. The scope of a group determines the extent to which the group is applied within a domain or forest. The group type determines whether you can use a group to assign permissions from a shared resource (for security groups) or use a group for e-mail distribution lists only (for distribution groups).

There are also groups for which you cannot modify or view the memberships. These groups are referred to as special identities. They represent different users at different times, depending on the circumstances. For example, the Everyone group is a special identity that represents all current network users, including guests and users from other domains.

The following sections provide additional information about group accounts in AD DS.

Default groups

Default groups, such as the Domain Admins group, are security groups that are created automatically when you create an Active Directory domain. You can use these predefined groups to help control access to shared resources and to delegate specific, domain-wide, administrative roles.

Many default groups are automatically assigned a set of user rights that authorize members of the group to perform specific actions in a domain, such as logging on to a local system or backing up files and folders. For example, a member of the Backup Operators group has the right to perform backup operations for all domain controllers in the domain.

When you add a user to a group, the user receives the following:

  • All the user rights that are assigned to the group

  • All the permissions that are assigned to the group on any shared resources

Default groups are located in the Builtin container and the Users container. The default groups in the Builtin container have a group scope of Builtin Local. Their group scope and group type cannot be changed. The Users container contains groups that are defined with global scope and groups that are defined with domain local scope. You can move groups that are located in these containers to other groups or OUs within the domain, but you cannot move them to other domains.

For more information about default groups, see Default groups (http://go.microsoft.com/fwlink/?LinkId=131422).

Group scope

Groups are characterized by a scope that identifies the extent to which the group is applied in the domain tree or forest. There are three group scopes: domain local, global, and universal.

Domain local groups

Members of domain local groups can include other groups and accounts from Windows NT, Windows 2000, Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2 domains. Members of these groups can be assigned permissions only within a domain.

Groups with domain local scope help you define and manage access to resources within a single domain. These groups can have the following as their members:

  • Accounts from any domain

  • Global groups from any domain

  • Universal groups from any domain

  • Domain local groups, but only from the same domain as the parent domain local group

  • A mixture of any of the above

For example, to give five users access to a particular printer, you can add all five user accounts in the printer permissions list. If, however, you later want to give the five users access to a new printer, you again have to specify all five accounts in the permissions list for the new printer.

With a little planning, you can simplify this routine administrative task by creating a group with domain local scope and assigning it permission to access the printer. Put the five user accounts in a group with global scope, and add this group to the group that has domain local scope. When you want to give the five users access to a new printer, assign the group with domain local scope permission to access the new printer. All members of the group with global scope automatically receive access to the new printer.

Global groups

Members of global groups can include accounts from the same domain as the parent global group and global groups from the same domain as the parent global group. Members of these groups can be assigned permissions in any domain in the forest.

Use groups with global scope to manage directory objects that require daily maintenance, such as user and computer accounts. Because groups with global scope are not replicated outside their own domain, you can change accounts in a group having global scope frequently without generating replication traffic to the global catalog.

Although rights and permissions assignments are valid only within the domain in which they are assigned, by applying groups with global scope uniformly across the appropriate domains, you can consolidate references to accounts with similar purposes. This simplifies and rationalizes group management across domains. For example, in a network with two domains, Europe and UnitedStates, if there is a group with global scope called GLAccounting in the UnitedStates domain, there should also be a group called GLAccounting in the Europe domain (unless the accounting function does not exist in the Europe domain).

Important

We strongly recommend that you use global groups or universal groups instead of domain local groups when you specify permissions on domain directory objects that are replicated to the global catalog.

Universal groups

Members of universal groups can have the following as their members:

  • Accounts from any domain within the forest in which this Universal Group resides

  • Global groups from any domain within the forest in which this Universal Group resides

  • Universal groups from any domain within the forest in which this Universal Group resides

Members of these groups can be assigned permissions in any domain in the domain tree or forest. Use groups with universal scope to consolidate groups that span domains. To do this, add the accounts to groups with global scope and nest these groups within groups that have universal scope. When you use this strategy, any membership changes in the groups that have global scope do not affect the groups with universal scope.

For example, in a network with two domains, Europe and UnitedStates, and a group that has global scope called GLAccounting in each domain, create a group with universal scope called UAccounting that has as its members the two GLAccounting groups, UnitedStates\GLAccounting and Europe\GLAccounting. You can then use the UAccounting group anywhere in the enterprise. Any changes in the membership of the individual GLAccounting groups will not cause replication of the UAccounting group.

Do not change the membership of a group with universal scope frequently. Any changes to the membership of this type of group cause the entire membership of the group to be replicated to every global catalog in the forest.

Group types

There are two types of groups in AD DS: distribution groups and security groups. You can use distribution groups to create e-mail distribution lists. You can use security groups to assign permissions to shared resources.

You can use distribution groups only with e-mail applications (such as Microsoft Exchange Server 2007) to send e-mail to collections of users. Distribution groups are not security enabled, which means that they cannot be listed in discretionary access control lists (DACLs). If you need a group for controlling access to shared resources, create a security group.

When they are used with care, security groups provide an efficient way to assign access to resources on your network. By using security groups, you can:

  • Assign user rights to security groups in AD DS.

    User rights are assigned to a security group to determine what members of that group can do within the scope of a domain (or forest). User rights are automatically assigned to some security groups at the time that AD DS is installed to help administrators define a person's administrative role in the domain. For example, a user who is added to the Backup Operators group in AD DS has the ability to back up and restore files and directories on each domain controller in the domain.

  • Assign permissions to security groups on resources.

    Permissions are different from user rights. Permissions determine who can access a shared resource. They also determine the level of access, such as Full Control. You can use security groups to manage access and permissions to a shared resource. Some permissions that are set on domain objects are automatically assigned to allow various levels of access to default security groups, such as the Account Operators group or the Domain Admins group.

Like distribution groups, security groups can also be used as e-mail entities. Sending an e-mail message to a security group sends the message to all the members of the group.

Special identities

In addition to the groups in the Users container and Builtin container, servers running Windows Server 2008 R2, Windows Server 2008, or Windows Server 2003 include several special identities. For convenience, these identities are generally referred to as groups. These special groups do not have specific memberships that can be modified. However, they can represent different users at different times, depending on the circumstances. The following groups represent special identities:

  • Anonymous Logon

    This group represents users and services that access a computer and its resources through the network without using an account name, password, or domain name. On computers running Windows NT and earlier, the Anonymous Logon group is a default member of the Everyone group. On computers running Windows Server 2008 R2, Windows Server 2008, or Windows Server 2003, the Anonymous Logon group is not a member of the Everyone group by default.

  • Everyone

    This group represents all current network users, including guests and users from other domains. Whenever a user logs on to the network, the user is added automatically to the Everyone group.

  • Network

    This group represents users who are currently accessing a given resource over the network, as opposed to users who access a resource by logging on locally at the computer where the resource is located. Whenever a user accesses a given resource over the network, the user is added automatically to the Network group.

