Active Directory

‘Name’ Attribute cannot be modified – owned by the system

In Active Directory (AD), a system-owned attribute refers to an attribute that is automatically created and managed by the system. These attributes are essential for the functioning of AD and are typically not intended to be modified or managed directly by administrators.

System-owned attributes in AD serve various purposes, such as defining object properties, maintaining internal information, and enabling specific functionalities within the directory. To learn more about system owned attributes, read this article.

And also, there are some specific considerations we should keep in mind when modifying the “CN” attribute. Before making any modifications to the CN attribute, read this article.

‘CN’ Attribute cannot be modified – owned by the system

If you try to edit a system owned attribute in AD, you will get the error “The Attribute cannot be modified because its owned by the system”. If you still want to go ahead here is steps how to change the system owned attribute in AD .

Attribute Name– CN value.

When we attempted to change the CN value for one user, the error highlighted below appeared.

CN-Attribute-cannot-be-modified–owned-by-the-system

 

There are two option to modify the CN attribute as following.

  1. Directly rename the CN attribute in the ADUC console.
  2. LDP.exe can be used to alter or rename the CN value.

In the Active Directory Users and Computers (ADUC) console, you cannot directly rename the “CN” (Common Name) attribute for an object. The “CN” attribute is a system-generated attribute that is automatically assigned based on the object’s name when it is created. It represents the distinguished name (DN) of the object within its container.

To change the “CN” attribute for an object in ADUC, you would need to perform the following steps:

  • Open the ADUC console.
  • Locate and select the object whose “CN” attribute you want to change.

        Search-Object-CN

  • Right-click on the object and choose “Rename” from the context menu.

          CN-Value-Rename

  • Full name is the CN value of the object as shown below.

        CN-Value-Rename-

  • Modify the Full name of the object as desired, including the new value for the “CN” attribute.

      CN-Value-Rename-Ok

  • Click Ok or press Enter to save the changes.

      CN-Value-Renamed

  • Now CN value has been changed as per above screenshot. 
  • You can also check the CN value details by Active Directory Administrative center console as shown below.

    CN-Value-Renamed-1

By renaming the object, you effectively change its “CN” attribute indirectly. However, it’s important to note that modifying the “CN” attribute can have implications for the object’s distinguished name and may require updates to any scripts, applications, or services that rely on the object’s DN. It’s recommended to exercise caution when modifying these attributes.

Additionally, we have a video below that demonstrates the same. Do not forget to check this.

 

Modify the system owned attribute value via LDP.exe tool as showing below.

Carry out the following steps.

Warning: Make sure you fully test these in a pre-production environment before applying them to your live environment.

Steps: –

  1. 1Launch LDP.exe and bind to the DS server you want to modify. Make sure you are schema admin, and admin over the partition you are modifying.
  2.  After connecting and binding navigate to the browse menu and select the “Modify” option.
  3. Leave the DN blank, type ‘schemaUpgradeInProgress’ into the Attribute field and in the values field type 1.
  4. Click the Add operation and then click the enter button. This will add this command to the entry list.
  5. Click the Run button. If you are successful, you should see a successful modify message.
  6. Go to View -> Tree. Connect to the appropriate base DN. NOTE: If your goal is to delete an object in AD that has child objects, then you will need to remove the child objects first.
  7. Find the object, right click and select modify.
  8. In the attribute field, type “systemflags”; in the Values field, leave it blank; in the operation radio options, select delete.
  9. Then click Enter, then click Run to remove the system flags values.
  10. Perform the modification or deletion of the object
  11. Set the systemflags value back to the original value, to make it owned by the system again.
  12. Once finished, run LDP again with the above steps, changing the schemaUpgradeInProgress value to 0 (to prevent unwanted schema/system changes).

So, that’s all in this blog. I will meet you soon with next stuff. Have a nice day!!!

Recommended content

Guys please don’t forget to like and share the post. Also join our WindowsTechno Community and where you can post your queries/doubts and our experts will address them.

You can also share the feedback on below windows techno email id.

If you have any questions, feel free to contact us on support@windowstechno.com also follow us on facebook@windowstechno to get updates about new blog posts.

How useful was this post?

Click on a star to rate it!

As you found this post useful...

Follow us on social media!

Was this article helpful?
YesNo

Vipan Kumar

He is an Active Directory Engineer. He has been working in IT industry for more than 10 years. He is dedicated and enthusiastic information technology expert who always ready to resolve any technical problem. If you guys need any further help on subject matters, feel free to contact us on admin@windowstechno.com Please subscribe our Facebook page as well website for latest article. https://www.facebook.com/windowstechno

Leave a Reply

Back to top button