2

Can I have 2 different groups in Active Directory in different containers that have the same name? For example, can I have an OU=baz that contains a group CN=foo and an OU=bar with a group CN=foo? This is all in the same domain.

Does it make a difference what the group type is? I have been playing around with ADAM, and it seems like this is possible, but I was not sure if a production AD instance might not allow this sort of thing.

Thanks, Carl

Improve this question

1 Answer 1

Reset to default
3

In generic LDAP implementations, you can do this. In Novell NDS, you can do this. In MS DS (AD), you can't reuse names in a single domain, although you could have identical names in different domains (but in the same AD tree or forest.)

Improve this answer
2
  • 1
    Actually you can have two groups called cn=foo in the same domain. They cant exist within the same parent node though. If you were doing this through tools like aduc.msc you will find the 2nd group creation is blocked. Thats becase samaccountname is no longer unique in the domain. If you were to change the first object to have a samaccountname of foo1, you can proceed to create the second with cn=foo. Only gotcha is if people assume cn=foo has a matching samaccountname always, they may be confused when they try create cn=foo1 (as it will try to set samaccountname to foo1) and fail.
    – maweeras
    Feb 2, 2012 at 7:38
  • Nice description of a corner case. That matches with what I know; it's the samaccountname that can't be duplicated, within a single domain. The first part of a DN can be identical as long as the rest of it is unique, and the sam as well.
    – mfinni
    Feb 2, 2012 at 14:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .