Windows Server 2008 : Working with Active Directory Accounts - Redirecting Computer Accounts, Redirecting User Accounts

1. Redirecting Computer Accounts

When a computer joins a domain, the computer account is added to the Computers container by default; however, you can change the default behavior with the redircmp command. The basic syntax is

redircmp target-DN

Tip

The target-DN can be any container or OU but is typically an OU.

For example, if you want new computers to be placed into an OU you’ve created called New Computers (shown in Figure 1), you can use the following command:

redircmp "ou=new computers,dc=pearson,dc=pub"

Figure 1. New Computers OU in ADUC

The primary reason to do this is to control the new computers with a Group Policy Object (GPO). You can create a GPO that configures security settings or install software for all new computers placed into this OU. As soon as a computer joins the domain, the GPO applies these settings.

Tip

You can link a GPO to an OU but not to a container such as the Computers container or the Users container.

2. Redirecting User Accounts

You can also redirect new user accounts that are created with the net user command. The basic syntax to redirect user accounts is

redirusr target-DN

Tip

If the user account is created with a DN (such as with dsadd, csvde, or ldifde), the target DN is already specified. The redirusr command does not override these commands. However, because the net user command doesn’t specify a DN, the redirusr command redirects these user accounts.

For example, the following command redirects all user accounts created with the net user command to the Sales OU:

redirusr "ou=sales,dc=pearson,dc=pub"

Most methods of creating user accounts identify the target location. For example, if you’re using ADUC, you simply right-click over the target OU and select New, User. If you’re using csvde or ldifde, the target OU is included in the DN.

It’s not as common to create accounts with the net user command, but it can be done. The basic syntax is

net user username [password] /add

For example, the following command creates an account for a user named Maria:

net user Maria P@ssw0rd /add

Tip

If you run the net user command on a DC, it adds the account to AD. If you run it on a member server or a standalone system, it adds it as a local account.