Active Directory objects naming convention

 

Have you ever wondered about Active Directory objects naming convention in your domain environment? If not, but you wish to standardize their naming convention because your current one is not satisfactory then this article is for you.

Of course this is only a suggestion how to build the naming convention because there is no default and suitable template for all environments.

I will try to show you couple of examples for particular Active Directory objects and I hope you would be able to adjust them to your environment’s requirements.

Users

Every domain environment is full of users. That’s why good to have some naming convention for them to avoid mess.

The most popular template is based on user’s first and last name. This allows you to define variety naming conventions.

One of them defines user’s login combined with first name and last name separated by special character like:

  • dot
  • hyphen
  • underscore
  • no special character

Let’s take a look closer to an example for a person: Krzysztof Pytko. Possible logins could look like:

  • Krzysztof.Pytko
  • KrzysztofPytko
  • Krzysztof_Pytko
  • KrzysztofPytko

There is nothing wrong in this convention but what will happen if some day another Krzysztof Pytko would be hired in a company? In this case you need to somehow differentiate users. One of available options is to add a digit/number at the end of user’s login for example:

  • Krzysztof.Pytko1
  • Krzysztof.Pytko2

and so on.

Another option uses user’s last name and part of first name (let’s say 3 letters), in example:

  • pytkokrz

You can of course use a lot of variants based on a solution shown above but this also does not guarantee unique logins in the environment.

It’s good to have a naming convention which defines unique logins. One of option is to use employee number assigned by HR department. This should be unique for every employee in the company. Of course this might be difficult to remember by user but after few usages it should be easily remembered.

Let’s take a look for few examples

  • 1001000001
  • 0000001
  • 1150010001

everything depends on your company’s policy assigning employee numbers.

The last one example uses country and location identifiers with the next free number. Let’s consider this for Poland/Wroclaw for 15th employee

  • PLWRO015 (for smaller environments up to 1000 users in a location)
  • PLWRO0015 (for medium environments up to 10000 users in a location)
  • PLWRO00015 (for larger environments up to 100000 users in a location)
  • PLWRO000015 (for huge environments up to 1000000 users in a location)

That was not all possible options but this should show you a direction to create your own user’s naming convention.

Groups

As in previous paragraph, every domain is also full of groups. They are mostly used to grant access to resources but they have other purpose like:

  • role
  • fine-grained password policy
  • mail group
  • or other not mentioned here

However, regardless of their destination, every group must belongs to one of those types:

  • domain local
  • global
  • universal

So, you can use as group prefix, its type and it would look like:

  • l – for domain local groups
  • gfor global groups
  • ufor universal groups

OK, I have mentioned group prefix, so this probably means that I have some template to build group’s name? Yes, you’re right, I have something like that. Group naming convention relies on 2 variants in this case and depends on:

  • group is for resource access
  • group is not for resource access

 Let’s take a look what we need for group’s name, designated for resource access control:

  • group prefix
  • department owner
  • group role
  • group suffix

As group prefix, it’s good to choose group type, to simply underline what kind of type it is. Another possibility is to use prefix indicating for a group role. For department owner, specify short name or unique id of team to which it is designated. Group role should clearly define for what this group is used and it may be few words separated by hyphen () or underscore (_). However, I would recommend using hyphens only, it is much more readable form. Group suffix is mostly used only for resource access groups, which states if group has read-only (-r) or modify (-rw) permissions.

OK, let’s see few examples of resource groups for couple of departments:

  • IT department with licensing data
  • HR department with payroll data
  • Finance department with invoices
  • Common resources for all departments with instructions

All group types for IT department in above example are presented below:

  • litlicensing-datar (for read-only access); litlicensing-datarw (for modify access)
  • gitlicensing-datar (for read-only access); gitlicensing-datarw (for modify access)
  • uitlicensing-datar (for read-only access); uitlicensing-datarw (for modify access)

All group types for HR department with payroll data in above example are presented below:

  • lhrpayrollr; lhrpayrollrw
  • ghrpayrollr; ghrpayrollrw
  • uhrpayrollr; uhrpayrollrw

All group types for finance department with invoices data:

  • lfinanceinvoicer; lfinanceinvoicerw
  • gfinanceinvoicer; gfinanceinvoicerw
  • ufinanceinvoicer; ufinanceinvoicerw

and all group types for common resources share in read-only mode as modify is rarely used for all departments:

  • lallinstructionsr
  • gallinstructionsr
  • uallinstructionsr

That was not all possible options but this should show you a direction to create your own groups’s naming convention.

Computers and Servers

OK, now we are going into another important part on naming convention. This scheme is related with user devices and servers. It is really good to have common template for those machines as it would simply allow identifying them without logging on onto them.

There is a lot of possibilities and they rely on how much big is your environment. I will show you just couple of options which may direct you into your own scheme.

Computers

You need to remember that we are still limited to 15 characters in a computer name which is caused by NetBIOS.

Let’s start with the environments where up to 10000 computers in single location is enough.