  • Interactive

    This group represents all users who are currently logged on to a particular computer and who are accessing a given resource that is located on that computer, as opposed to users who access the resource over the network. Whenever a user accesses a given resource on the computer to which they are currently logged on, the user is added automatically to the Interactive group.

Although the special identities can be assigned rights and permissions to resources, the memberships of special identities cannot be modified or viewed. Group scopes do not apply to special identities. Users are assigned automatically to these special identities whenever they log on or access a particular resource.

Where groups can be created

In AD DS, groups are created in domains. You can use Active Directory Administrative Center to create groups. When you have the necessary permissions, you can create groups in the root domain of the forest, in any other domain in the forest, or in an OU.

Besides the domain in which it is created, a group is also characterized by its scope. The scope of a group determines the following:

  • The domain from which members can be added

  • The domain in which the rights and permissions that are assigned to the group are valid

Choose the particular domain or OU where you create a group based on the administration that is required for the group. For example, if your directory has multiple OUs, each of which has a different administrator, you may want to create groups with global scope within those OUs so that the administrators can manage group membership for users in their respective OUs. If groups are required for access control outside the OU, you can nest the groups in the OU into groups with universal scope (or other groups with global scope) that you can use elsewhere in the forest.

If the domain functional level is set to Windows 2000 native or higher, the domain contains a hierarchy of OUs, and administration is delegated to administrators at each OU, it may be more efficient to nest groups with global scope. For example, if OU1 contains OU2 and OU3, a group with global scope in OU1 can have as its members groups with global scope in OU2 and OU3. In OU1, the administrator can add or remove group members from OU1, and the administrators of OU2 and OU3 can add or remove group members for accounts from their own OUs without having administrative rights for the group with global scope in OU1.

Note

You can move groups within a domain. However, only groups with universal scope can be moved from one domain to another. The rights and permissions that are assigned to a group with universal scope are lost when the group is moved to another domain, and new assignments must be made.

Additional references

  • Managing Groups


Create a New Group

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To create a new group using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, right-click the node in which you want to add a group, click New, and then click Group.

  3. In Create Group, in the Group section:

    • Type the name of the new group.

      By default, the name that you type is also entered as the Group (SamAccountName) name of the new group.

    • In Group scope, click one of the options.

      For more information, see the section "Group scope" in Understanding Groups.

    • In Group type, click one of the options.

      For more information, see the section "Group types" in Understanding Groups.

    • To protect the group from accidental deletion, select the Protect from accidental deletion check box.

  4. In Create Group, modify the appropriate values in the Managed By, Member Of, and Members sections, and then click OK.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Create a New Group (http://go.microsoft.com/fwlink/?LinkId=141703).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Groups


Add a Member to a Group

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To add a member to a group using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the management list, right-click the group to which you want to add members, and then click Properties.

  3. In the Members section, click Add.

  4. In Enter the object names to select, type the name of the user, group, or computer that you want to add to the group, and then click OK.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Add a Member to a Group (http://go.microsoft.com/fwlink/?LinkId=141707).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

  • In addition to users and computers, group members can include contacts and other groups.

Additional references

  • Managing Groups


Modify Group Type or Group Scope

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To modify group type or group scope using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, select the node that contains the group whose type or scope you want to modify.

  3. In the management list, right-click the group whose type or scope you want to modify, and then click Properties.

  4. In the Group section, do one of the following:

    • To modify group type, under Group type, click the group type.

    • To modify group scope, under Group scope, select the group scope.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Modify Group Type or Group Scope (http://go.microsoft.com/fwlink/?LinkId=141712).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

  • To modify group type or group scope, the domain functional level must be set to Windows 2000 native or higher. You cannot modify group type or group scope when the domain functional level is set to Windows 2000 mixed.

  • You can change the scope of a group from universal to domain local only on a global catalog server. An error message appears if the domain controller is not a global catalog server.

Additional references

  • Managing Groups


Move a Group

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To move a group using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, select the node that contains the group that you want to move.

  3. In the management list, right-click the group that you want to move, and then click Move.

  4. In the Move dialog box, use the column explorer to navigate to and select the folder to which you want to move the group, and then click OK.

Additional considerations

  • You cannot use Active Directory Administrative Center to move groups between domains. To move groups between domains, use the Active Directory Migration Tool (ADMT). For more information, see the ADMT v3.1 Guide: Migrating and Restructuring Active Directory Domains (http://go.microsoft.com/fwlink/?LinkId=82740).

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Move a Group (http://go.microsoft.com/fwlink/?LinkId=141723).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Groups


Delete a Group

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To delete a group using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, select the node that contains the group that you want to delete.

  3. In the management list, right-click the group that you want to delete, and then click Delete.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Delete a Group (http://go.microsoft.com/fwlink/?LinkId=141735).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Groups


Managing Computers

You can use Active Directory Administrative Center to create new computer accounts or manage existing computer accounts.

  • Understanding Computer Accounts

  • Create a New Computer Account

  • Add a Computer Account to a Group

  • Move a Computer Account

  • Reset a Computer Account

  • Disable or Enable a Computer Account

  • Delete a Computer Account


Understanding Computer Accounts

Every computer running Windows NT, Windows 2000, Windows XP, Windows Vista®, or Windows 7 operating systems or a server running Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 that joins a domain has a computer account. Like user accounts, computer accounts provide a means for authenticating and auditing access to the network and to domain resources. Each computer account must be unique.

Note

Computers running Windows 95 and Windows 98 do not have advanced security features. Therefore, they are not assigned computer accounts.

You can add, move, reset, disable, enable, and delete computer accounts with Active Directory Administrative Center. You can also create a computer account when you join a computer to a domain.

When the domain functional level is set to Windows Server 2008 or Windows Server 2008 R2, a lastLogonTimestamp attribute is used to track the last logon time of a user or computer account. This attribute is replicated within the domain, and it can provide you with important information regarding the history of a user or computer.

Understanding computer names

Each computer account that is created in Active Directory Domain Services (AD DS) has a relative distinguished name (also known as RDN), a pre–Windows 2000 computer name (that is, a Security Accounts Manager (SAM) account name), a primary Domain Name System (DNS) suffix, a DNS host name, and a service principal name (SPN). The administrator enters the computer name when he or she creates the computer account. This computer name is used as the Lightweight Directory Access Protocol (LDAP) relative distinguished name.

AD DS suggests the pre–Windows 2000 name using the first 15 bytes of the relative distinguished name. You can change the pre–Windows 2000 name anytime.

The DNS name for a host is called a full computer name. This is a DNS fully qualified domain name (FQDN). The full computer name is a concatenation of the computer name (the first 15 bytes of the SAM account name of the computer account without the "$" character) and the primary DNS suffix (the DNS domain name of the domain in which the computer account exists), for example, computer1.contoso.com.

