Microsoft KB Archive/322684

= How To Use the Directory Service Command-Line Tools to Manage Active Directory Objects in Windows Server 2003 =

Article ID: 322684

Article Last Modified on 12/3/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Small Business Server 2003 Premium Edition
 * Microsoft Windows Small Business Server 2003 Standard Edition

-



This article was previously published under Q322684



IN THIS TASK
SUMMARY How to Manage Users
 * Creating a New User Account
 * Resetting a User Password
 * Disabling or Enabling a User Account
 * Deleting a User Account

How to Manage Groups
 * Creating a New Group
 * Adding a Member to a Group
 * Converting a Group to Another Group Type
 * Changing Group Scope
 * Deleting a Group
 * Finding Groups in Which a User Is a Member

How to Manage Computers
 * Creating a New Computer Account
 * Adding a Computer Account to a Group
 * Resetting a Computer Account
 * Disabling or Enabling a Computer Account

How to Manage Organizational Units
 * Creating a New Organizational Unit
 * Deleting an Organizational Unit

How to Search Active Directory
 * Finding a User Account
 * Finding a Contact
 * Finding a Group
 * Finding a Computer Account
 * Finding an Organizational Unit
 * Finding a Domain Controller
 * Performing a Custom Search

REFERENCES



SUMMARY
This article describes how to use the Directory Service command-line tools to perform administrative tasks for Active Directory in Windows Server 2003. The following tasks are broken down into task groups.

back to the top

Creating a New User Account
 Click Start, and then click Run. In the Open box, type cmd. At the command prompt, type the following command:

dsadd user  -samid

The following values are used in this command:    specifies the distinguished name (also known as the DN) of the user object that you want to add.   specifies the security account manager (SAM) name used as the unique SAM account name for this user (for example, Linda).  To specify the user account password, type the following command, where  is the password that is to be used for the user account:

dsadd user userdn -pwd

</li></ol>

NOTE: To view the complete syntax for this command, and to obtain more information about entering more user account information, at a command prompt, type dsadd user /?.

back to the top

Resetting a User Password
<ol> Click Start, and then click Run.</li> In the Open box, type cmd.</li> At the command prompt, type the following command:

dsmod user  -pwd

This command uses the following values:    specifies the distinguished name of the user for which the password will be reset.</li>   specifies the password that will replace the current user password</li></ul> </li> If you want to require the user to change this password at the next logon process, type the following command:

dsmod user  -mustchpwd {yes|no}

</li></ol>

NOTE: If a password is not assigned, the first time the user tries to log on (by using a blank password), the following logon message is displayed:

You are required to change your password at first logon

After the user has changed the password, the logon process continues.

You must reset the services that are authenticated with a user account if the password for the service's user account is changed.

NOTE: To view the complete syntax for this command, and to obtain more information about entering more user account information, at a command prompt, type dsmod user /?.

back to the top

Disabling or Enabling a User Account
<ol> Click Start, and then click Run.</li> In the Open box, type cmd.</li> At the command prompt, type the following command:

dsmod user  -disabled {yes|no}

This command uses the following values:    specifies the distinguished name of the user object to be disabled or enabled.</li>  specifies whether the user account is disabled for log on (yes) or not (no).</li></ul> </li></ol>

NOTE: As a security measure, instead of deleting that user's account, you can disable user accounts to prevent a particular user from logging on. If you disable user accounts that have common group memberships, you can use disabled user accounts as account templates to simplify user account creation.

back to the top

Deleting a User Account
<ol> Click Start, and then click Run.</li> In the Open box, type cmd.</li> <li>At the command prompt, type the following command, where  specifies the distinguished name of the user object to be deleted:

dsrm

</li></ol>

After you delete a user account, all of the permissions and memberships that are associated with that user account are permanently deleted. Because the security identifier (SID) for each account is unique, if you create a new user account that has the same name as a previously deleted user account, the new account does not automatically assume the permissions and memberships of the previously deleted account. To duplicate a deleted user account, you must manually re-create all permissions and memberships.

