active-directory – 为什么计算机对象是CN而不是Microsoft Active Directory中的OU？

在我的Microsoft活动目录环境中,几乎每个组织结构都是组织单位.此规则有两个常见的例外,即Computers对象和Users对象.这些是设置Active Directory时创建的默认对象.每当我阅读有关这些对象的任何内容时,我都被告知他们使用“容器名称”来向后兼容.据我所知,这些对象是在设置活动目录时以这种方式配置的.我的主要问题是：

What will break if you convert to using OU’s for these objects? I’m
asuming the only way to do it is to create new OU’s,redirect active
directy to use these new OU’s,and then delete the old CN objects.

我意识到这不是推荐的程序,但我想知道原因.

奖金问题

>活动目录开发人员是否给出了使用CN而不是普通OU创建计算机和用户对象的原因？
>甚至可以删除默认对象吗？

这些容器的存在是为了在升级到 Windows 2000 AD域时向后兼容基于NT4的域,以及由于NT4与Windows 2000兼容而导致的许多其他原因.

由于遗留(“早期版本”)api调用,MS KB 324949提供了对此背后原因的一个很好的解释：
https://support.microsoft.com/en-us/help/324949/redirecting-the-users-and-computers-containers-in-active-directory-domains

In a default installation of an Active Directory domain,user accounts,computer accounts,and groups are put in CN=objectclass containers instead of being put in a more desirable organizational unit class container. Similarly,and groups that were created by using earlier-version APIs are put in the CN=Users and CN=computers containers.

Users,computers,and groups that are created by earlier-version APIs place objects in the DN path that is specified in the WellKNownObjects attribute that is located in the domain NC head. The following code example shows the relevant paths in the WellKNownObjects attribute from the CONTOSO.COM domain NC head.

原文地址：https://www.jb51.cc/windows/368107.html