By default, the primary DNS suffix portion of the FQDN for a computer must be the same as the name of the Active Directory domain where the computer is located. To allow different primary DNS suffixes, a domain administrator may build a restricted list of allowed suffixes by creating the msDS-AllowedDNSSuffixes attribute in the domain object container. The domain administrator creates and manages this attribute with Active Directory Service Interfaces (ADSI) or LDAP.

The SPN is a multivalue attribute. It is usually built from the DNS name of the host. The SPN is used in the process of mutual authentication between the client and the server that hosts a particular service. The client finds a computer account based on the SPN of the service to which it is trying to connect. Members of the Domain Admins group can modify the SPN.

Additional references

  • Managing Computers


Create a New Computer Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To create a new computer account using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, right-click the node in which you want to add a new computer account, click New, and then click Computer.

  3. In Create Computer, in the Computer section:

    • In Name, type the name of the new computer account.

      By default, the name that you type is also entered as the Computer (NetBIOS) name of the new computer account.

    • To protect the computer account from accidental deletion, select the Protect from accidental deletion check box.

    • If the computer using the account that you are creating is a pre–Windows 2000 computer, select the Assign this computer account as a Pre-Windows 2000 computer check box.

  4. In Create Computer, modify the appropriate values in the Managed By and Member Of sections, and then click OK.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Create a New Computer Account (http://go.microsoft.com/fwlink/?LinkId=141741).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Computers


Add a Computer Account to a Group

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To add a computer account to a group using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, select the node that contains the computer account that you want to add to a group.

  3. In the management list, right-click the computer account that you want to add to a group, and then click Properties.

  4. Under Member Of, click Add.

  5. In Enter the object names to select, type the name of the group to which you want to add this computer account, and then click OK.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Add a Computer Account to a Group (http://go.microsoft.com/fwlink/?LinkId=141773).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

  • By adding a computer to a group, you can assign permissions to all the computer accounts in that group and you can filter Group Policy settings on all the accounts in that group.

Additional references

  • Managing Computers


Move a Computer Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To move a computer account using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, select the node that contains the computer account that you want to move.

  3. In the management list, right-click the computer account that you want to move, and then click Move.

  4. In the Move dialog box, use the column explorer to navigate to and select the folder to which you want to move the group, and then click OK.

Additional considerations

  • You cannot use Active Directory Administrative Center to move computer accounts between domains. To move computer accounts between domains, use the Active Directory Migration Tool (ADMT). For more information, see ADMT v3.1 Guide: Migrating and Restructuring Active Directory Domains (http://go.microsoft.com/fwlink/?LinkId=82740).

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Move a Computer Account (http://go.microsoft.com/fwlink/?LinkId=141774).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Computers


Reset a Computer Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To reset a computer account using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, select the node that contains the computer account that you want to reset.

  3. In the management list, right-click the computer account that you want to reset, and then click Reset account.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Reset a Computer Account (http://go.microsoft.com/fwlink/?LinkId=141775).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Computers


Disable or Enable a Computer Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To disable or enable a computer account using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, select the node that contains the computer account whose status you want to change.

  3. In the management list, right-click the computer whose status you want to change.

  4. Depending on the status of the computer account, do one of the following:

    • To disable the computer account, click Disable.

    • To enable the computer account, click Enable.

Additional considerations

  • When you disable a computer account, the computer cannot authenticate to the domain until it has been enabled.

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Disable or Enable a Computer Account (http://go.microsoft.com/fwlink/?LinkId=141801).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Computers


Delete a Computer Account

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To delete a computer account using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, select the node that contains the computer account that you want to delete.

  3. In the management list, right-click the computer account that you want to delete, and then click Delete.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Delete a Computer Account (http://go.microsoft.com/fwlink/?LinkId=141803).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Computers


Managing Domains and Domain Controllers

You can use Active Directory Administrative Center to connect to a specific domain or domain controller and then view or manage the directory information for that domain or domain controller. You can also use Active Directory Administrative Center to manage Active Directory objects across multiple trusted domains.

  • Understanding Domains

  • Understanding Domain and Forest Functionality

  • Raise the Domain Functional Level

  • Raise the Forest Functional Level

  • Manage the Domain With a Different Domain Controller

  • Manage Different Domains


Understanding Domains

Domains are units of replication. All the domain controllers in a particular domain can receive changes and replicate those changes to all the other domain controllers in the domain. Each domain in Active Directory Domain Services (AD DS) is identified by a Domain Name System (DNS) domain name. Each domain requires one or more domain controllers. If your network requires more than one domain, you can easily create multiple domains.

One or more domains that share a common schema and global catalog are referred to as a forest. The first domain in a forest is referred to as the forest root domain. If multiple domains in the forest have contiguous DNS domain names, the structure is referred to as a domain tree.

A single domain can span multiple physical locations or sites and contain millions of objects. Site structure and domain structure are separate and flexible. A single domain can span multiple geographical sites. A single site can include users and computers that belong to multiple domains.

A domain provides several benefits:

  • You can organize objects.

    You do not have to create separate domains merely to reflect your company's organization of divisions and departments. Within a domain, you can use organizational units (OUs) for this purpose. Using OUs helps you manage the accounts and resources in the domain. You can then assign Group Policy settings and place users, groups, and computers into the OUs. Using a single domain greatly simplifies administrative overhead. For more information, see Managing Organizational Units.

  • You can publish resources and information about domain objects.

    A domain stores information only for objects that are located in that domain. Therefore, when you create multiple domains, you are partitioning or segmenting the directory to better serve different parts of your user base. When you use multiple domains, you can scale AD DS to include very large numbers of objects to accommodate your administrative and directory publishing requirements.

  • Delegating authority eliminates the need for a number of administrators with broad administrative authority.

    By using delegated authority in conjunction with Group Policy objects and group memberships, you can assign an administrator rights and permissions to manage objects in an entire domain or in one or more OUs within the domain.

  • Security policies and settings (such as user rights and password policies) do not cross from one domain to another.

    Each domain has its own security policies and trust relationships with other domains. However, the forest is the final security boundary.

Additional references

  • Managing Domains and Domain Controllers


Understanding Domain and Forest Functionality

Domain and forest functionality

Domain and forest functionality, which is available in Windows Server 2008 R2 Active Directory Domain Services (AD DS), provides a way to enable domain-wide or forest-wide Active Directory features in your network environment. Different levels of domain functionality and forest functionality are available, depending on your network environment.

If all the domain controllers in your domain or forest are running Windows Server 2008 R2 and the domain and forest functional levels are set to Windows Server 2008 R2, all domain-wide features and forest-wide features are available. When your domain or forest contains Windows 2000, Windows Server 2003, or Windows Server 2008 domain controllers, Active Directory features are limited. For more information about how to enable domain-wide features or forest-wide features, see Raise the Domain Functional Level and Raise the Forest Functional Level.

Domain functionality

Domain functionality enables features that affect the entire domain—and that domain only. In Windows Server 2008 R2 AD DS, four domain functional levels are available: Windows 2000 native, Windows Server 2003 (the default), Windows Server 2008, and Windows Server 2008 R2.

