Copyright: Saturday, January 04, 2003 15:50:30


Click this option to change the type of objects displayed in the current Active Directory console. For example, to create a console that displays only Computer objects, click
Computers. You can create different filters to customize consoles for different users and purposes.


Click this to force the user to change the password at the next logon.


Provides a space for you to type a case-sensitive password up to 127 characters. If you are on a network with computers running Windows 95 and Windows 98, avoid passwords longer than 14 characters. Type the password again in Confirm password to confirm the password.

It is a security best practice to use a strong password. For more information, see Strong passwords.


Type the contact's name as it is to appear in Active Directory.


Click to open the Find Custom Search dialog box that you use to select objects for creating a custom filter for Active Directory.


Type the user's name as it is to appear in Active Directory.


Type the contact's full name in this space.


Type a name for the group for use by Active Directory. This name must be unique within the domain.


Type the fully qualified user name in this space.


Type the contact's first name in this space.


Type the user's first name in this space.


Type the contact's last name in this space.


Type the user's last name in this space.


Use this space to control the maximum number of objects that can be displayed for any single folder in the Active Directory console tree. You can enter a number from 0 to 1,000,000,000. The default value of this setting is 2,000.


This is the user account name as defined by the Windows NT 4.0 Security Accounts Manager. This account name is used for logging on to a Windows NT 4.0 network. It is supported by the Windows  Server 2003 family to provide compatibility.


Type a name for the group for use by pre-Windows 2000 operating systems and applications.  This name is used to provide backward compatibility for the group. The default value is the Active Directory name of the group.


Type the user's pre-Windows 2000 logon name here. This user name is used in the pre-Windows 2000 format which is domainname\username.


Lists the available user principal name (UPN) suffixes that may be used to create the user logon name. The list contains the full DNS name of the current domain, the full DNS name of the root domain of the current forest, and any alternative UPN suffixes created through Active Directory Domains and Trusts.


Type the user's name that is used to log on to the domain.


Click this button to search for a domain.


Provides a space for you to type the name of the domain controller running Windows 2000 Server or Windows  that you want to connect to. You can specify any domain controller running Windows 2000 Server or Windows  in the currently selected domain. The focus of the Active Directory console will change to the domain controller you specify. The default value Any Writable Domain Controller finds any available domain controller running Windows 2000 Server or Windows  in the currently selected domain.


This is a list of all domain controllers running Windows 2000 Server or Windows  in this domain. Click the domain controller that you want to use.


Displays the fully qualified domain name of the domain that is the current focus of the Active Directory console. Domain controllers that exist in this domain are listed as available domain controllers. You can change the focus of the console to any one of the available domain controllers in the currently selected domain.


Click Browse to display a list of domains contained in the domain tree or forest. You can then change the focus of the Active Directory console to the selected domain.


Displays the fully qualified domain name of the domain that is the current focus of the Active Directory console. To change the focus of the Active Directory console to another domain, type the full DNS name of the domain here.


Specifies whether to save the current domain focus for the console. If selected, the next time the console is opened, the console will focus on the domain listed here.


Displays the fully qualified domain name of the forest that is the current focus of the Active Directory console. To change the focus of the Active Directory console to another forest, type the full DNS name of the forest here.


Specifies whether to save the current forest focus for the console. If selected, the next time the console is opened, the console will focus on the forest listed here.


Click this option to display all Active Directory objects in the Active Directory console. Show all types of objects is the default selection.


Click this option to activate the list of objects that you can select as filter objects for the Active Directory console.


Click this option to create a customized Active Directory console. You create a filter by creating a query for directory objects.


Every user account in Active Directory has a name that identifies the user account and that is used to authenticate the user during the network logon process. The user account name is a short common name for the user, and generally corresponds to the leftmost portion of the user’s e-mail address. The user account name on a Windows  network may be the same as the security account name used in previous versions of Windows. A user name cannot be identical to any other user or group name existing in the domain or computer being administered. It can contain up to 20 uppercase or lowercase characters except for the following:

"  /  \  [  ]  :  ;  |  =  ,  +  *  ?  <  >

A user name cannot consist solely of periods (.) or spaces.