NOTE: To view the complete syntax for this command, and to obtain more information about entering more user account information, at a command prompt, type dsrm /?.

back to the top

Creating a New Group
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsadd group  -samid   -secgrp yes | no -scope l | g | u

This command uses the following values: <ul> <li>  specifies the distinguished name of the group object that you want to add.</li> <li>  specifies the SAM name that is the unique SAM account name for this group (for example, operators).</li> <li>yes | no specifies whether the group you want to add is a security group (yes) or a distribution group (no).</li> <li>l | g | u specifies the scope of the group you want to add ( domain local [l], global [g], or universal [u]).</li></ul> </li></ol>

If the domain in which you are creating the group is set to the domain functional level of Windows 2000 mixed, you can select only security groups with domain local scopes or global scopes.

To view the complete syntax for this command, and to obtain more information about entering more group information, at a command prompt, type dsadd group /?.

back to the top

Adding a Member to a Group
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsmod group  -addmbr

This command uses the following values: <ul> <li>  specifies the distinguished name of the group object that you want to add.</li> <li>  specifies the distinguished name of the object that you want to add to the group.</li></ul> </li></ol>

In addition to users and computers, a group can contain contacts and other groups.

To view the complete syntax for this command, and to obtain more information about entering more user account and group information, at a command prompt, type dsmod group /?.

back to the top

Converting a Group to Another Group Type
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsmod group  -secgrp {yes|no}

This command uses the following values: <ul> <li>  specifies the distinguished name of the group object for which you want to change the group type.</li> <li>{yes|no} specifies that the group type is set to security group (yes) or distribution group (no).</li></ul> </li></ol>

To convert a group, the domain functionality must be set to Windows 2000 Native or higher. You cannot convert groups when the domain functionality is set to Windows 2000 Mixed.

To view the complete syntax for this command, at a command prompt, type dsmod group /?.

back to the top

Changing Group Scope
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsmod group  -scope l|g|u

This command uses the following values: <ul> <li>  specifies the distinguished names of the group object to which the scope will be changed.</li> <li>l|g|u specifies the scope that the group is to be set to (local, global or universal). If the domain is still set to Windows 2000 mixed, the universal scope is not supported. Also, it is not possible to convert a domain local group to global group or vice versa.</li></ul>

NOTE: You can only change group scopes when the domain functional level is set to Windows 2000 native or higher.</li></ol>

back to the top

Deleting a Group
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsrm

This command uses the following value: <ul> <li>  specifies the distinguished name of the group object to be deleted.</li></ul> </li></ol>

NOTE: If you delete the group, the group is permanently removed.

By default, local groups that are provided automatically in domain controllers that are running Windows Server 2003, such as Administrators and Account Operators, are located in the Builtin folder. By default, common global groups, such as Domain Admins and Domain Users, are located in the Users folder. You can add or move new groups to any folder. Microsoft recommends that you keep groups in an organizational unit folder.

To view the complete syntax for this command, at a command prompt, type dsrm /?.

back to the top

Finding Groups in Which a User Is a Member
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsget user  -memberof

This command uses the following value: <ul> <li>  specifies the distinguished name of the user object for which you want to display group membership.</li></ul> </li></ol>

To view the complete syntax for this command, at a command prompt, type dsget user /?.

back to the top

Creating a New Computer Account
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsadd computer

This command uses the following value: <ul> <li>  specifies the distinguished name of the computer you want to add. The distinguished name indicates the folder location.</li></ul> </li></ol>

To view the complete syntax for this command, at a command prompt, type dsadd computer /?.

To modify the properties of a computer account, use the dsmod computer command.

back to the top

Adding a Computer Account to a Group
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsmod group  -addmbr

This command uses the following values: <ul> <li>  specifies the distinguished name of the group object to which you want to add the computer object.</li> <li>  specifies the distinguished name of the computer object to be added to the group. The distinguished name indicates the folder location.</li></ul> </li></ol>

When you add a computer to a group, you can assign permissions to all of the computer accounts in that group, and then filter Group Policy settings on all accounts in that group.