The following table lists the domain functional levels and their corresponding supported domain controllers.

Domain functional level | Supported domain controllers
Windows 2000 native | Windows 2000 Server Windows Server 2003 Windows Server 2008 Windows Server 2008 R2
Windows Server 2003 | Windows Server 2003 Windows Server 2008 Windows Server 2008 R2
Windows Server 2008 | Windows Server 2008 Windows Server 2008 R2
Windows Server 2008 R2 | Windows Server 2008 R2

When you raise the domain functional level, domain controllers that run earlier operating systems cannot be introduced into the domain. For example, if you raise the domain functional level to Windows Server 2008 R2, you cannot add domain controllers running Windows Server 2008 to the domain.

The following table describes the domain-wide features that are enabled for the Windows Server 2008 R2 AD DS domain functional levels.

Domain functional level Enabled features

Windows 2000 native

All default Active Directory features and the following features:

  • Universal groups are enabled for both distribution groups and security groups.

  • Group nesting.

  • Group conversion is enabled, which makes conversion possible between security groups and distribution groups.

  • Security identifier (SID) history.

Windows Server 2003

All default Active Directory features, all features from the Windows 2000 native domain functional level, plus the following features:

  • The availability of the domain management tool, Netdom.exe, to prepare for domain controller rename.

  • Update of the logon time stamp. The lastLogonTimestamp attribute is updated with the last logon time of the user or computer. This attribute is replicated within the domain.

  • The ability to set the userPassword attribute as the effective password on the inetOrgPerson object and user objects.

  • The ability to redirect Users and Computers containers. By default, two well-known containers are provided for housing computer and user/group accounts: cn=Computers,<domain root> and cn=Users,<domain root>. This feature makes it possible to define a new well-known location for these accounts.

  • Authorization Manager can store its authorization policies in AD DS.

  • Constrained delegation is included, which makes it possible for applications to take advantage of the secure delegation of user credentials by means of the Kerberos authentication protocol. You can configure delegation to be allowed only to specific destination services.

  • Selective authentication is supported, which makes it possible to specify the users and groups from a trusted forest who are allowed to authenticate to resource servers in a trusting forest.

Windows Server 2008

All default Active Directory features, all features from the Windows Server 2003 domain functional level, plus the following features:

  • Distributed File System (DFS) Replication support for SYSVOL, which provides more robust and detailed replication of SYSVOL contents.

  • Advanced Encryption Services (AES 128 and 256) support for the Kerberos authentication protocol.

  • Last Interactive Logon Information, which displays the time of the last successful interactive logon for a user, from what workstation, and the number of failed logon attempts since the last logon.

  • Fine-grained password policies (FGPP), which make it possible for password policies and account lockout policies to be specified for users and global security groups in a domain.

Windows Server 2008 R2

All default Active Directory features, all features from the Windows Server 2008 domain functional level, plus the following feature:

  • Authentication mechanism assurance, which packages information about the type of logon method (smart card or user name/password) that is used to authenticate domain users inside each user’s Kerberos token. When this feature is enabled in a network environment that has deployed a federated identity management infrastructure, such as Active Directory Federation Services (AD FS), the information in the token can then be extracted whenever a user attempts to access any claims-aware application that has been developed to determine authorization based on a user’s logon method.

Forest functionality

Forest functionality enables features across all the domains in your forest. Four forest functional levels are available in Windows Server 2008 R2 operating system: Windows 2000, Windows Server 2003 (default), Windows Server 2008, and Windows Server 2008 R2.

The following table lists the forest functional levels that are available in Windows Server 2008 R2 and their corresponding supported domain controllers.

Forest functional level | Supported domain controllers
Windows 2000 Server | Windows NT 4.0 Windows 2000 Windows Server 2003 Windows Server 2008 Windows Server 2008 R2
Windows Server 2003 (the default) | Windows Server 2003 Windows Server 2008 Windows Server 2008 R2
Windows Server 2008 | Windows Server 2008 Windows Server 2008 R2
Windows Server 2008 R2 | Windows Server 2008 R2

When you raise the forest functional level, domain controllers that are running earlier operating systems cannot be introduced into the forest. For example, if you raise the forest functional level to Windows Server 2008 R2, domain controllers that are running Windows Server 2008 cannot be added to the forest.

The following table describes the forest-wide features that are enabled for the Windows Server 2008 R2 forest functional levels.

Forest functional level Enabled features

Windows Server 2003

All default Active Directory features, plus the following features:

  • Forest trust.

  • Domain rename.

  • Linked-value replication. Changes in group membership store and replicate values for individual members instead of replicating the entire membership as a single unit. This results in lower network bandwidth and processor usage during replication and eliminates the possibility of lost updates when different members are added or removed concurrently at different domain controllers.

  • The ability to deploy a read-only domain controller (RODC) that runs Windows Server 2008.

  • Improved Knowledge Consistency Checker (KCC) algorithms and scalability. The intersite topology generator (ISTG) uses improved algorithms that scale to support forests with a greater number of sites than can be supported at the Windows 2000 forest functional level.

  • The ability to create instances of the dynamic auxiliary class called dynamicObject in a domain directory partition.

  • The ability to convert an inetOrgPerson object instance into a User object instance, and the reverse.

  • The ability to create instances of the new group types, called application basic groups and Lightweight Directory Access Protocol (LDAP) query groups, to support role-based authorization.

  • Deactivation and redefinition of attributes and classes in the schema.

Windows Server 2008

All the features that are available at the Windows Server 2003 forest functional level, but no additional features. All domains that are subsequently added to the forest, however, will operate at the Windows Server 2008 domain functional level by default.

Windows Server 2008 R2

All the features that are available at the Windows Server 2003 forest functional level, plus the following features:

  • Active Directory Recycle Bin, which provides the ability to restore deleted objects in their entirety while AD DS is running.

All domains that are subsequently added to the forest will operate at the Windows Server 2008 R2 domain functional level by default.

If you plan to include only domain controllers that run Windows Server 2008 R2 in the entire forest, you might choose this forest functional level for administrative convenience. If you do, you will never have to raise the domain functional level for each domain that you create in the forest.

Additional references

  • Managing Domains and Domain Controllers


Raise the Domain Functional Level

When you install Active Directory Domain Services (AD DS) on a server running Windows Server 2008 R2, a set of basic Active Directory features is enabled by default. In addition to the basic Active Directory features on individual domain controllers, there are new domain-wide and forest-wide Active Directory features that are available when all domain controllers in a domain or forest are running Windows Server 2008 R2. For more information, see Understanding Domain and Forest Functionality.

For the new domain-wide features to be enabled, all domain controllers in the domain must be running Windows Server 2008 R2, and the domain functional level must be raised to Windows Server 2008 R2. You can use the following procedure to raise the domain functional level using Active Directory Administrative Center.

