Copying a new user from an existing user in ADUC

magus474
magus474 used Ask the Experts™
on
In Active Directory Users and Computers, one can right click on an existing account and select "Copy" to create a new user account which includes much of the same information as the original account (Department, Title, Group Memberships, etc.).  I would like to know how to add and remove the attributes that it copies over into the new user.  I suspect this is doable through adsiedit.msc but have not been able to discover how.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
PowerShell Developer
Top Expert 2010
Commented:

An attribute is copied if the searchFlags attribute (in the Schema) contains a specific flag. See:

http://msdn.microsoft.com/en-us/library/ms679765(VS.85).aspx

That means you can find all attributes which will be copied by using this LDAP Filter against the Schema:

(searchFlags:1.2.840.113556.1.4.803:=16)

For instance, if you were to use PowerShell and Quest's CmdLets to find those attributes it would be:

$Schema = ([DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()).Schema.Name
Get-QADObject -SearchRoot $Schema -LdapFilter "(searchFlags:1.2.840.113556.1.4.803:=16)"

Or with ADFind:

ADFind.exe -schema -f "searchFlags:1.2.840.113556.1.4.803:=16" lDAPDisplayName

You can add attributes to the copied set by modifying that flag in the Schema (with the usual, you're playing with the Schema, be sure of your backups warning).

Chris

Author

Commented:
Thank you Chris.  So looking at one of the current attributes that is copying, the search flag is set to 0x11 = (INDEX | COPY).  Two questions for you:
1) Would I mirror that entry in other attributes I wished to copy over?
2) What would I change that to if I wanted a particular attribute to stop copying.
Thanks very much!
 

CN-Company-Properties.jpg
Chris DentPowerShell Developer
Top Expert 2010

Commented:

Old RA, not to worry :)

1. Yes.

2. Remove the flag, so if it's included you would remove 16 from the value. Only if that value is included though, that's normally where we resort to scripts which can do bitwise-AND operations without having to think hard :)

Chris

Author

Commented:
Thank you very much!!

Author

Commented:
Thank you very much for your information!!

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial