Security - Windows Active Directory Search Tools

2006/12/13 - 2006/12/13

Windows/XP users who login to a managed domain have several tools for searching the Active Directoy -- Microsoft mailers like Outlook and Outlook Express are integrated with the Active Directory (from your "Address Book" use "Find People" and look in the "Active Directory"). This note describes an additional tool for searching the Active Directory to "Find Users, Contacts, and Groups" (and more).

Windows/XP Professional has a graphical user interface found under "My Network Places" to explore the Active Directory. You can configure a desktop shortcut to get there quickly. This is a little known interface that is quite powerful. What follows is a brief description of how to configure it, followed by some examples of how you might use it.

Find Users, Contacts, and Groups

From an Explorer window select "My Network Places" (which can be found as a drop down menu item in the "Address" bar):

You should have a "Search Active Directory" selection as a "Network Task" in the left hand menu of common tasks:

If you get the "Classic" view with no common tasks shown then click on the "Folders" button to show common tasks. If that fails then from the "Tools" menu select "Folder Options..." and under "Tasks" check the box to "Show common tasks in folders" ("Searching the Active Directory" is a common task in "My Network Places").

If configured properly then under "My Network Places" you should be able to "Search Active Directory" to get a search panel like this entitled "Find Users, Contacts, and Groups":
This tip describes how to configure a desktop icon to quickly access the "Search Active Directory". Right click on the desktop and from the pop-up menu select "New" and "Shortcut" to produce a panel like this:

Enter "rundll32 dsquery, OpenQueryWindow" as the location of the item (ie. as the command that is run) and press "Next>". Enter "Search Active Directory" as the name for this shortcut.

Having created the shortcut click to open like any other desktop icon and you will have a "Find Users, Contacts, and Groups" search panel like this:

From this search panel you can search the Active Directory to find people, computers, printers and much more.

Using the Directory Search Tool

You can access the "Find Users, Contacts, and Groups" panel from "My Network Places" or from an icon you've established on your desktop.

The default is to search for "Users, Contacts, and Groups". You can search for other things as well. From the "Find" menu observe the drop down menu:
The default is to search all Active Directories available. Usually your are only interested in a particular directory -- e.g., the ADS directory contains all UWdir users (and we work hard to keep it synchronized). You specify the directory you wish to search in the drop down "In" menu:
You can search on surname, given name, familiar name, or etc. to find a person:
If you double click a person found then you can find out more information about them:

The several tabs reveal more information stored within the Active Directory and many fields can be updated by the user. Compare with the UWdir Search on the same person.

Observations

The "Find Users, Contacts, and Groups" panel is only available to those who have authenticated in the Active Directory. If your system is not part of our Active Directory then none of this applies.
You should always try to constrain your searches to a particular Active Directory. The collection of Active Directories we support includes a "Test and Development Environment" as well as others. We support the "ADS" Active Directory and aim to have UWdir updates happen in real time.
There will be users in the Active Directory (cf. users within UWdir) you cannot find -- for privacy reasons they have asked that their directory entry not be found.
The assigned UWdir userid is attached to each distinguished name. The display "Reginald E Quinton (reggers)" shows my formal name as well as my userid "reggers".
It should be clear that you can bring start the search tool by other methods -- e.g., from the "Start" button select "Run" and enter the command ""rundll32 dsquery, OpenQueryWindow".
The search tool supports all sorts of advanced searches which you can explore at your leisure -- e.g., try to find all color printers, or all users who are employees.
The search tool has a good "Help" menu well worth exploring.
The interface to the Active Directory allows for a user to update information contained within -- e.g., if you search for my entry you'll find that I have updated my "Address" (my home address).
You should beware -- the telephone number, E-mail address, Home page, Department and Office are maintained by UWdir. Any changes you make there will be over written by data maintained in UWdir.
System Administrators have other tools on the Microsoft Management Console (MMC) that provides additional access -- this describes access tools for casual users.

Acknowledgements

Much of the information provided here comes from

Windows Networking: Give XP ability to search Active Directory

We are grateful for the information shared.

(by) Reg Quinton, Information Systems and Technology