up vote 0 down vote favorite
share [g+] share [fb]

Can I have 2 different groups in Active Directory in different containers that have the same name? For example, can I have an OU=baz that contains a group CN=foo and an OU=bar with a group CN=foo? This is all in the same domain.

Does it make a difference what the group type is? I have been playing around with ADAM, and it seems like this is possible, but I was not sure if a production AD instance might not allow this sort of thing.

Thanks, Carl

link|improve this question
feedback

1 Answer

up vote 1 down vote accepted

In generic LDAP implementations, you can do this. In Novell NDS, you can do this. In MS DS (AD), you can't reuse names in a single domain, although you could have identical names in different domains (but in the same AD tree or forest.)

link|improve this answer
Thanks. I wasn't sure about this. – user55749 Feb 1 at 21:40
1  
Actually you can have two groups called cn=foo in the same domain. They cant exist within the same parent node though. If you were doing this through tools like aduc.msc you will find the 2nd group creation is blocked. Thats becase samaccountname is no longer unique in the domain. If you were to change the first object to have a samaccountname of foo1, you can proceed to create the second with cn=foo. Only gotcha is if people assume cn=foo has a matching samaccountname always, they may be confused when they try create cn=foo1 (as it will try to set samaccountname to foo1) and fail. – maweeras Feb 2 at 7:38
Nice description of a corner case. That matches with what I know; it's the samaccountname that can't be duplicated, within a single domain. The first part of a DN can be identical as long as the rest of it is unique, and the sam as well. – mfinni Feb 2 at 14:37
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.