Group Object
Property Pages: Table of Contents |
Creating New Groups
New groups can be created with as much or as little information as you
require. The required columns for creating a group are the "objectClass"
column, which must be set to the value "group", the "groupType" column which
indicates which type of group you are creating and the "sAMAccountName"
column to give the group an account name. Please refer to the section
"Group Types" on the General Tab below for the values to use for the different types of groups.
The first line in our import csv file is the names of the columns we will be
using:
mode,distinguishedName,objectClass,groupType,sAMAccountName,member
mode: This column specifies the type of import operation to be
performed. To create a new group use the value
"Create".
distinguishedName: The distinguished name specifies the directory name and location for
the new object. In the example below the new group will have the directory
name "Group 1" and be created in the Groups organizational unit. For this
use the value "CN=Group 1,OU=Groups,DC=MADSolutions,DC=com".
objectClass: This column specifies the type of object being
created. Use the value "group".
groupType: This column specifies the type of group being created.
For this example, a Global Distribution Group, use the value "2". (See
the section "Group Types" below for values used for various group types).
sAMAccountName: This column specifies the new account name for
the group. For this example use the value "Group1".
member: This column allows you to specify the members for this
group. The full distinguished name for each member should be specified seperated by the "%" character. Example: "CN=Sally Smith,CN=Users,DC=MADSolutions,DC=com%DC=Richard
Booth,CN=Users,DC=MADSolutions,DC=com". This column is not required if
you do not want to specify any members when creating the group
A mail enabled group can also be created by specifying the attribute "mailNickname"
and using the same value you provided for the sAMAccountName attribute.
General Tab
Group Property Page in the Active Directory Users
and Computers MMC contains the following directory attributes.
 |
Tab Field |
LDAP Name |
Display Name |
Group name (pre-Windows 2000) |
sAMAccountName |
SAM-Account-Name |
Description |
description |
Description |
E-mail |
mail |
E-mail-Addresses |
Notes |
info |
Comment |
Group scope
This value is shared with "Group type". See
section below on how to set this value. |
groupType |
Group-Type |
Group type
This value is shared with "Group scope". See
section below on how to set this value. |
groupType |
Group-Type |
|
To set the group scope and group
type...use the following table |
Tab Field |
LDAP Name |
Value to set |
|
|
|
Domain local distribution group |
groupType |
4 |
Global distribution group |
groupType |
2 |
Universal distribution group |
groupType |
8 |
|
|
|
Domain local security group |
groupType |
-2147483644 |
Global security group |
groupType |
-2147483646 |
Universal security group |
groupType |
-2147483640 |
|
|
|
|
Members Tab
 |
Modifying Group Membership
To
change the membership of groups, we recommend that you modify
users (or other types of objects), just specify the "memberOf"
column in your import file during a "Create" or "Modify"
operation. The full distinguished names of the groups you want
the user to belong to should be specified with a "%" character
inbetween each group. Example: "CN=Group1,CN=Users,DC=MADSolutions,DC=com%CN=Acct
Group,OU=Accounting,DC=MADSolutions,DC=com". You can also the
objectGUID value of groups to identify them. Example to
identify two groups by their objectGUID with a "%" character to
separate them:
"4e1adcb77db96f47a282e1fb25d196be%6fbc74ba27697a46867c7836fb427dfc".
If
you specify the option "Append import file values to the
existing values in multi-valued fields" in the import wizard,
then the object will be added to the groups you specified and
not removed from any groups that they already belong to.
If
you specify the option "Overwrite values in multi-valued fields
with the import file values" in the import wizard, then the
object will be added to the groups you specified and removed
from any groups that they already belong to. A special
exception to this is the "Domain Users" group. An object will
not be removed from that group if it already belongs to it by
using the "Overwrite" option. It is not possible to remove
objects from the "Domain Users" group with Directory Mate. |
Member Of Tab
 |
Modifying Group Membership
To
change the membership of a group, specify the "memberOf" column
in your import file during a "Create" or "Modify" operation.
The full distinguished names of the groups you want the group to
belong to should be specified with a "%" character inbetween
each group. Example: "CN=Group1,CN=Users,DC=MADSolutions,DC=com%CN=Acct
Group,OU=Accounting,DC=MADSolutions,DC=com". You can also the
objectGUID value of groups to identify them. Example to
identify two groups by their objectGUID with a "%" character to
separate them:
"4e1adcb77db96f47a282e1fb25d196be%6fbc74ba27697a46867c7836fb427dfc".
If
you specify the option "Append import file values to the
existing values in multi-valued fields" in the import wizard,
then the object will be added to the groups you specified and
not removed from any groups that they already belong to.
If
you specify the option "Overwrite values in multi-valued fields
with the import file values" in the import wizard, then the
object will be added to the groups you specified and removed
from any groups that they already belong to. A special
exception to this is the "Domain Users" group. An object will
not be removed from that group if it already belongs to it by
using the "Overwrite" option. It is not possible to remove
objects from the "Domain Users" group with Directory Mate. |
Managed By Tab
 |
Tab Field |
LDAP Name |
Possible Values |
Name
Set the value to the distinguished name of the user.
Example: "CN=Administrator,CN=Users,DC=MADSolutions,DC=com" |
managedBy |
Managed By |
Office |
* see below |
* see below |
Street |
* see below |
* see below |
City |
* see below |
* see below |
State/province |
* see below |
* see below |
Country/region |
* see below |
* see below |
Telephone number |
* see below |
* see below |
Fax number |
* see below |
* see below |
* These values are filled in automatically by the Active
Directory Users and Computers console and are taken from the
properties of the selected user.
|
|