This is the currently selected domain controller from which Active Directory Users and Computers is reading and displaying information.


This is the domain controller that is currently the relative identifier (RID) master. For more information, see Operations master roles.


Click this button to transfer the relative identifier (RID) master role from the current server to the current focused domain controller. If the current domain controller and the current RID master are the same, a message will appear indicating that you should first change the focus to the domain controller that will become the RID master. For more information, see Transferring operations master roles.


This is the currently selected domain controller from which Active Directory Users and Computers is reading and displaying information.


This is the domain controller that is currently the infrastructure master. For more information, see Operations master roles.


Click this button to transfer the infrastructure master role from the current server to the current focused domain controller. If the current domain controller and the current infrastructure master are the same, a message will appear indicating that you should first change the focus to the domain controller that will become the infrastructure master. For more information, see Transferring operations master roles.


This is the currently selected domain controller from which Active Directory Users and Computers is reading and displaying information.


This is the domain controller that is currently the primary domain controller (PDC) emulator master. For more information, see Operations master roles.


Click this button to transfer the primary domain controller (PDC) emulator master role from the current server to the current focused domain controller. If the current domain controller and the current PDC emulator master are the same, a message will appear indicating that you should first change the focus to the domain controller that will become the PDC emulator master. For more information, see Transferring operations master roles.


Type your network password in this field.


This list displays objects within the domain. Highlight an object from this list, and then click OK.


Click this button to add additional objects to the list for the selected account.


Click this button to make changes to the selected object in the list.


Click this button to remove the selected object from this list.


This list displays the distinguished name (DN) for each certificate that is mapped to the selected account.  A server application can then use public key technology to authenticate the user using this certificate.


This list displays the accounts from trusted non-Windows Kerberos realms that are mapped to the selected account.


This is the fully qualified domain name for the selected account.


Lists the available domains to which you can connect.


Provides a space for you to type the name of the query.


Provides a space for you to type a description of the query.


Displays the container in which to search for specified objects.


Specifies whether to search subcontainers, including all objects, of the selected query root.


Click to define a commonly used query. Three types of queries can be defined: users, computers, or groups. You cannot define a query that contains a combination of users, computers, or groups.


Displays the LDAP string for this query.


Lists the search variables used to find user, computer, or group names. In the space provided, type the name of user, computer, or group that you want to find.


Lists the search variables used to find user, computer, or group descriptions. In the space provided, type the description of the user, computer, or group that you want to find. The description search is based on the descriptions that are defined in the user, computer, or group Properties dialog box.


Specifies whether the search will include disabled accounts.


Specifies whether the search will include user accounts with non-expiring passwords.


Specifies the number of days that users within the specified query root last logged on to the domain.


Provides a space for you to type the name of a new folder, which will contain your saved queries.


Click to select the query root container.


Provides a space for you to type in the Kerberos principal name. The Kerberos principal name must identify the user account that resides in the non-Windows Kerberos realm. For example, if the non-Windows Kerberos realm is microsoft, and the user account name is someone, the Kerberos principal name would be: someone@microsoft.com


Lists the containers that you can specify as the query root.


Lists the properties contained in the certificate.


Specifies that alternate security identifier information will be provided during authentication, and that the alternate security identifier information will be the issuer of the certificate.


Specifies that alternate security identifier information will be provided during authentication, and that the alternate security identifier information will be the subject of the certificate.


Select this option to repair a computer account on the domain controller.


Select this option to repair a computer account's password on the domain controller.


Select this option to repair the account type of the computer.


Select this option to synchronize the time service on the domain controller.


Select this option to reset the Active Directory services on the domain controller.


Select this option to synchronize the Active Directory replication service and all files that require synchronization.