Membership in Domain Admins in the domain for which you want to raise the functional level or Enterprise Admins in AD DS, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To raise the domain functional level using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, right-click the domain for which you want to raise the functional level, and then click Raise the domain functional level.

  3. In Select an available domain functional level, do one of the following:

    • To raise the domain functional level to Windows Server 2008, click Windows Server 2008, and then click OK.

    • To raise the domain functional level to Windows Server 2008 R2, click Windows Server 2008 R2, and then click OK.
Caution
  • After you set the domain functional level to a certain value, you cannot roll back or lower the domain functional level, with one exception: when you raise the domain functional level to Windows Server 2008 R2 and if the forest functional level is Windows Server 2008 or lower, you have the option of rolling the domain functional level back to Windows Server 2008.
  • You can lower the domain functional level only from Windows Server 2008 R2 to Windows Server 2008. If the domain functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Raise the Domain Functional Level (http://go.microsoft.com/fwlink/?LinkId=141909).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Domains and Domain Controllers


Raise the Forest Functional Level

When you install Active Directory Domain Services (AD DS) on a server running Windows Server 2008 R2, a set of basic Active Directory features is enabled by default. In addition to the basic Active Directory features on individual domain controllers, there are new domain-wide and forest-wide Active Directory features that are available when all domain controllers in a domain or forest are running Windows Server 2008 R2. For more information, see Understanding Domain and Forest Functionality.

To enable new forest-wide features, all domain controllers in the forest must be running Windows Server 2008 R2 and the forest functional level must be raised to Windows Server 2008 R2. You can use the following procedure to raise the forest functional level using Active Directory Administrative Center.

Membership in Domain Admins in the forest root domain or Enterprise Admins in AD DS, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To raise the forest functional level using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, right-click the domain that belongs to a forest whose functional level you want to raise, and then click Raise the forest functional level.

  3. In Select an available forest functional level, do one of the following:

    • To raise the forest functional level to Windows Server 2008, click Windows Server 2008, and then click OK.

    • To raise the forest functional level to Windows Server 2008 R2, click Windows Server 2008 R2, and then click OK.
Caution
  • After you set the forest functional level to a certain value, you cannot roll back or lower the forest functional level, with one exception: when you raise the forest functional level to Windows Server 2008 R2 and if Active Directory Recycle Bin is not enabled, you have the option of rolling the forest functional level back to Windows Server 2008. (For more information about the Active Directory Recycle Bin, see What's New in AD DS: Active Directory Recycle Bin (http://go.microsoft.com/fwlink/?LinkId=141392).
  • You can lower the forest functional level only from Windows Server 2008 R2 to Windows Server 2008. If the forest functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.

Additional considerations

  • Domains that are set to the domain functional level of Windows Server 2008 will be raised automatically to Windows Server 2008 R2 at the same time that the forest functional level is raised to Windows Server 2008 R2.

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Raise the Forest Functional Level (http://go.microsoft.com/fwlink/?LinkId=141939).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Domains and Domain Controllers


Manage the Domain With a Different Domain Controller

There is no minimum group membership required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To manage the domain with a different domain controller using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, right-click the domain that you want to manage with a different domain controller, and then click Change domain controller.

    Note

    You can also right-click any navigation node that represents a container within the domain that you want to manage with a different domain controller, and then click Change domain controller. In other words, you can change a domain controller connection for any node in the navigation pane. However, changing a domain controller connection for any particular node that represents a container within a certain domain also changes that connection for all other nodes in the navigation pane that represent containers that belong to that same domain.

  3. Click Any writable domain controller or click Select a domain controller from the following list, and then select a domain controller in the list.

Additional references

  • Managing Domains and Domain Controllers


Manage Different Domains

When you open Active Directory Administrative Center on your computer that is running Windows Server 2008 R2 or Windows 7 (the latter, by using Windows Server 2008 R2 Remote Server Administrative Tools (RSAT)), the domain that you are currently logged on to on this computer (the local domain) appears in the Active Directory Administrative Center navigation pane. Depending on the rights of your current set of logon credentials, you can view or manage the Active Directory objects in this local domain.

You can also use the same set of logon credentials and the same instance of Active Directory Administrative Center to view or manage Active Directory objects in any other domain (that belongs or does not belong to the same forest as the local domain) as long as it has an established trust with the local domain. Both one-way trusts and two-way trusts are supported.

Note

If there is a one-way trust between Domain A and Domain B through which users in Domain A can access resources in Domain B but users in Domain B cannot access resources in Domain A, if you are running Active Directory Administrative Center on the computer where Domain A is your local domain, you can connect to Domain B with the current set of logon credentials and in the same instance of Active Directory Administrative Center. But if you are running Active Directory Administrative Center on the computer where Domain B is your local domain, you cannot connect to Domain A with the same set of credentials in the same instance of the Active Directory Administrative Center.

There is no minimum group membership required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To manage a foreign domain in the selected instance of Active Directory Administrative Center using the current set of logon credentials

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. To open Add Navigation Nodes, in Active Directory Administrative Center, click Add Navigation Nodes.

    Note

    Another way to open Add Navigation Nodes is to right-click anywhere in the Active Directory Administrative Center navigation pane, and then click Add Navigation Nodes.

  3. In Add Navigation Nodes, click Connect to other domains.

  4. In Connect to, type the name of the foreign domain that you want to manage (for example, contoso.com), and then click OK.

  5. When you are successfully connected to the foreign domain, browse through the columns in the Add Navigation Nodes window, select the container or containers to add to your Active Directory Administrative Center navigation pane, and then click OK.
Note

For more information about customizing the Active Directory Administrative Center navigation pane, see Customizing the Active Directory Administrative Center Navigation Pane.

You can also open Active Directory Administrative Center by using a set of logon credentials that is different from your current set of logon credentials. The command in the following procedure can be useful if you are logged on to the computer that is running Active Directory Administrative Center with normal user credentials, but you want to use Active Directory Administrative Center on this computer to manage your local domain as an administrator. This command can also be useful if you want to use Active Directory Administrative Center to remotely manage a domain that is different from your local domain with a set of credentials that is different from your current set of logon credentials. However, this domain must have an established trust with the local domain.

There is no minimum group membership required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To manage a domain using logon credentials that are different from the current set of logon credentials

  1. To open Active Directory Administrative Center, at a command prompt, type the following command, and then press ENTER:

    runas /user:<domain\user> dsac

    Where runas /user is the command that allows users to remotely execute commands as a different user, <domain\user> is the set of credentials that you want to open Active Directory Administrative Center with, and dsac is the Active Directory Administrative Center executable file name (Dsac.exe).

    For example, type the following command, and then press ENTER:

    runas /user:contoso\administrator dsac

  2. When Active Directory Administrative Center is open, browse through the navigation pane to view or manage your Active Directory domain.

Additional references

  • Managing Domains and Domain Controllers


Managing Organizational Units

You can use Active Directory Administrative Center to create new organizational units (OUs) and containers or manage existing OUs and containers.