To view the complete syntax for this command, at a command prompt, type dsmod group /?.

back to the top

Resetting a Computer Account
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsmod computer  -reset

This command uses the following value: <ul> <li>  specifies the distinguished names of one or more computer objects that you want to reset.</li></ul> </li></ol>

NOTE: When you reset a computer account, you break the computer's connection to the domain. You must rejoin computer account to the domain computer account after you reset it.

To view the complete syntax for this command, at a command prompt, type dsmod computer /?.

back to the top

Disabling or Enabling a Computer Account
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsmod computer  -disabled {yes|no}

This command uses the following values: <ul> <li>  specifies the distinguished name of the computer object that you want to disable or enable.</li> <li>{yes|no} specifies whether the computer is disabled for log on (yes) or not (no).</li></ul> </li></ol>

When you disable a computer account, you break the computer's connection with the domain and the computer cannot authenticate to the domain.

To view the complete syntax for this command, at a command prompt, type dsmod computer /?.

back to the top

Creating a New Organizational Unit
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsadd ou

This command uses the following value: <ul> <li>  specifies the distinguished name of the organizational unit to be added.</li></ul> </li></ol>

To view the complete syntax for this command, at a command prompt, type dsadd ou /?.

NOTE: To modify the properties of an organizational unit, use the dsmod ou command.

back to the top

Deleting an Organizational Unit
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsrm

This command uses the following value: <ul> <li>  specifies the distinguished name of the organizational unit to be deleted.</li></ul>

To view the complete syntax for this command, at a command prompt, type dsrm /?.

NOTE: If you delete an organizational unit, all of the objects that it contains are deleted.</li></ol>

back to the top

Finding a User Account
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsquery user

This command uses the following value: <ul> <li>  specifies the parameter to use. For the list of parameters, see the online help for the dsquery user command.</li></ul> </li></ol>

To view the complete syntax for this command, at a command prompt, type dsquery user /?.

back to the top

Finding a Contact
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsquery contact

This command uses the following values: <ul> <li>  specifies the parameter to use. For the list of parameters, see the online help for the dsquery user command.</li></ul> </li></ol>

back to the top

Finding a Group
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsquery group

This command uses the following values: <ul> <li>  specifies the parameter to use. For the list of parameters, see the online help for the dsquery user command.</li></ul> </li></ol>

By default, local groups that are provided automatically in domain controllers that are running Windows Server 2003, such as Administrators and Account Operators, are located in the Builtin folder. By default, common global groups, such as Domain Admins and Domain Users, are located in the Users folder. You can add or move new groups to any folder. Microsoft recommends that you keep groups in an organizational unit folder.

back to the top

Finding a Computer Account
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsquery computer -name

This command uses the following value: <ul> <li>  specifies the computer name that the command searches for. This command searches for computers whose name attributes (value of CN attribute) matches .</li></ul> </li></ol>

To view the complete syntax for this command, at a command prompt, type dsquery computer /?.

back to the top

Finding an Organizational Unit
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsquery ou

This command uses the following value: <ul> <li>  specifies the parameter to use. For the list of parameters, see the online help for dsquery ou.</li></ul> </li></ol>

To view the complete syntax for this command, at a command prompt, type dsquery ou /?.

back to the top

Finding a Domain Controller
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsquery server

This command uses the following values: <ul> <li>  specifies the parameter to use. There are several attributes of a server that you can search by using this command. For the list of parameters, see online help for dsquery server.</li></ul> </li></ol>

back to the top

Performing a Custom Search
<ol> <li>Click Start, and then click Run.</li> <li>In the Open box, type cmd.</li> <li>At the command prompt, type the following command:

dsquery *

This command uses the following value: <ul> <li>  specifies the parameter to use. There are several attributes that you can search by using this command. For more information about LDAP searches, see the Windows Server 2003 Resource Kit.</li></ul> </li></ol>

back to the top

<div class="references_section">