Description

Creates a new group in Active Directory in the specified parent container.

Declaration

<CREATEADGROUP LDAPPATH="text" GROUP="text" DISPLAYNAME="text" DESCRIPTION="text" GROUPTYPE="text [options]" GROUPSCOPE="text [options]" USERNAME="text" PASSWORD="text"/>

Example

<CREATEADGROUP LDAPPATH="LDAP://servtest.com" USERNAME="administrator" PASSWORD="password" GROUP="BPA" DISPLAYNAME="BPA" DESCRIPTION="Business Process Automated Workflowion" GROUPTYPE="SECURITY" GROUPSCOPE="DOMAINLOCAL" />

General Tab Parameters

Parent Path: Allows you to enter the LDAP path of the parent active directory container. Usually the top most container or rootdse path.

Text, Required
MARKUP: LDAPPATH="LDAP://DC=networkautomation,DC=com"

• Click Select Container to select the parent container from the domain. You can also select objects like user, computer, group, contacts by clicking select objects.

Name: Allows you to specify a group name.

Text, Required
MARKUP: GROUP="Dave"

Display: Allows you to specify group's display name.

Text, Required
MARKUP: DISPLAYNAME="Davelopers"

Description: Allows you to specify group's description.

Text, Required
MARKUP: DESCRIPTION="Automated Workflow Developers"

Group type: Allows you to select the type of group your are looking to create from the dropdown list. The available options are SECURITY and DISTRIBUTION.

Text [options], Optional - Default "Security"
MARKUP: GROUPTYPE="Distribution"

• Security groups: Use Security groups for granting permissions to gain access to resources. Sending an e-mail message to a group sends the message to all members of the group. Therefore, security groups share the capabilities of distribution groups.

• Distribution groups: Use Distribution groups to send e-main messages to groups of users. You cannot grant permissions to security groups. Even though security groups have all the capabilities of distribution groups, distribution groups still requires, because some applications can only read distribution groups.

http://www.tech-faq.com/active-directory-groups.shtml

Group Scope: Allows you to select the scope of group you are looking to create from the dropdown list. The available options are DOMAINLOCAL, GLOBAL, and UNIVERSAL.

Text [options], Optional - Default "Domainlocal"
MARKUP: GROUPSCOPE="GLOBAL"

Group scopes normally describe which type of users should be clubbed together in a way that is easy for their administration. One group can be a member of other group(s), which is known as Group nesting. One or more groups can be members of any group in the entire domain(s) within a forest.

• Domain Local Group: Use this scope to grant permissions to domain resources that are located in the same domain in which you created the domain local group. Domain local groups can exist in all mixed, native and interim functional level of domains and forests. Domain local group memberships are not limited as you can add members as user accounts, universal and global groups from any domain. Just to remember, nesting cannot be done in domain local group. A domain local group will not be a member of another Domain Local or any other groups in the same domain.

• Global Group: Users with similar function can be grouped under global scope and can be given permission to access a resource (like a printer or shared folder and files) available in local or another domain in same forest. To say in simple words, Global groups can be use to grant permissions to gain access to resources that are located in any domain but in a single forest as their memberships are limited. User accounts and global groups can be added only from the domain in which global group is created. Nesting is possible in Global groups within other groups as you can add a global group into another global group from any domain. Finally to provide permission to domain specific resources (like printers and published folder), they can be members of a Domain Local group. Global groups exist in all mixed, native and interim functional level of domains and forests.

• Universal Group Scope: These groups are precisely used for e-mail distribution and can be granted access to resources in all trusted domain as these groups can only be used as a security principal (security group type) in a Windows 2000 native or Windows Server 2003 domain functional level domain. Universal group memberships are not limited like global groups. All domain user accounts and groups can be a member of universal group. Universal groups can be nested under a global or Domain Local group in any domain.

Credentials Tab Parameters

Username: Allows you to enter the name of the active directory user.

Text, Optional
MARKUP: USERNAME="username"

Password: Allows you to enter the password of the active directory user.

Text, Optional
MARKUP: PASSWORD="password"

Note: Leave these fields blank if you want to use current user's credentials. If you are trying to access the active directory information then any Domain user is valid but in order to modify the user or group you need Domain Administrator. We recommend to use domain administrator for all the active directory actions.

Refer to the following link for more information about LDAP: http://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol

See Also

Create Active Directory Object, Create Active Directory User