Friday, 26 August 2011

Changing the default User and Computer OU

I like to keep my "Real" Users in a separate folder away from all the other system accounts. This ensures that only valid accounts are displayed if you use LDAP lookups for various applications (e.g. a network scanner)


Windows 2003 introduced a couple of new commands that allow you to change the default location:


Users:


   ReDirUsr "OU=RealUsers,DC=domain,DC=com"


Computers:


   ReDirCmp "OU=RealComputers,DC=domain,DC=com"


You need to run this on a Domain Controller, and you need the AD to be in Windows 2003 mode as a minimum.


As you want to ensure the path to the new directory is correct, I recommend Softerra LDAP browser (it's free) which allows you to connect to the AD with LDAP and copy object locations.


I hope this helps you out...please click on an advert to show your appreciation.