  • Understanding Organizational Units

  • Create a New Organizational Unit

  • Move an Organizational Unit

  • Delete an Organizational Unit


Understanding Organizational Units

The organizational unit (OU) is a particularly useful type of directory object in domains. OUs are Active Directory containers into which you can place users, groups, computers, and other OUs. An OU cannot contain objects from other domains.

An OU is the smallest scope or unit to which you can assign Group Policy settings or delegate administrative authority. By using OUs, you can create containers within a domain that represent the hierarchical, logical structures in your organization. You can then manage the configuration and use of accounts and resources based on your organizational model.

OUs can contain other OUs. You can extend a hierarchy of OUs as necessary to model your organization's hierarchy within a domain. Using OUs helps you minimize the number of domains that are required for your network.

You can use OUs to create an administrative model that you can scale to any size. A user can have administrative authority for all OUs in a domain or for a single OU. An administrator of an OU does not have to have administrative authority for any other OUs in the domain.

Additional references

  • Managing Organizational Units


Create a New Organizational Unit

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To create a new organizational unit using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, right-click the node in which you want to add an organizational unit (OU), click New, and then click Organizational Unit.

  3. In Create Organizational Unit, under Organizational Unit,

    • In Name, type the name of the new OU.

    • In Address, Country/Region, and Description, type the appropriate information.

    • To protect the OU from accidental deletion, select the Protect from accidental deletion check box.

    • To create the OU in a different node, click Change, and then use column explorer to navigate to and select another location for the OU.

  4. In Create Organizational Unit, modify the appropriate values under Managed By, and then click OK.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Create a New Organizational Unit (http://go.microsoft.com/fwlink/?LinkId=141997).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Organizational Units


Move an Organizational Unit

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To move an organizational unit using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, select the node that contains the organizational unit (OU) that you want to move.

  3. In the management list, right-click the OU that you want to move, and then click Move.

  4. In the Move dialog box, use the column explorer to navigate to and select the folder to which you want to move the OU, and then click OK.

Additional considerations

  • You cannot use Active Directory Administrative Center to move OUs between domains. To move OUs between domains, use the Active Directory Migration Tool (ADMT). For more information, see ADMT v3.1 Guide: Migrating and Restructuring Active Directory Domains (http://go.microsoft.com/fwlink/?LinkId=82740).

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Move an Organizational Unit (http://go.microsoft.com/fwlink/?LinkId=141998).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Organizational Units


Delete an Organizational Unit

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To delete an organizational unit using Active Directory Administrative Center

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the navigation pane, select the node that contains the organizational unit (OU) that you want to delete.

  3. In the management list, right-click the OU that you want to delete, and then click Delete.

Additional considerations

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Delete an Organizational Unit (http://go.microsoft.com/fwlink/?LinkID=141999).

    For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Managing Organizational Units


Locating Active Directory Objects in Active Directory Administrative Center

If you want to locate Active Directory objects quickly, you can use the Active Directory Administrative Center query-building search and filtering mechanism. When the Active Directory objects that you target are returned as the results of a search or a filter query, you can perform the necessary administrative tasks.

You can also save the queries that you build and use them again at a later time. Each saved query consists of the query criteria that you select, as well as the customized sorting and column information that you specify.

Searching for Active Directory objects

To search for Active Directory objects in Active Directory Administrative Center, you can use Global Search to specify a scope for your search query.

There is no minimum group membership required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To search for Active Directory objects using Global Search

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. In the Active Directory Administrative Center navigation pane, click Global Search.

    Note

    You can also use the Global Search tile on the Active Directory Administrative Center Overview page.

  3. You can build a Global Search query using keywords and the available search criteria or by using the Lightweight Directory Access Protocol (LDAP) query mode.

    • To build a query using keywords and search criteria, click Normal.

      Note

      To add search criteria to your query, click Add Criteria.

    • To search for Active Directory Data by using the LDAP query mode, click Convert to LDAP.

  4. To adjust the scope of your search query, click Scope.

    The default Global Search scope is set to the local domain, that is, the domain that you are currently logged on to. You can also set Global Search scope to Global Catalog Search for any forest that you are managing in the selected instance of Active Directory Administrative Center or to one or more nodes that are currently added to your navigation pane.

    If you set the scope of your query to Global Catalog Search for a particular forest that you are managing in Active Directory Administrative Center, the query returns a subset of the Active Directory objects that are stored across all the partitions of the selected forest, including domain partitions, configuration partitions, schema partitions, and all other user-defined partitions.

    If you set the scope of your query to one or more nodes that are currently added to your navigation pane, the query returns a subset of the Active Directory objects that are stored in the containers that the selected navigation nodes represent, including all the children containers of the selected parent containers.

  5. To run your query, click Search.
Notes
  • By default, Active Directory Administrative Center is installed on your Windows Server 2008 R2 computer with the Active Directory module for Windows PowerShell and the Active Directory Web Services (ADWS) service. The Active Directory module must be installed on your Windows Server 2008 R2 computer for Active Directory Administrative Center on this computer to function correctly. The ADWS service must be installed on at least one domain controller in the Active Directory domain so that you can use Active Directory Administrative Center to manage this domain.
  • The Active Directory module imposes a two-minute operations time-out (when it attempts to connect to the ADWS service), which is different from the operations time-out that is monitored and controlled by the ADWS service that is running on a Windows Server 2008 R2 server. When you are running a Global Search query in Active Directory Administrative Center, if you are experiencing a slow network connection or if the results of your Global Search query are not returned within the two minutes of the Active Directory module time-out, you might see the following error message: “The operation was aborted because the client side timeout limit was exceeded.”

Filtering through the Active Directory data of selected organizational units

If an organizational unit (OU) contains a particularly large data set, you can narrow it down by building a query and filtering through the Active Directory data of that specific OU.

There is no minimum group membership required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To filter through the Active Directory data of a selected OU

  1. To open Active Directory Administrative Center, click Start, click Administrative Tools, and then click Active Directory Administrative Center.

    Note

    Another way to open Active Directory Administrative Center is to click Start, click Run, and then type dsac.exe.

  2. Navigate to the desired OU by using either the Active Directory Administrative Center navigation pane or management list.

    Important

    The scope of filtering through the Active Directory data of a specific OU is always set to that particular OU. It cannot be adjusted. This scope does not include any children OUs of the selected parent OU. To include the children OUs of the selected parent OU in the scope, in the Tasks pane, click Search under this node.

  3. In Filter, type keywords for your query, or to add criteria, click Add criteria.
Important

If you build a query to filter through the Active Directory data of a specific OU, your query is applied only to the objects that are displayed in the Active Directory Administrative Center management list for this OU. In other words, this query will return a subset of the objects that are displayed in the Active Directory Administrative Center management list for this OU, not a subset of all objects that this OU contains. To specify the maximum number of objects that are displayed, per container (or OU), in the Active Directory Administrative Center management list, on the View menu, click Management List Options.

