title: LDAP CN as a container
body: <p>I was running a script to pull back LDAP paths, and I noticed that some DN has 2 CN entries eg</p>
  
  <pre><code>CN=User1,CN=Users,DC=....
  CN=User1,CN=Users,DC=....
  </code></pre>
  
  <p>I was wondering if this was possible to have set up inside AD, and if it is then why would a OU not be used instead of 2 CN's. I was under the impression that best practice would be to only have 1 CN as the terminal object.</p>
  
  <p>Thanks for reading.</p>