You can copy Active Directory user accounts with the Active Roles Console.
To copy a user account
-
In the Console tree, locate and select the folder that contains the user account you want to copy.
-
In the details pane, right-click the user account you want to copy, then click Copy to start the Copy Object - User wizard.
-
Follow the wizard pages to specify properties for the copy of the user account, such as the user first name, last name, full name, display name, login name, pre-Windows 2000 login name, password, and Exchange mailbox settings.
Figure 6: Copying a user account
-
If you want to set values for additional properties (those for which the wizard pages do not provide data entries), click Edit Attributes on the completion page of the wizard.
-
After setting any additional properties, click Finish on the completion page of the wizard.
NOTE: Consider the following when copying a user account:
-
The behavior of the wizard pages may vary depending on the configuration of Active Roles policies. To determine whether a given item on a page is under the control of a certain policy, observe the text label next to the item: the underlined text label indicates that some policy restrictions are in effect. Click underlined text labels to examine the policies that govern the behavior of the wizard pages. For more information, see Getting policy-related information.
The policy information is also displayed whenever you supply a property value that violates a policy restriction. The wizard cannot proceed until you enter an acceptable value.
-
By default, some common properties are carried over to the copied user account from the original user account. This includes the group membership settings as well, so if the original user account is a member of a specific group (or groups), the Copy Object - User wizard will automatically add the copied user account to the same group(s).
You can modify the properties of Active Directory user accounts with the Active Roles Console.
To modify user account properties
-
In the Console tree, locate and select the folder that contains the user account you want to modify.
-
In the details pane, right-click the user account you want to modify, then click Properties.
Figure 7: User account properties
-
Use the tabs in the Properties dialog to view or modify properties of the user account.
-
If you want to view or modify additional properties (those for which the tabs in the Properties dialog do not provide data entries), navigate to the Object tab and click Advanced Properties.
-
After setting all the properties you want, click OK.
NOTE: Consider the following when modifying object properties:
-
In the wizard, some property labels may be displayed as hyperlinks. The hyperlink indicates that Active Roles enforces certain policy restrictions on the property. To examine policy details, click the hyperlink: the policy information is displayed. For more information, see Getting policy-related information.
The policy information is also displayed whenever you supply a property value that violates a policy restriction. The wizard cannot proceed until you enter an acceptable value.
-
To modify properties for multiple objects, press and hold Ctrl, then click each object. Right-click the selection, then click Properties.
-
You can use the Properties dialog to view or modify any property of the object by navigating to the Object tab and clicking Advanced Properties. In the Advanced Properties window you can manage all properties, including those that cannot be accessed via the Properties dialog itself.
You can also display the Advanced Properties window by right-clicking the object and selecting All Tasks > Advanced Properties.
-
To locate the object that you want to modify, use the Find function of Active Roles. Once you found the object, open the Properties page by right-clicking the object, and clicking Properties.
You can rename Active Directory user accounts with the Active Roles Console.
To rename a user account
-
In the Console tree, locate and select the folder that contains the user account you want to rename.
-
In the details pane, right-click the user account and click Rename.
-
Type a new name (or clear the existing name), then press Enter to display the Rename User dialog.
Figure 8: Rename User
-
Use the Rename User dialog to modify (if needed) the naming properties of the user account such as the user full name, first name, last name, display name, and login name.
-
When finished, click OK.
NOTE: Consider the following when renaming an object:
-
The behavior of the dialog may vary depending on the configuration of Active Roles policies. To determine whether a given item in the dialog is under the control of a certain policy, observe the text label next to the item: the underlined text label indicates that some policy restrictions are in effect. Click underlined text labels to examine the policies that govern the behavior of the dialog. For more information, see Getting policy-related information.
-
To locate the object you want to rename, use the Find function of Active Roles. Once you found the object, rename it by selecting it in the list of search results, right-clicking it, clicking Rename, then specifying the new name. To apply the new name, press Enter.
To prevent a particular user from logging on, you can block the user account as a security measure instead of deleting it. You can block and unblock Active Directory user accounts with the Active Roles Console.
To block a user account
-
In the Console tree, locate and select the folder that contains the user account you want to block.
-
In the details pane, right-click the user account and click Disable Account.
NOTE: Consider the following when blocking a user account:
-
To prevent particular users from logging on for security reasons, the administrator can block user accounts instead of deleting user accounts.
-
The Disable Account command appears if the account is enabled and thus can be used for login; otherwise, the Enable Account command appears on the menu. By using the Enable Account command the administrator can change the status of the blocked account to allow the user to log in with that account.
-
To locate user accounts for blocking, use the Find function of Active Roles. Once you found the users, block them by selecting the accounts in the list of search results, right-clicking the selection, and clicking Disable.
-
Since the Copy function ensures that the copy of a user account belongs to the same groups as the original user account, you can create a blocked user account that belongs to certain groups, then make copies of that account to simplify the creation of user accounts with common group memberships.
You can unblock a blocked user account with the Active Roles Console. The Enable Account command only appears for deactivated accounts, marked with the 
icon.
To unblock a blocked user account
-
In the Console tree, locate and select the folder that contains the user account you want to unblock.
-
In the details pane, right-click the user account and click Enable Account.
NOTE: Consider the following when unblocking a user account:
-
The Enable Account command appears if the account is blocked and cannot be used for login; otherwise, the Disable Account command appears in the menu. To prevent particular users from logging in for security reasons, block user accounts with the Disable Account command.
-
To locate user accounts for unblocking, use the Find function of Active Roles. Once you found the users, unblock them by selecting the accounts in the list of search results, right-clicking the selection, and clicking Enable Account.