Additional references

  • Active Directory Administrative Center


User Interface: Active Directory Administrative Center

  • Raise Forest Functional Level Dialog Box

  • Raise Domain Functional Level Dialog Box

  • Change Domain Controller Dialog Box

  • Add Navigation Nodes Dialog Box

  • Customizing the Active Directory Administrative Center Navigation Pane

  • User Properties - Account Section

  • User Properties - Profile Section

  • Computer Properties - Delegation Section

  • Create Organizational Unit - Organizational Unit Section


Raise Forest Functional Level Dialog Box

Item Details

Forest name

Specifies the name of the selected forest.

Current forest functional level

Specifies the current setting of the forest functional level.

Notes
  • After you set the forest functional level to a certain value, you cannot roll back or lower the forest functional level, with one exception: when you raise the forest functional level to Windows Server 2008 R2 and if Active Directory Recycle Bin is not enabled, you have the option of rolling the forest functional level back to Windows Server 2008. (For more information about Active Directory Recycle Bin, see What's New in AD DS: Active Directory Recycle Bin (http://go.microsoft.com/fwlink/?LinkId=141392).
  • You can lower the forest functional level only from Windows Server 2008 R2 to Windows Server 2008. If the forest functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.

The functional level of a domain or forest defines only the set of Windows Server operating systems that can run on domain controllers, along with the available features. It does not define the client operating systems that are supported in the domain or forest.

Additional references

User Interface: Active Directory Administrative Center


Raise Domain Functional Level Dialog Box

Item Details

Domain name

Specifies the name of the selected domain.

Current domain functional level

Specifies the current setting of the domain functional level.

Notes
  • After you set this option to a certain value, you cannot roll back or lower the domain functional level, with one exception: when you raise the domain functional level to Windows Server 2008 R2 and if the forest functional level is Windows Server 2008 or lower, you have the option of rolling the domain functional level back to Windows Server 2008.
  • You can lower the domain functional level only from Windows Server 2008 R2 to Windows Server 2008. If the domain functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.

The functional level of a domain or forest defines only the set of Windows Server operating systems that can run on domain controllers, along with the set of available features. It does not define the client operating systems that are supported in the domain or forest.

Additional references

User Interface: Active Directory Administrative Center


Change Domain Controller Dialog Box

Item | Details
Any writable domain controller | Select this option to find any available domain controller that is writable in the currently selected domain.
Select a domain controller from the following list | Select this option to select a domain controller from the list of domain controllers that are registered in the currently selected domain.
Filter domain controllers | To connect to a specific domain controller, type the computer name of a server that hosts this domain controller.

Additional references

User Interface: Active Directory Administrative Center


Add Navigation Nodes Dialog Box

You can use Add Navigation Nodes to add nodes to your Active Directory Administrative Center navigation pane. You can browse through the Add Navigation Nodes column explorer and select (double-click) one or more containers to add to your navigation pane.

Item Details

Connect to other domains

Click this link to connect to the domain that you want to manage in the selected instance of Active Directory Administrative Center using your current set of logon credentials.

Note

For more information about managing Active Directory objects across multiple domains, see Manage Different Domains.

Connect to

Provides a space for you to type the name of the domain that you want to manage in the selected instance of Active Directory Administrative Center using your current set of logon credentials, for example, contoso.com.

For more information about customizing the Active Directory Administrative Center navigation pane, see Customizing the Active Directory Administrative Center Navigation Pane.

Additional references

User Interface: Active Directory Administrative Center


Customizing the Active Directory Administrative Center Navigation Pane

You can browse through the Active Directory Administrative Center Navigation Pane by using the tree view, which is similar to the Active Directory Users and Computers console tree, or by using the simple list view.

Whether you use the tree view or the simple list view, you can customize your Active Directory Administrative Center navigation pane anytime by adding various containers from the local domain or poany foreign domain (that is, a domain other than the local domain that has an established trust with the local domain) to the navigation pane as separate nodes. Customizing Active Directory Administrative Center navigation pane can provide quicker access to Active Directory objects. For more information, see Manage Different Domains.

Also, to further customize the navigation pane, you can rename or remove these manually added navigation pane nodes, create duplicates of these nodes, or move them up or down in the navigation pane.

Note

You cannot customize the default local domain node.

To customize the Active Directory Administrative Center navigation pane

  1. In the Active Directory Administrative Center navigation pane, right-click the node that you want to modify. You can modify the position or name of the node, or you can create a duplicate of it.

  2. Select one of the following options:

    • Rename

    • Create duplicate node

    • Remove

    • Move up

    • Move down
Note

By using the simple list view, you can take advantage of the Most Recently Used (MRU) list. The MRU list automatically appears under a navigation node when you visit at least one container within this navigation node. You can also view the current MRU list by expanding the Active Directory Administrative Center breadcrumb bar. The MRU list always contains the last three containers that you visited within a particular navigation node. Every time that you select a particular container, this container is added to the top of the MRU list and the last container in the MRU list is removed from it.

Using the Active Directory Administrative Center breadcrumb bar

You can use the Active Directory Administrative Center breadcrumb bar to navigate directly to a specific container within a local domain or any trusted foreign domain by clicking the breadcrumb bar (which puts it in edit mode) and specifying one of the following:

  • A Lightweight Directory Access Protocol (LDAP) path for the desired container, for example, LDAP://cn=Users,DC=contoso,DC=com

  • A distinguished name (also known as DN) for the desired container, for example, cn=Users,DC=contoso,DC=com

  • A hierarchical path for the desired container, for example, Active Directory Domain Services\contoso (local)\Users

Note
  • You can use the Active Directory Administrative Center breadcrumb bar to navigate directly to a specific container only if this container is stored in the domain directory partition of the local domain or the trusted foreign domain that you are managing in Active Directory Administrative Center. You cannot use the Active Directory Administrative Center breadcrumb bar to navigate directly to containers that are stored in the configuration, schema, or application directory partitions of the local or trusted foreign domains that you are managing in Active Directory Administrative Center.

  • To successfully navigate directly to a container by specifying its hierarchical path in the Active Directory Administrative Center breadcrumb bar, you must be managing the domain (local or a trusted foreign) that this container belongs to in the selected instance of Active Directory Administrative Center. However, this restriction does not apply to navigating to a specific container by specifying its LDAP path or a distinguished name in the breadcrumb bar.

    For example, if the domains contoso.com (a local domain) and fabricam.com (a foreign domain) have an established trust relationship, you can specify the LDAP paths or distinguished names of the containers in the breadcrumb bar. You can navigate successfully to the desired containers within both contoso.com and fabricam.com, regardless of whether contoso.com or fabricam.com is currently added to your Active Directory Administrative Center navigation pane. However, contoso.com and fabricam.com must be added to your navigation pane for you to navigate successfully to the containers within these domains by specifying the hierarchical paths of these containers in the breadcrumb bar.

