5

In my Microsoft active directory environment almost every organizational structure is an Organizational Unit. There are two common exceptions to this rule, the Computers object and the Users object. These are the default objects that are created when you setup Active Directory. Whenever I read anything about these objects, I am told that they use "Container Names" for backwards compatibility. From what I understand, these objects were configured that way when active directory was setup. My main question is this:

What will break if you convert to using OU's for these objects? I'm asuming the only way to do it is to create new OU's, redirect active directy to use these new OU's, and then delete the old CN objects.

I realize it's not a recommended procedure, but I want to know why.

Bonus Questions

  • Did the active directory developers give a reason why the Computers and Users objects were created using a CN and not as a normal OU?
  • Is it even possible to delete the default objects?
2
  • They aren't Organizational Units because they aren't part of your organization. There are at least seven top-level containers, and Computers and Users are flagged DisallowDelete, DisallowRename, DisallowMove, and isCriticalSystemObject. That's a good sign that you are way off-track. – Greg Askew Feb 17 '15 at 20:09
  • 1
    If they are not part of the organization, why are they used as part of the organizational structure? I totally get that Microsoft did a lot of work to prevent anyone from messing with them. What I want to know is why. Why are these objects so important? I can't find anyone who seems to know that answer. Everyone just points to a Microsoft KB that tells you not to do it. – Doltknuckle Feb 20 '15 at 0:10
3

These containers exist for backward compatibility with NT4-based domains when being upgraded to Windows 2000 AD domains, and many other reasons that are due to NT4 compatibility with Windows 2000.

MS KB 324949 provides a good explanation of the reasons behind this due to legacy ("earlier-version") api calls: https://support.microsoft.com/en-us/help/324949/redirecting-the-users-and-computers-containers-in-active-directory-domains

In a default installation of an Active Directory domain, user accounts, computer accounts, and groups are put in CN=objectclass containers instead of being put in a more desirable organizational unit class container. Similarly, user accounts, computer accounts, and groups that were created by using earlier-version APIs are put in the CN=Users and CN=computers containers.

Users, computers, and groups that are created by earlier-version APIs place objects in the DN path that is specified in the WellKnownObjects attribute that is located in the domain NC head. The following code example shows the relevant paths in the WellKnownObjects attribute from the CONTOSO.COM domain NC head.

5

I'd advise against messing with those objects. It is typical to create new OUs and then move any necessary objects to your new OUs. You can then use redircmp (https://technet.microsoft.com/en-us/library/cc770619.aspx) to change where computer objects are created by default.

3
  • 2
    Never modify the default Computers and Users containers unless it's your last day in the job...because it will be. – I say Reinstate Monica Feb 6 '15 at 18:07
  • That's great, but misses the point of the question.The internet is full of tricks to not use these objects, but I want to know why they were put there in the first place. What problem were the developers of active directory solving by having these objects be different from everything else? – Doltknuckle Feb 20 '15 at 0:12
  • I'm not sure serverfault is the right place for a history question, and you'd probably need to find some old Microsoft developers to get a full answer. Going into the bowls of TechNet, I found this article that talks about the default containers, and it lists both the Computer and Users containers as default locations for objects created through legacy APIs that are not Active Directory–aware. technet.microsoft.com/en-us/library/cc773295(v=ws.10).aspx So the answer is the same as for lots of other strange things in Windows, backwards compatibility. – E-Rock Feb 20 '15 at 3:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.