Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

It seems that in my Active Directory (win2k8r2), there is a restriction on the name of a user. NOT the username, but the display name. I tried adding two users with the same same (different accounts), but it wouldn't let me because of the duplicate name.

If I try the same across two OU's, it does work.

Is there a way to switch of this restriction? I've got two users which belong to the same OU which happen to have the exact same display name.

share|improve this question

migrated from stackoverflow.com Sep 10 '11 at 20:07

This question came from our site for professional and enthusiast programmers.

1 Answer 1

up vote 3 down vote accepted

In AD the CN (initiall derived from Display Name when an account is created) must be unique within the same OU. The reason is that the DistinguishedName value must be unique and the DistinguishedName is composed of the domain\ou(s)\CN so if the domain is the same and the ou is the same, the CN must be different. When you first create a user in AD the First and Last name are combined to form the CN and the displayName attributes (Last, First), but these can be changed after creation as in the example below.

Example workaround:

If you have two user's with the same name that need to go in the same OU you would do the following.

  1. Create the first user Joe Smith (DN will be yourdomain.com\Accounting\"Smith, Joe")
  2. Rename "Smith, Joe" to something like "Smith, Joe L" (DN will be yourdomain.com\Accounting\"Smith, Joe L."
  3. Create the second user Joe Smith (DN will be yourdomain.com\Accounting\"Smith, Joe")
  4. At this point you can let the second joe smith stay "Smith, Joe" or you can change it like in step 2.

This is fundamental LDAP behavior - not just AD. The DN is the unique identifier - kind of similar to a URL.

If it didn't work this way then when searched for (dn=mydomain.com\Users\Accounting\Smith, Joe) you would get back two user objects assuming you had to Joe Smith users in the accounting ou.

To avoid this problem some organizations will sometimes use an employee ID as the CN which is always unique. This doesn't effect the user's name which is derived from the sn and givenName attributes.

share|improve this answer
    
The technical term for this part of the object's DN is the RDN or Relative Distinguished Name. The RDN always has to be unique within the container. AD does not let you differentiate by the RDN attribute, though (unlike some directories), so, you can't have say "cn=bob" and "uid=bob" as two RDNs in the same OU. –  Brian Desmond Sep 9 '11 at 18:07
    
Step 2 in workaround didn't work for me. Even though you can change the First and Last and and even the display name of the first created account "Joe Smith" - the CN= is already created. If I try to create a new firstname=Joe and Lastname=Smith - even with a different samaccountname, It tries to create same CN= and fails. Same server win2kr2 –  Randy Spina Feb 11 at 13:27
    
@Randy from ADUC, go to the account you want to change the CN of, then press F2. Confusingly, the DisplayName is not what gets shown in the ADUC MMC snap-in. Instead, what gets displayed in ADUC is the CN. –  pepoluan Feb 11 at 18:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.