Paul
Thu Oct 18 11:54:07 PDT 2007
Forget it, I don't know what I'm thinking. You are spot on.
--
Paul Bergson
MVP - Directory Services
MCT, MCSE, MCSA, Security+, BS CSci
2003, 2000 (Early Achiever), NT
http://www.pbbergs.com
Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.
"Paul Bergson [MVP-DS]" <pbergson@allete_nospam.com> wrote in message
news:uurTfKbEIHA.4476@TK2MSFTNGP06.phx.gbl...
>I thought the user object was named after its upn. Could you elaborate
>on...
>
> "When you modify cn, you rename the object"
>
> --
> Paul Bergson
> MVP - Directory Services
> MCT, MCSE, MCSA, Security+, BS CSci
> 2003, 2000 (Early Achiever), NT
>
>
http://www.pbbergs.com
>
> Please no e-mails, any questions should be posted in the NewsGroup
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
> "Richard Mueller [MVP]" <rlmueller-nospam@ameritech.nospam.net> wrote in
> message news:e9cCD5aEIHA.5976@TK2MSFTNGP02.phx.gbl...
>> Many organizations make the values of sAMAccountName and cn the same to
>> avoid confusion. It is certainly not necessary, but when a user (or
>> Admin) knows the "Logon Name", a common complaint is that they cannot
>> find the user object in AD and cannot bind to the object.
>>
>> You are correct that when you modify sAMAccountName, users must be
>> notified that their "Login Name" has changed. When you modify cn, you
>> rename the object, but this seems to have less impact.
>>
>> --
>> Richard Mueller
>> Microsoft MVP Scripting and ADSI
>> Hilltop Lab -
http://www.rlmueller.net
>> --
>>
>> "Paul Bergson [MVP-DS]" <pbergson@allete_nospam.com> wrote in message
>> news:uZrCykaEIHA.4196@TK2MSFTNGP04.phx.gbl...
>>> What I have learned since I have posted the initial question is that
>>> when the Full Name (Name) is modified within ADUC, the attribute cn
>>> (Common Name) is updated to be equivalent to Full Name. SteveB has
>>> reinforced this finding with info that replicates my learned experience.
>>>
>>> I'm confused on the sAMAccountName reference, I don't want to touch this
>>> at all. Since this is the pre-windows 2000 logon attribute value, it is
>>> the value users use to authenticate into our domain. Rarely does anyone
>>> use their upn to authenticate, as a matter of fact it wouldn't surprise
>>> me to learn if I was the only one who did use their upn.
>>>
>>> --
>>> Paul Bergson
>>> MVP - Directory Services
>>> MCT, MCSE, MCSA, Security+, BS CSci
>>> 2003, 2000 (Early Achiever), NT
>>>
>>>
http://www.pbbergs.com
>>>
>>> Please no e-mails, any questions should be posted in the NewsGroup
>>> This posting is provided "AS IS" with no warranties, and confers no
>>> rights.
>>>
>>> "Richard Mueller [MVP]" <rlmueller-nospam@ameritech.nospam.net> wrote in
>>> message news:O%23P78CaEIHA.5208@TK2MSFTNGP04.phx.gbl...
>>>>
>>>> "Paul Bergson [MVP-DS]" <pbergson@allete_nospam.com> wrote in message
>>>> news:%23QAAoOZEIHA.1204@TK2MSFTNGP03.phx.gbl...
>>>>>I am trying to determine how each of the following four Active
>>>>>Directory user attributes (Listed below) are used and any possible
>>>>>negative consequnces on such a change. I have an Oracle to HR Sync
>>>>>program I have written and we are now passing the display name to AD
>>>>>and obviously it isn't that simple. I have had some success going
>>>>>through MSDN but I'm hoping someone might have a complete definition of
>>>>>each of their uses.
>>>>>
>>>>> Right now I don't see an issue of syncing the four attributes up so
>>>>> they all are equivalent. Anybody who is familiar with these
>>>>> attributes please provide any and all feedback.
>>>>>
>>>>> displayName
>>>>> displayNamePrintable
>>>>> cn
>>>>> name
>>>>>
>>>>> Thanks for your time
>>>>
>>>> The attribute with LDAP-Display-Name "Name" is actually the RDN
>>>> attribute, the Relative Distinguished Name of the object. For user
>>>> objects, this is the value of the "cn" attribute. If you change the
>>>> value assigned to cn, by renaming the object, the value assigned to
>>>> Name will also change. The documentation says that Name can only be
>>>> updated by the Schema Administrator. I interpret this to mean that the
>>>> Schema Administrator dictates which attribute is the RDN. For OU
>>>> objects it is the attribute ou, for user objects it is the attribute
>>>> cn. In any case, you really only have 3 attributes to worry about. The
>>>> values of cn and Name will always be the same for user objects.
>>>>
>>>> The value of cn must be unique in the parent container/OU and is
>>>> mandatory. I think the value of cn is limited to about 120 characters,
>>>> and a few possible characters must be escaped (like the comma, pound
>>>> sign, and backslash) with the backslash escape character. There are no
>>>> restrictions on displayName or displayNamePrintable, except a limit of
>>>> a few thousand characters.
>>>>
>>>> I'm surprised sAMAccountName (pre-Windows 2000 logon name) is not on
>>>> your list, unless that is what you meant by Name. It can avoid
>>>> confusion if the values of cn and sAMAccountName are the same.
>>>> sAMAccountName must be unique in the domain, a few characters are not
>>>> allowed, and the value is limited to 20 characters (for user objects).
>>>>
>>>> --
>>>> Richard Mueller
>>>> Microsoft MVP Scripting and ADSI
>>>> Hilltop Lab -
http://www.rlmueller.net
>>>> --
>>>>
>>>>
>>>
>>>
>>
>>
>
>