CCLLLSVVFFFXXXX

where:

  • CC – is for country code
  • LLL – is a location code
  • S – is for operating system type (Windows, Unix, Linux, Solaris, BSD)
  • VV – is operating system version (XP, 07, 08, 81, 10)
  • FFF – is machine function (WKS, NTB, TAB, MOB)
  • XXXX – next number for machine

and below you can find few examples of scheme usage for 2 locations (Poland/Wroclaw and England/London):

  • PLWROW07WKS0001 (for computer with Windows 7)
  • PLWROW81WKS0005 (for computer with Windows 8.1)
  • PLWROW81NTB0015 (for notebook with Windows 8.1)
  • PLWROW81TAB0002 (for tablet with Windows 8.1)
  • UKLONWXPWKS0001 (for computer with Windows XP)
  • UKLONW07NTB0004 (for notebook with Windows 7)
  • UKLONW81TAB0150 (for tablet with Windows 8.1)

in a companies where more devices (up to 100000) are needed in one location, this convention might be selected (this is modification of this one above)

CCLLLSVVFFXXXXX

  • CC – is for country code
  • LLL – is a location code
  • S – is for operating system type (Windows, Unix, Linux, Solaris, BSD)
  • VV – is operating system version (XP, 07, 08, 81, 10)
  • FF – is machine function (PC, NB, TA, MO)
  • XXXXX – next number for machine

just short single example: PLWROW81PC00005

and a case for really large companies where up to 1000000 devices are needed in one location (this is modification of this one above)

  • CC – is for country code
  • LLL – is a location code
  • S – is for operating system type (Windows, Unix, Linux, Solaris, BSD)
  • VV – is operating system version (XP, 07, 08, 81, 10)
  • F – is machine function (Pc, Notebook, Tablet, Mobile)
  • XXXXXX – next number for machine

just short single example: UKLONW81T000015

Servers

Situation with servers name is similar to computers with the same limitation to 15 characters of NetBIOS name. You can simply apply the same scheme with small modifications.

Below scheme is good for environments where no more than 1000 servers of the same role are located within the same site.

CCLLLSVVRFFFXXX

where:

  • CC – is for country code
  • LLL – is a location code
  • S – is for operating system type (Windows, Unix, Linux, Solaris, BSD)
  • VV – is operating system version (03 – 2003, 08 – 2008, 12 – 2012)
  • R – is for operating system release (1 – release 1, 2 – release 2)
  • FFF – is machine function (DCR, DCW, FIL, PRT, APP, MGM)
  • XXX – next number for machine

Machine function in template above states:

  • DCR – Read-Only Domain Controller
  • DCW – Domain Controller
  • FIL – File Server
  • PRT – Print Server
  • APP – Application Server
  • MGM – Management Server

Ok, let’s consider few servers according to above naming convention:

  • PLWROW121DCW001
  • PLWROW122DCW002
  • PLWAWW122DCR001
  • PLWROW082FIL001
  • PLWROW082PRT001
  • PLPOZW032MGM003

this should be enough for most environments but if this is too less then you need to replace one server function character for the digit like:

CCLLLSVVRFFXXXX

you have less letters to describe more detailed server’s role but this allows you to have up to 10000 servers with the same role in the same site.

Let’s see short example of this scheme usage  PLWROW121APP0001

 Printers

To define printer naming convention you have a lot of possibilities, so I will present only one which seems to be good in my opinion. This is using:

SSSPMMMXXX

where:

  • SSS – printer signature
  • P – is it pooled or not (0 – no , 1 – pooled)
  • MMM – device manufacturer (SAM – Samsung, LEX – Lexmark, CAN – Cannon, HPP – HP Printer, KYO – Kyocera, RIC – Ricoh)
  • XXX – device number

Let’s see how this looks in practice:

  • PRT0LEX001
  • PRT0HPP002
  • PRT0RIC001
  • PRT1SAM001

Remember! Put detailed information of the printer’s location in printer’s properties as this is not available in naming convention.

I think that’s all for printers. As I said there is a lot of possibilities but I chose this one.

Group Policies

One more object remained on my list. This is GPO which is rarely used according to any naming convention. Especially in outsourced environments where many administrators are managing group policies.

I strongly suggest to apply some good scheme for those objects as it is much more convenient in management where a lot of policies are deployed.

For Group Policy naming convention you can use:

  • GPO prefix
  • GPO function (words separated by hyphen ““)
  • GPO suffix
  • GPO description (optional out of naming convention)

where GPO prefix is one of:

  • WIN – for Windows policies
  • CTX – for Citrix policies
  • RDS – for Terminal/Remote Desktop Services
  • TST – test policies
  • CUS – customer policies
  • OLD – old policies awaiting for removal

where GPO suffix is one of:

  • LPM – for loopback policy in merge mode
  • LPR – for loopback policy in replace mode
  • SCF – security filtering enabled
  • WMI – WMI filter applied
  • GPP – group policy preferences defined

basing on that, you can create GPOs in your environment. Below couple of examples:

  • winie-restrictions-control-panel
  • ctxscreen-saverlpr
  • tstwsus-updatescf
  • winfolder-mapping-drive-hgpp

and that’s all about naming convention in this article. I hope it was somehow helpful for you and you could build your custom naming convention for Active Directory objects.

Author: Krzysztof Pytko

Facebooktwittergoogle_plusredditpinterestlinkedinmail

Leave a Reply

Your email address will not be published. Required fields are marked *