(Stupid?) Active Directory User Naming Question

[evilspoons]

Hello everyone,

I am a self-taught administrator of a work Active Directory network used for Windows logins on ~30 PCs. I inherited the system from someone else who also didn't have any direct Microsoft training and as a result I am in the dark a bit on a couple things.

The network itself has a single Windows Server 2008 R2 machine acting as domain controller, DNS, file shares, etc. Logins work fine, but I was poking around the list of users while disabling old accounts and I noticed something I don't quite understand.

The current domain controller was swapped in from another one that used to run Windows Server 2003.

Here are a couple sample user accounts:

1.
Logon Name: john
First Name: John
Last Name: Smith
Display Name: John Smith
Canonical Name of Object: domain.com/Users/john

2.
Logon Name: bob
First Name: Bob
Last Name: French
Display Name: Bob French
Canonical Name of Object: domain.com/Users/Bob French

The first one was created when the Server 2003 box was DC, the second was created when the Server 2008 R2 box was DC. Why is the Canonical Name different, and does it make any difference?

I'm mostly annoyed by the fact that my users list in the active directory browser has half the accounts as 'firstname' and half as 'firstname lastname'.

Can I do something to make all of them the same without breaking working accounts?

 

[evilspoons]

Anyone?

Is there a better place to ask this question?

EDIT: Posted it on Server Fault in Stack Exchange. If I get an answer, I'll let everyone here know in case this question comes up in search results or something.

EDIT 2:

The answer is something like this: the Canonical Name doesn't really matter for logins - users won't ever really see it.

You can just rename the object in the Active Directory Users & Computers administrative tool and nothing bad will happen. The old accounts were named differently than the new accounts simply because the creation rules on Windows Server 2003 were different than the rules for Windows Server 2008 R2.

As an aside, throwing all your users in domain.com/Users/ is a slightly messy way to go about business. I was told to create some OUs (Organizational Units) and move the users in to them to categorize them slightly. Since I am at a small company, I broke it up into domain.com/Users (Active Employees)/, domain.com/Users (Active Non-Employee)/ for accounts multiple people use, like for presentations on the boardroom PC, and domain.com/Users (Inactive)/ for all the disabled stuff, ex-employees, etc.

 

[imagoon]

"Canonical Name of Object" is a built object. I suspect if you opened ASDI edit or look at the object values, you will see that CN=john on the one and CN=Bob French on the other. This likely happened when someone added the account and simply used "john" then edited it afterwards.

You can edit CN. Don't edit ObjectGUID.

You can use powershell to see the properties via:

get-aduser bob -properties * | fl *