Using The Directory Service Command-line Tools In Windows Server 2003

By Author: Chily Software
Total Articles: 6
Comment this article

Effectively managing users in Active Directory is the task with which an administrator needs to be involved on regular basis so that the users can smoothly work on their respective computer systems. Users' management in Active Directory includes creating new user accounts, resetting passwords of the expired user accounts, enabling the disabled user accounts, etc. The administrator always needs to perform the specified tasks on urgent basis to provide the pause-free working environment. For example, if the password of a user's account is expired, then until the administrator does not reset the password; the user cannot logon to the system, which results in delayed output. Therefore, the administrator deals with users' management related tasks on priority.

There are many tools available to manage users' in Active Directory but the tool that administrator mostly use is Directory Service command-line tool. However, to impeccably manage users in Active Directory, the administrator must have sound knowledge about the related commands. This article depicts the processes and commands required for impeccable users' management. ...
... Therefore, the article will be beneficial for the novice administrators and the one looking for methods to manage users in Active Directory. Mentioned below are the topics under which the processes to manage users in Active Directory through Directory Service command-line tool are described:

. Create a New User Account

. Reset Password

. Disable or Enable a User Account

. Delete a User Account

Create a New User Account

Execute the following steps to create a new user account in Active Directory:

1. Click Start > All Programs > Accessories > Command Prompt. The command prompt window appears.

2. Now, you have to specify the User ID and name of the user whose account you want to create in Active Directory. Type the following command in command prompt window to specify user ID and name:

dsadd user userdn -samid sam_name

In the preceding command:

. userdn indicates the distinguished name of the user that you want to add in Active Directory.

. sam_name indicates the name of the Security Account Manager (SAM), which must be unique.

3. After specifying the user name, you have to specify a password for the user account. Type the following command to specify the password:

dsadd user userdn -pwd password_value

In the preceding command, password_value indicates the value that you want to specify as the password for user account.

Note: If you want to gather more information about the parameters used in preceding commands then type dsadd user /? at command prompt.

Reset Password

Mentioned below are the steps following which you can easily reset a user's account password:

1. Click Start > All Programs > Accessories > Command Prompt. The command prompt window appears.

2. Execute the following command to reset the user's password:
dsmod user user_dn -pwd new_pass_value

In the preceding command:

user_dn indicates the name of the user account whose password you want to reset.

. new-pass_value indicates the new password value for the specified user account.

. Note: If you want to collect more information about the parameters used in preceding command then type dsmod user /? at command prompt.

Disable or Enable a User Account

Execute the following steps to enable or disable a user account:

1. Click Start > All Programs > Accessories > Command Prompt. The command prompt window appears.

2. Execute the following command to enable or disable the user account:
dsmod user user_dn -disabled {yes | no}

In the preceding command, chose yes or no. If you want to disable the user account then type yes in { } braces otherwise type no.

Delete a User Account

Undertake the following steps to delete a user account from Active Directory:

1. Click Start > All Programs > Accessories > Command Prompt. The command prompt window appears.

2. Execute the following command to delete the user account:

dsrm user_dn

In the preceding command, user_dn specifies the user's account name that you want to permanently delete from Active Directory.

When you delete an account from Active Directory using the preceding command then all of the permissions and memberships associated with that accounts also get deleted.

Note: If you want to collect more information about the parameters used in preceding command then type dsrm /? at command prompt.

This way the users management related tasks can be done with the Directory Service command-line tool. Using the Directory Service command-line tool for managing Active Directory is quite complex and lengthy; therefore, requires a considerable time. Moreover, the commands must be on tips. A little mistake in specifying parameters with a command can result in unpredictable output. Thus, taking advantage of the Directory Service command-line tool requires lots of time, proactive nature, and hands-on exposure on commands.

Executing such long processes were fine until there was no choice for the administrator; but today, all of the users management related tasks can be done easily; even without using long and complex commands, and spending significant time. Yes, this is possible with the use of Active Directory Management tools that provide graphical user interface for quickly and efficiently creating and managing Active Directory users. With an effective Active Directory User Management tool, there will be no need for the administrator to remember long and complex commands to perform a simple task like deleting a user account.