Directory Mate 2003 Help

Group Object Property Pages: Table of Contents

- Creating New Groups  
- General Tab  
- Members Tab  
- Member Of Tab  
- Managed By Tab  

 

Creating New Groups

 

New groups can be created with as much or as little information as you require.  The required columns for creating a group are the "objectClass" column, which must be set to the value "group", the "groupType" column which indicates which type of group you are creating and the "sAMAccountName" column to give the group an account name.  Please refer to the section "Group Types" on the General Tab below for the values to use for the different types of groups.

 

The first line in our import csv file is the names of the columns we will be using:

mode,distinguishedName,objectClass,groupType,sAMAccountName,member

 

mode: This column specifies the type of import operation to be performed.  To create a new group use the value "Create".

 

distinguishedName: The distinguished name specifies the directory name and location for the new object. In the example below the new group will have the directory name "Group 1" and be created in the Groups organizational unit.  For this use the value "CN=Group 1,OU=Groups,DC=MADSolutions,DC=com".

 

objectClass: This column specifies the type of object being created.  Use the value "group".

 

groupType: This column specifies the type of group being created.  For this example, a Global Distribution Group, use the value "2".  (See the section "Group Types" below for values used for various group types). 

 

sAMAccountName:  This column specifies the new account name for the group.  For this example use the value "Group1".

 

member:  This column allows you to specify the members for this group. The full distinguished name for each member should be specified seperated by the "%" character.  Example: "CN=Sally Smith,CN=Users,DC=MADSolutions,DC=com%DC=Richard Booth,CN=Users,DC=MADSolutions,DC=com".  This column is not required if you do not want to specify any members when creating the group

 

A mail enabled group can also be created by specifying the attribute "mailNickname" and using the same value you provided for the sAMAccountName attribute.

General Tab

Group Property Page in the Active Directory Users and Computers MMC contains the following directory attributes.

Tab Field LDAP Name Display Name
Group name (pre-Windows 2000)

sAMAccountName

SAM-Account-Name

Description

description

Description

E-mail

mail

E-mail-Addresses

Notes

info

Comment

Group scope
This value is shared with "Group type".  See section below on how to set this value.

groupType

Group-Type

Group type
This value is shared with "Group scope".  See section below on how to set this value.

groupType

Group-Type

 
To set the group scope and group type...use the following table
Tab Field LDAP Name Value to set
     
Domain local distribution group

groupType

4

Global distribution group

groupType

2
Universal distribution group

groupType

8
     
Domain local security group

groupType

-2147483644
Global security group

groupType

-2147483646
Universal security group

groupType

-2147483640
     

Members Tab

Modifying Group Membership

 

To change the membership of groups, we recommend that you modify users (or other types of objects), just specify the "memberOf" column in your import file during a "Create" or "Modify" operation.  The full distinguished names of the groups you want the user to belong to should be specified with a "%" character inbetween each group.  Example:  "CN=Group1,CN=Users,DC=MADSolutions,DC=com%CN=Acct Group,OU=Accounting,DC=MADSolutions,DC=com".  You can also the objectGUID value of groups to identify them.  Example to identify two groups by their objectGUID with a "%" character to separate them: "4e1adcb77db96f47a282e1fb25d196be%6fbc74ba27697a46867c7836fb427dfc".

 

If you specify the option "Append import file values to the existing values in multi-valued fields" in the import wizard, then the object will be added to the groups you specified and not removed from any groups that they already belong to.

 

If you specify the option "Overwrite values in multi-valued fields with the import file values" in the import wizard, then the object will be added to the groups you specified and removed from any groups that they already belong to.  A special exception to this is the "Domain Users" group.  An object will not be removed from that group if it already belongs to it by using the "Overwrite" option.  It is not possible to remove objects from the "Domain Users" group with Directory Mate.

Member Of Tab

Modifying Group Membership

 

To change the membership of a group, specify the "memberOf" column in your import file during a "Create" or "Modify" operation.  The full distinguished names of the groups you want the group to belong to should be specified with a "%" character inbetween each group.  Example:  "CN=Group1,CN=Users,DC=MADSolutions,DC=com%CN=Acct Group,OU=Accounting,DC=MADSolutions,DC=com".  You can also the objectGUID value of groups to identify them.  Example to identify two groups by their objectGUID with a "%" character to separate them: "4e1adcb77db96f47a282e1fb25d196be%6fbc74ba27697a46867c7836fb427dfc".

 

If you specify the option "Append import file values to the existing values in multi-valued fields" in the import wizard, then the object will be added to the groups you specified and not removed from any groups that they already belong to.

 

If you specify the option "Overwrite values in multi-valued fields with the import file values" in the import wizard, then the object will be added to the groups you specified and removed from any groups that they already belong to.  A special exception to this is the "Domain Users" group.  An object will not be removed from that group if it already belongs to it by using the "Overwrite" option.  It is not possible to remove objects from the "Domain Users" group with Directory Mate.

Managed By Tab

Tab Field LDAP Name Possible Values
Name
Set the value to the distinguished name of the user.  Example: "CN=Administrator,CN=Users,DC=MADSolutions,DC=com"

managedBy

Managed By

Office * see below * see below
Street * see below * see below
City * see below * see below
State/province * see below * see below
Country/region * see below * see below
Telephone number * see below * see below
Fax number * see below * see below

* These values are filled in automatically by the Active Directory Users and Computers console and are taken from the properties of the selected user.