  • You can also copy a specified LDAP path, a distinguished name, or a hierarchical path from the Active Directory Administrative Center breadcrumb bar (by right-clicking the breadcrumb bar and selecting either Copy Path or Copy Distinguished Name) or paste it into the breadcrumb bar. This can be very useful if you want to copy and paste a certain path or distinguished name from the Active Directory Administrative Center into other tools and applications, such as, for example, the Active Directory module for Windows PowerShell, an instant message window, or an e-mail message.

Additional references

User Interface: Active Directory Administrative Center


User Properties - Account Section

Item Details

User UPN logon

The text box on the left provides a space for you to type the account name for this user. This is the name that the user will use to log on to an Active Directory domain.

The drop-down list on the right lists the available user principal name (UPN) suffixes that may be used to create the user logon name. The list contains the full Domain Name System (DNS) name of the current domain, the full DNS name of the root domain of the current forest, and any alternative UPN suffixes that are created with Active Directory Domains and Trusts.

User SamAccountName logon

The read-only text box on the left displays the domain name that is used by computers that are running pre–Windows 2000 operating systems.

The text box on the right provides a space for you to type the user's pre–Windows 2000 logon name.

Protect from accidental deletion check box

Select this option to update the security descriptor of the object—and, potentially, its parent—to deny all administrators or users of this domain and domain controller the ability to delete this object.

Note

This setting does not provide protection against accidental deletion of a subtree that contains the protected object. Therefore, we recommend that you enable this setting for all the protected object’s containers, up to the domain naming context head.

Log on Hours

Click to change the hours during which this selected object can log on to the domain. By default, domain logon is allowed 24 hours a day, 7 days a week. Note that this control does not affect the user's ability to log on locally to a computer by using a local computer account instead of a domain account.

Log On To

Click to specify workstation logon restrictions that will allow this user to log on only to specified computers in the domain. By default, a user is able to log on at any workstation computer that is joined to the domain. Note that this control does not affect the user's ability to log on locally to a computer by using a local computer account instead of a domain account.

Account expires

Sets the account expiration policy for this user. You can select between the following options:

  • Use Never to specify that the selected account will never expire. This option is the default for new users.

  • Select End of, and then select a date if you want to have the user's account expire on a specified date.

Password options

The following are the password options for an Active Directory user account:

  • User must change password at next logon—Forces a user to change his or her password the next time that the user logs on to the network. Enable this option when you want to ensure that the user will be the only person that knows the password.

  • Smart card is required for interactive log on—Requires that a user possess a smart card to log on to the network interactively. The user must also have a smart-card reader attached to the computer and a valid personal identification number (PIN) for the smart card.

  • Password never expires—Prevents a user’s password from expiring. We recommend that service accounts have this option enabled and that they use strong passwords.

  • User cannot change password—Prevents a user from changing his or her password. Enable this option when you want to maintain control over a user account, such as a Guest account or a temporary account.

Encryption options

The following are the encryption options for an Active Directory user account:

  • Store password using reversible encryption—Allows a user to log on to a Windows network from Apple computers. If the user is not logging on from an Apple computer, do not enable this option.

  • User Kerberos DES encryption types for this account—Provides support for the Data Encryption Standard (DES). DES supports multiple levels of encryption, including Microsoft Point-to-Point Encryption (MPPE) Standard (40-bit), MPPE Standard (56-bit), MPPE Strong (128-bit), Internet Protocol security (IPsec) DES (40-bit), IPsec 56-bit DES, and IPsec Triple DES (3DES).

  • This account supports Kerberos AES 128 bit encryption

  • This account supports Kerberos AES 256 bit encryption

Note

The Kerberos Advanced Encryption Standard (AES) encryption options (both the 128-bit option and the 256-bit option) are available only when the domain functional level is set to Windows Server 2008 R2, Windows Server 2008, or Windows Server 2003. AES is a new encryption algorithm that has been standardized by the National Institute of Standards and Technology (NIST). For more information about Kerberos authentication, see Kerberos Explained (http://go.microsoft.com/fwlink/?LinkId=85494).

Other options

The following are additional options for an Active Directory user account:

  • Account is sensitive and cannot be delegated—You can use this option if the account, for example a Guest or temporary account, cannot be assigned for delegation by another account. For more information, see Enabling Delegated Authentication (http://go.microsoft.com/fwlink/?LinkId=143007).

  • Do not require Kerberos preauthentication—Provides support for alternative implementations of the Kerberos protocol. However, use caution when you enable this option, because Kerberos preauthentication provides additional security and requires time synchronization between the client and the server. For more information, see Kerberos Explained (http://go.microsoft.com/fwlink/?LinkID=120374).

Additional references

User Interface: Active Directory Administrative Center


User Properties - Profile Section

Item Details

Profile path

Provides a space for you to type the profile path, for example, \\servername\sharefolder\user name.

Log on script

Provides a space for you to type the location of the logon script.

Local path

Specifies that the home folder is located on a local path. In the space provided, type the path location.

Connect

Select this option to choose a network path to connect to a home folder. You can select and configure the network path as follows:

  • Click the arrow in the drop-down list, and then select a drive letter.

  • In the To box, you can specify that the home folder is located on a network. To specify a network path for the home folder, you must first create the shared resource and set permissions that allow the user access. You can do this by using shared folders on another computer.

Additional references

User Interface: Active Directory Administrative Center


Computer Properties - Delegation Section

Item Details

Do not trust this computer for delegation

Specifies that no delegation of any services is allowed on this computer. For more information, see Delegating authentication (http://go.microsoft.com/fwlink/?LinkId=143012).

Trust this computer for delegation to any service (Kerberos only)

Specifies that the delegation of services on this computer is allowed only with the Kerberos protocol.

Note

The Kerberos version 5 (V5) authentication protocol is the primary security protocol for authentication in a domain. It verifies the identity of the user and the system.

Trust this computer for delegation to specified services only

Specifies that only certain selected services are allowed to be delegated on this computer. If the Use Kerberos only option is selected, delegation is allowed only with the Kerberos protocol. If Use any authentication protocol option is selected, delegation is allowed with any available authentication protocol.

Add

Click to select services to which delegated credentials can be presented.

Remove

Click to remove services from the list of services to which delegated credentials can be presented.

Additional references

User Interface: Active Directory Administrative Center


Create Organizational Unit - Organizational Unit Section

Item Details

Name

Provides a space for you to type the name of the organizational unit (OU).

Create in

Specifies the container in which the new OU is created. To specify a different container, click Change.

Protect from accidental deletion

When this option is selected, it updates the security descriptor of the object—and, potentially, its parent—which denies all administrators or users of this domain and domain controller the ability to delete this object.

Note

This setting does not provide protection against accidental deletion of a subtree that contains the protected object. Therefore, we recommend that you enable this setting for all the protected object's containers, up to the domain naming context head.

Additional references

User Interface: Active Directory Administrative Center