Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm creating some AD LDS objects. In AD I'm prompted with this window.

enter image description here

What's the difference between 'container' and 'group'? Is there a web resource that lists the difference? I haven't been able to find one yet.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

The 'container' class is for AD folders that aren't OUs, e.g. the automatically created 'Users' folder. the 'group' class is for Security or Distribution groups that can have users, computers, or other groups as members.

An object being inside a container affects it's DN. If I put a user with a CN of 'jdoe' in the 'Users' folder, it's DN will be 'CN=jdoe,CN=Users,DC=domain,DC=com'. If 'jdoe' becomes a member of a 'group', that would not change his DN.

share|improve this answer
    
If a LDAP directory was a file system, organizationalUnit would be folders and users would be files. Groups would be zip files, I guess. Obviously, a directory (LDS) has much more to offer... –  ixe013 Dec 12 '12 at 17:49

The Active Directory Schema documentation should have everything you need.

The container object has the following definition:

This class is used to hold other classes.

The group object has the following definition:

Stores a list of user names. Used to apply security principals on resources.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.