Q: How can I change the default Active Directory (AD) location that’s used when no explicit location is specified for new user and computer accounts?

A: By default, new user and computer accounts are put in the predefined AD Users and Computers containers. Microsoft created these containers for interoperability with Windows NT 4.0 domains. When you upgrade a Windows domain from NT 4.0 to Windows 2000, Dcpromo puts all existing user accounts in the Users AD container and all existing computer accounts in the Computers AD container.

The Users and Computers containers aren't AD organizational units (OUs), so you can't link OU-level Group Policy Objects (GPOs) to them. You can, however, subject objects in the Users and Computers containers to domain-level and site-level GPOs. If you want to use OU-level GPOs for your user and computer objects, you must create proper AD OUs. If you do so, it's a good practice to change the default location for new user and computer objects. Changing the default location can be handy when, for example, you script the creation of AD accounts and you don't explicitly provide an AD location. To change the default location, use the Redirusr and Redircmp command-line utilities.

To change the default location of new user accounts to an OU named usersou in the contoso.com domain, use following command.

redirusr ou=usersou,dc=contoso,dc=com

Before you run Redirusr or Redircmp you should make sure that the new default containers actually exist in AD. Also, to use Redirusr and Redircmp your domains must be at the Windows Server 2003 functional level—they can contain only Windows 2003 Domain Controllers (DCs), not Win2K or NT 4.0 DCs. When you change the default location, the DC with the PDC emulator Flexible Single-Master Operation role should be online. The default location changes are written to the wellKnownObjects attribute of the AD domain object on the PDC emulator.