In AD the CN (initiall derived from Display Name when an account is created) must be unique within the same OU. The reason is that the DistinguishedName value must be unique and the DistinguishedName is composed of the domain\ou(s)\CN so if the domain is the same and the ou is the same, the CN must be different. When you first create a user in AD the First and Last name are combined to form the CN and the displayName attributes (Last, First), but these can be changed after creation as in the example below.
If you have two user's with the same name that need to go in the same OU you would do the following.
- Create the first user Joe Smith (DN will be
- Rename "Smith, Joe" to something like "Smith, Joe L" (DN will be
yourdomain.com\Accounting\"Smith, Joe L."
- Create the second user Joe Smith (DN will be
- At this point you can let the second joe smith stay "Smith, Joe" or
you can change it like in step 2.
This is fundamental LDAP behavior - not just AD. The DN is the unique identifier - kind of similar to a URL.
If it didn't work this way then when searched for (dn=mydomain.com\Users\Accounting\Smith, Joe) you would get back two user objects assuming you had to Joe Smith users in the accounting ou.
To avoid this problem some organizations will sometimes use an employee ID as the CN which is always unique. This doesn't effect the user's name which is derived from the sn and givenName attributes.