Add an AD LDS User to the Directory

  • Article

Applies To: Windows Server 2008

You can administer users and groups in Active Directory Lightweight Directory Services (AD LDS) through the Active Directory Service Interfaces (ADSI) Edit snap-in or through your directory-enabled applications.

To create users in AD LDS, you must either import the optional user classes that are provided with AD LDS into the AD LDS schema or create your own user object definitions. The AD LDS optional user classes are provided in importable .ldf files, which you can find in the directory %windir%\adam on the computer where AD LDS is installed. For more information, see Import the User Classes Supplied with AD LDS.

Membership in the Administrators group of the AD LDS instance is the minimum required to complete this procedure. By default, the security principal that you specify as the AD LDS administrator during AD LDS setup becomes a member of the Administrators group in the configuration partition.

To add an AD LDS user to the directory

  1. To open ADSI Edit, on a computer with the AD LDS server role installed, click Start, click Administrative Tools, and then click ADSI Edit.

  2. Connect and bind to the AD LDS instance and directory partition to which you want to add a user. For more information, see Manage an AD LDS Instance Using ADSI Edit.

  3. In the console tree, double-click the directory partition to which you want to add the user.

  4. In the console tree, right-click the container to which you want to add the user, point to New, and then click Object.

  5. In Select a class, click the class that you want to use (user, inetOrgPerson, person, or OrganizationalPerson), and then click Next.

  6. In Value, type a value for the common name (CN) attribute of the new user, and then click Next.

  7. If you want to set values for additional attributes, click More attributes.

  8. After setting any additional attributes for the new user, click Finish.

Additional Considerations

  • By default, an AD LDS user account is enabled when the user account is created. However, no initial password is set on an AD LDS user account that is created with ADSI Edit. On AD LDS instances running on Windows Server 2008, where local or domain password policy restrictions are in effect, the AD LDS user account is disabled by default. Before you can enable the user account, you must set a password for it that meets the password policy restrictions that are in effect.

  • Any object class can be used as a security principal in AD LDS, if the object class definition contains the msds-bindableObject static auxiliary class and the unicodePwd attribute.

  • The user, inetOrgPerson, and OrganizationalPerson object classes are not available until you import the AD LDS user class definitions into the schema.