dsadd Command Reference – Active Directory Object Creation

dsadd is the legacy Windows command-line utility to add objects (user, group, computer, contact, OU, quota) to Active Directory Domain Services. It requires AD DS role or RSAT.

dsadd <ObjectType> <DistinguishedName> [OptionalFlags]
ObjectType: computer | contact | group | ou | user | quota

Options and Flags

All flags are optional except Distinguished Name for most object types.

Usage Examples

1. Create a user with mandatory password change

dsadd user "cn=John Doe,ou=Users,dc=contoso,dc=com" -samid jdoe -pwd * -mustchpwd yes -upn jdoe@contoso.com

Prompts for password interactively. User must change password at first logon. Best practice for new hires.

2. Add a group and a computer object

dsadd group "cn=Finance,ou=Groups,dc=contoso,dc=com" -samid Finance
dsadd computer "cn=LAPTOP001,ou=Workstations,dc=contoso,dc=com"

Creates a security group (default) and a computer account. Computer requires -samid only if name differs.

3. Batch import from CSV using a for loop

@echo off
for /f "skip=1 tokens=1-4 delims=," %%a in (users.csv) do (
    dsadd user "cn=%%a,ou=Users,dc=contoso,dc=com" -samid %%b -pwd %%c -upn %%b@contoso.com -mustchpwd yes
)

Assumes CSV columns: DisplayName,SamAccountName,Password,OU. Efficient for bulk provisioning (50+ users).

Troubleshooting & Common Errors

Performance Considerations and Tuning

dsadd adds Active Directory objects one at a time via LDAP. Because it does not expose built-in knobs for parallelism, MTU, buffer sizes, or timeouts, performance tuning relies on scripting and operating system defaults. Microsoft’s Active Directory Domain Services Capacity Planning documentation recommends batching multiple dsadd commands in a script to reduce per-connection overhead. Network latency and TCP window size are controlled at the network stack level; dsadd inherits the system’s default TCP settings. To simulate parallelism, launch multiple dsadd instances concurrently in a PowerShell script:

# Parallel batch creation (PowerShell 7+)
Get-Content C:users.csv | ForEach-Object -Parallel {
    $name, $ou = $_ -split ','
    dsadd user "CN=$name,$ou" -pwd * -upn "$name@domain.com"
} -ThrottleLimit 10

Key considerations:

• Batch size: No internal batch flag exists; use external scripting to avoid creating too many simultaneous LDAP connections (typically <100).
• Timeouts: dsadd relies on LDAP timeout (default 120 seconds). Adjust via the registry key HKEY_LOCAL_MACHINESystemCurrentControlSetServicesLDAPLDAPClientTimeout.
• Network overhead: Reduce round trips by pre-creating parent OUs. dsadd uses TCP port 389; MTU settings are handled by the OS.
• Parallelism: Use Start-Process or PowerShell jobs (as shown) to run multiple dsadd commands concurrently, throttled to avoid server overload.

For large bulk imports, consider using ldifde or csvde instead; dsadd is best for small-to-medium batches due to its sequential nature.

Security and Operational Best Practices

When using dsadd to create Active Directory objects, follow these security and operational guidelines to minimize risk and maintain auditability.

• IAM / Least-Privilege: Run dsadd under a delegated account that has write permissions only on the target OUs (e.g., OU=Users,OU=AcmeCo,DC=ss64,DC=com). Avoid using Domain Admin accounts; assign granular rights via AD Delegation Control.
• Authentication Knobs: Use the -pwd * flag to force a password prompt instead of embedding passwords in scripts. The special token $username$ can place the SAM account name. Never pass plaintext passwords on the command line.
• Audit / Logging Hooks: Enable Advanced Audit Policy for User Account Management (Event ID 4720 on domain controllers). Use built-in Windows tools to query these events.

# Configure audit policy (run once on DC)
auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

# Query last 5 user-creation events
wevtutil qe Security /q:"*[System[(EventID=4720)]]" /c:5 /rd:true /f:text

# PowerShell equivalent (for automation scripts)
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4720} -MaxEvents 5 | Format-List

Regularly review these logs for unexpected object additions. Combine with scheduled dsquery runs to detect unauthorized accounts. Store dsadd scripts in version-controlled repositories and restrict execution to authorized administrators.

dsadd user "CN=jsmith,OU=Users,DC=contoso,DC=com" -samid jsmith -pwd P@ssw0rd -upn jsmith@contoso.com

dsadd user "CN=jdoe,OU=Sales,DC=contoso,DC=com" -samid jdoe -pwd P@ssword123

dsquery user -samid jsmith # returns DN if exists

# Install RSAT on Windows 11
Add-WindowsCapability -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 -Online

for /f "tokens=1-3 delims=," %a in (users.csv) do dsadd user "CN=%a,OU=Users,DC=contoso,DC=com" -samid %b -pwd %c