{"id":71063,"date":"2004-11-05T16:12:00","date_gmt":"2004-11-05T16:12:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2004\/11\/05\/how-can-i-work-with-a-cn-that-has-a-comma-in-it\/"},"modified":"2004-11-05T16:12:00","modified_gmt":"2004-11-05T16:12:00","slug":"how-can-i-work-with-a-cn-that-has-a-comma-in-it","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-work-with-a-cn-that-has-a-comma-in-it\/","title":{"rendered":"How Can I Work with a CN that Has a Comma in It?"},"content":{"rendered":"

\"Hey,<\/p>\n

Hey, Scripting Guy! My user accounts have commas in their CN attributes; for example, Myer, Ken<\/b>. How do I bind to those user accounts using a script? I always get the error message “An invalid dn syntax has been specified.”<\/p>\n

— GT<\/p>\n

\"Spacer\"\"Hey,<\/a><\/p>\n

Hey, GT. For those of you who don’t know, the CN attribute is the attribute that uniquely identifies a user account within an OU or other Active Directory container. (You can have more than one Myer, Ken<\/b> in your domain, but you can have only a single Myer, Ken<\/b> in, say, the Accounting OU.) The CN attribute is also the attribute used to display user names in Active Directory Users and Computers. When you add a user from within Active Directory Users and Computers, one of the fields you typically fill out is labeled Full Name<\/b> (and then, for some reason, when you later view the user account properties, this same field gets re-labeled Display Name<\/b>). Administrators like to specify CNs (full names) using the last name, first name syntax; that way, when they look at an OU all the users are arranged in alphabetical order by last name. (If you specified Ken Myer<\/b> as the full name, users will be arranged in alphabetical order by first<\/i> name.)<\/p>\n

In other words, it’s very common for users to have CNs similar to Myer, Ken. That’s great when you’re working in Active Directory Users and Computers, but not so great when you’re trying to manage these users with ADSI scripts. For example, this script – which attempts to bind to the Myer, Ken user account – will fail with an invalid syntax error:<\/p>\n

Set objUser = GetObject(LDAP:\/\/CN=Myer, Ken,OU=Accounting,DC=fabrikam,DC=com<\/a>)<\/pre>\n
Wscript.Echo objUser.CN<\/pre>\n
So what’s the problem here? Well, it’s not with the user’s CN; Myer, Ken<\/b> is perfectly valid. The problem is that when you write a binding string in ADSI the comma is used to separate the individual values within the ADsPath. When we write CN=Myer, Ken,OU=Accounting<\/b>, our script thinks CN=Myer<\/b> is the first value, and Ken<\/b> is the second value. That’s because of the comma between Myer and Ken. And because Ken<\/b> by itself doesn’t make any sense within an ADsPath, the script blows up.<\/p>\n
So what do you about that? As it turns out, the comma is a reserved character when it comes to Active Directory paths. (Other reserved characters include the semicolon, the plus sign, the backslash, and the left and right angle brackets. For a complete list, see the Lightweight Access Directory Protocol<\/b><\/a> documentation on MSDN.) <\/p>\n
For most reserved characters, you can use them in binding strings simply by placing a backslash (\\) in front of the characters. This script will successfully bind to the Myer, Ken<\/b> user account and report back the user’s CN:<\/p>\n
Set objUser = GetObject(LDAP:\/\/CN=Myer\\, Ken,OU=Accounting,DC=fabrikam,DC=com<\/a>)<\/pre>\n
Wscript.Echo objUser.CN<\/pre>\n
Again, note how the user CN is specified: CN=Myer\\, Ken,OU<\/b>. After Myer we place a backslash and a comma, then we continue with the rest of the path (including the blank space that separates Myer,<\/b> and Ken<\/b>).<\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! My user accounts have commas in their CN attributes; for example, Myer, Ken. How do I bind to those user accounts using a script? I always get the error message “An invalid dn syntax has been specified.” — GT Hey, GT. For those of you who don’t know, the CN attribute is […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,3,5],"class_list":["post-71063","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-scripting-guy","tag-vbscript"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! My user accounts have commas in their CN attributes; for example, Myer, Ken. How do I bind to those user accounts using a script? I always get the error message “An invalid dn syntax has been specified.” — GT Hey, GT. For those of you who don’t know, the CN attribute is […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/71063","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=71063"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/71063\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=71063"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=71063"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=71063"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}