I am a self-taught administrator of a work Active Directory network used for Windows logins on ~30 PCs. I inherited the system from someone else who also didn't have any direct Microsoft training and as a result I am in the dark on a couple things.

The network itself has a single Windows Server 2008 R2 machine acting as domain controller, DNS, file shares, etc. Logins work fine, but I was poking around the list of users while disabling old accounts and I noticed something I don't quite understand.

Here are a couple sample user accounts:

  1. Logon Name: john
    First Name: John
    Last Name: Smith
    Display Name: John Smith
    Canonical Name of Object: domain.com/Users/john

  2. Logon Name: bob
    First Name: Bob
    Last Name: French
    Display Name: Bob French
    Canonical Name of Object: domain.com/Users/Bob French

The current domain controller was swapped in from another one that used to run Windows Server 2003. The first sample account was created when the Server 2003 box was DC, the second was created when the newer Server 2008 R2 box was DC. Why is the Canonical Name different, and does it make any difference?

I'm mostly annoyed by the fact that my users list in the active directory browser has half the accounts as 'firstname' and half as 'firstname lastname'.

Can I do something to make all of them the same without breaking working accounts?

  • Do you actually store the users in the domain.com/Users OU? Or is it just an example? – Mathias R. Jessen Feb 18 '14 at 17:21
  • Yes - they are all in domain.com/Users/ along with a number of security groups. Is this bad practice? Should I move them? Can I move them without wrecking everything? – evilspoons Feb 18 '14 at 17:24
  • 2
    Unless you have external applications using simple binds for authentication, yes - you can safely move them - and you should. It gives much better control over Group Policy appliance to separate them from the well-known security groups. I'll update the answer to cover this as well – Mathias R. Jessen Feb 18 '14 at 17:35
  • 2
    It depends on how many objects are in your AD and on how you want them organized; generally, it's better to place them in OUs to better organize them and apply GPOs to them, and it's considered best practice to leave the default containers (such as "Users" alone). – Massimo Feb 18 '14 at 17:43

Active Directory does not really concern itself with how the User account object's RDN (the last part of the Canonical Name) relates to other properties like the Display Name or the Logon Name - as long as the value of each individual attribute doesn't violate the schema definition.

The behavior of the "New User" form in Active Directory Users and Computers (as well as a number of other dialogues) has changed significantly between Windows Server 2003 and Windows Server 2008 R2 - and that's probably why they're not consistent

You can use PowerShell to move the non-system accounts, and then go through the users and rename them to whatever their Display Name is:

# Create new OU named RegularUsers
New-ADOrganizationalUnit -Name RegularUsers -Path "dc=domain,dc=com"

# Retrieve all users that are not critical system objects
$users = Get-ADUser -SearchBase "CN=Users,DC=domain,DC=com" -SearchScope OneLevel -Filter {-not(isCriticalSystemObject -like '*')}

# Go through each and move to the new OU
foreach($user in $users){
    Move-ADObject $user -TargetPath "OU=RegularUsers,DC=domain,DC=com"

# Retrieve all users in the new OU
$movedUsers = Get-ADUser -SearchBase "CN=Users,DC=domain,DC=com" -SearchScope OneLevel -Filter '*'

foreach($user in $movedUsers){
    # Test if Display Name and object Name is the same, if not - rename
    if($user.DisplayName -ne $user.Name)
        Rename-ADObject $user -NewName "$($user.DisplayName)" 

For the first step, you could also just highlight all the user accounts in ADUC and drag-n-drop them to another location.


The CN/DN of an object is not all that relevant, as it is only used internally by AD and in LDAP queries; end users (and administrators) very rarely get to even see it. It actually changes on its own when you move objects around, because it includes the full LDAP path of the object.

If you want to standardize it, this can be done without any side effects; the only thing users are actually concerned with is their logon name, and as long as you don't change that, they will continue to log on as usual.

To change it, you can either use the ADUC console, or the PowerShell command Rename-ADObject.

  • 2
    I'd say CN/DN is important when it comes to integrating with applications. AD integration is usually not found, where LDAP usually is. It's nice to have your CN/DN follow a standard. It looks prettier too :) Great information on how to actually change it though. – Steve Butler Feb 18 '14 at 18:08

The dsmove command should be able to change the canonical name for you. I've done this in test environments but never in live environments so I would advise proceeding with caution.

Also, semi-related, I would advise implementing another domain controller to avoid a headache should your only DC go down.

  • If the domain & forest's functional level is at Server 2008 R2, can the old Server 2003 box act as a secondary DC or do we need to upgrade that machine's OS? – evilspoons Feb 18 '14 at 17:39
  • 2
    You can't raise the domain/forest functional level to version X unless all DCs in the domain/forest have at least that OS release. – Massimo Feb 18 '14 at 17:41
  • @evilspoons yes, you can, but as massimo says, it will have to be at a 2003 Domain level in order to do that. – Steve Butler Feb 18 '14 at 18:10
  • 4
    @SteveButler Since DFL/FFL 2008R2 can't be reverted further than level 2008, "yes" is definitely not the answer here – Mathias R. Jessen Feb 18 '14 at 18:37
  • Alright, so my options are rebuild the domain at a 2003 level (not going to happen) or upgrade the 2003 box to 2008 R2 (also probably not going to happen, my boss would sooner spend the money on a new machine than play with an old one). I'll make extra sure our backups are good though, just in case something DOES die... – evilspoons Feb 18 '14 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.