Certain requirements must be met when creating objects in Active Directory. These can be user accounts, groups, computers, or other classes of objects. This article documents some of these requirements. Errors will be raised if any of these requirements are not met. You can use this article to troubleshoot the possible problems. These requirements apply whether you create objects in the Active Directory Users and Computers MMC, in a script, or using command line utilities.

In this article:

All Classes of Objects

• You must have permissions in Active Directory to create the objects. You must either be a member of the built-in "Administrators" group, the "Account Operators" group, or have been granted the specific permissions in Active Directory required for the class of objects you are creating.
• You must use the "Run as administrator" feature if your client is Windows Vista or above. Otherwise normal user credentials will be used, which doesn't allow creation of objects in Active Directory. For example, if you use a VBScript program to create users, start an elevated command prompt by right clicking a shortcut to cmd.exe and selecting "Run as administrator".
• The Relative Distinguished Name (RDN) of the new object must be unique in the parent Organizational Unit or container. The parent OU/container is where the new object will reside in Active Directory. The RDN for user, group, computer, contact, and container objects is the value of the cn attribute (the "Common Name"). The RDN of Organizational Unit objects is the value of the ou attribute.
• The Relative Distinguished Name (RDN) is limited to 64 characters.
• Certain characters in the Relative Distinguished Names of objects must be escaped using the backslash, "\", escape character. The characters that must be escaped are:
  , \ # + < > ; " =
  In addition, any leading or trailing spaces in the RDN must be escaped. If ADSI is used to create the objects, then the forward slash character, "/", must also be escaped. ADSI is used by VBScript and the [ADSI] and [ADSISearcher] accelerators in PowerShell. For example, if the Common Name of a new user created in a script is "Smith, James", you must specify "Smith\, James" when you create the object. If you use the Active Directory Users and Computers MMC, the system will escape any characters that need it for you.
• The PowerShell New-AD* cmdlets, such as New-ADUser, New-ADComputer, New-ADGroup, New-ADObject, and New-ADOrganizationalUnit, will automatically escape any characters required by Active Directory.

↑ Return to Top

Objects with sAMAccountName Attribute

• The value assigned to the sAMAccountName attribute (pre-Windows 2000 Name) must be unique in the domain.
• The following characters are not allowed in sAMAccountName values:
  " [ ] : ; | = + * ? < > / \ ,
• In Windows Server 2003 domains and above, if you do not assign a value for sAMAccountName, the system will create a semi-random value for your. This value will be similar to:
  $KJK000-H4GJL6AQOV1I
  In Windows 2000 Server Active Directory the sAMAccountName attribute is mandatory and an error is raised if you fail to assign a value before the object is saved to Active Directory.
• The schema allows 256 characters in sAMAccountName values. However, the system limits sAMAccountName to 20 characters for user objects and 16 characters for computer objects.

↑ Return to Top

User Objects

• The value of the cn attribute is limited to 64 characters.
• The value of the sAMAccountName is limited to 20 characters.

↑ Return to Top

Computer Objects

• The value of the cn attribute is limited to 64 characters.
• The value of the sAMAccountName is limited to 20 characters, if you assign the value in code. However, ADUC limits the sAMAccountName to 16 characters. In fact, the sAMAccountName should be the NetBIOS name of the computer with a trailing "$" character appended to the end. This in affect limits the NetBIOS name to 15 characters.
• The Fully Qualified Domain Name (FQDN) is limited to 64 characters. For example, the computer "MyComputer-1234" in the domain "Engr.WestRegion.NorthAmerica.Company.MyDomain.com", has FQDN "MyComputer-1234.Engr.WestRegion.NorthAmerica.Company.MyDomain.com". This is not allowed because the FQDN has 65 characters.
• If you use the Create method exposed by the IADsContainer interface and specify a class of "computer", but do not specify a value for userAccountControl, the new object will have class computer, but sAMAccountType will be 805306368 (approproriate for a user) and userAccountControl have a value appropriate for a user, such as 546. You must assign a value to the userAccountControl attribute appropriate for a workstation or server. The system will then assign the correct value to sAMAccountType, which is 805306369.

↑ Return to Top

Group Objects

• The value of the cn attribute is limited to 64 characters.
• The value of the sAMAccountName attribute is limited to the value specified in the Schema, which by default is 256 characters.
• The groupType attribute of group objects is mandatory. If you create a group in code you should assign a value appropriate for the type of group.

↑ Return to Top

Contact Objects

• The value of the cn attribute is limited to 64 characters.

↑ Return to Top

Community Resources

Active Directory Maximum Limits - Scalability
http://technet.microsoft.com/en-us/library/cc756101.aspx

↑ Return to Top