Active Directory Fundamentals

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A directory is a tree of accounts, not a spreadsheet

Active Directory is the account database for a Windows domain, and it depends on DNS. A domain controller that cannot resolve its own names is a domain controller in trouble. Sites describe the network so clients find a nearby controller. You do not design sites in the same hour you create a user. You notice when a client is talking to a controller on the other side of a slow link.

An OU is a container you can delegate and that Group Policy can link to. A container that is not an OU, such as the default Users container, is a poor place to keep attaching policy. Put people and computers in OUs that match how you delegate: a place, a team, or a tier of admin. Do not build an OU for every attribute you might filter on. Groups exist for that.

Groups grant access. Users go in groups. Groups go on resources. Nesting is useful and becomes a maze when nobody drew it. A user with a direct permission on a file share, plus three nested groups, is a permission you will not be able to explain. Prefer one model and write it down. The Group Policy guide is how a setting reaches the OU. This page is the account and the group.

Search with a filter you can read. Get-ADUser and an LDAP filter answer who matches. They do not change anyone. The filter builder and the Get-ADUser builder on this site draft the query. A filter is not a place to hide a change. If the query returns more people than you can name, narrow it before any later Set- command exists.

One lab user in one OU, in one group

The lab domain is one you can break. Create an OU named Lab. Create a user whose name cannot be confused with a real person. Create a group named Lab-Readers. Put the user in the group. The ticket has the OU path, the samAccountName, and the group. You do not enable a remote-access flag, and you do not put the user in Domain Admins to see if the account works.

Search for the user with Get-ADUser and a filter on that samAccountName. The result is one user. Search for the group and list members. The result is that one user. The LDAP filter builder should produce a filter that matches this test and would not match every person in the domain. If the draft filter is (objectClass=user) and nothing else, it is a draft to narrow.

Delegation, if you need it, is a named group of admins on that OU, for the tasks they actually do, not Full Control because the wizard offered it. Write the delegated group in the ticket. A second admin account is how you test delegation. Your own Domain Admin account can do everything and proves nothing about the delegated group.

DNS for the domain is healthy before you call the lab a success: the client you used can find a controller. If it cannot, fix DNS as its own problem. Do not create a second domain because the first lookup failed.

A change you can finish

Production changes are one user or one group in a window until the OU design is already there. Moving a user between OUs can change which policies apply. The Group Policy guide says to look at the resulting set before you move a hundred people.

Rollback is moving the user back, or removing the group membership you added. Disable is not delete. Delete is a later decision with a backup of the directory you already practise.

Confirm you are in the lab domain or the OU the ticket named.
Create or pick the OU. Do not use the default Users container for a new design.
Create the user and the group. Put the user in the group.
Query with a filter that returns that user and not the whole domain.
Test a delegated admin only if delegation is part of the ticket.
Confirm DNS still finds a controller from a client.
Write the rollback as a move or a membership removal, not a delete.

Mistakes that outlive the command

Active Directory fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

Putting day-to-day people in Domain Admins, Enterprise Admins, or Schema Admins.
A filter with no name, run as a preview of a change, that matches everyone.
OUs that copy the org chart so deeply that nobody can delegate them.
Direct permissions on resources plus groups, so the effective access is a story.
Moving users between OUs without checking Group Policy results.
Deleting an account to see if anyone complains. Disable it.
Building a new domain because a DNS suffix was wrong.
Testing delegation while still logged in as a domain admin, which hides a broken ACL.

Decisions to write down before the window

One decision for Active Directory: The OU path is in the ticket. New people do not land in the default Users container. Access is a group. The user is a member. The resource points at the group. Privileged groups are empty of day-to-day accounts. Admin work uses a separate admin account. The search filter names the person or the group. A filter that can match everyone is not a change preview. Delegation is a named group and a named task. Full Control is not the default. A move between OUs includes a Group Policy check from that guide. Disable is the first undo. Delete waits for the directory backup you already restore in drills. DNS is a precondition. A failed lookup stops the account work. The lab user is obviously a lab user. The name cannot be mistaken for a colleague. The builders' drafts were narrowed before they were used on a real domain. And a second person read the OU path and the group name.

Active Directory checks before the account is used

Confirm this before you call the change done: The domain you edited is the domain in the ticket. The user is in the OU you named, not in Users. The user is in the group you named and not in a privileged group. Get-ADUser with the filter returns one user. A member listing of the group shows that user. A client can find a domain controller by DNS. Delegation, if any, was tested as the delegated account. No remote-access or admin flag was set as a shortcut. Rollback is disable or un-nest, and it is written down. The filter draft cannot match the whole domain. A second person read the samAccountName. Group Policy links on the OU were looked at if the OU is new. The account's password was set by the person who will use it, not stored in the ticket. The hostname in the prompt matches the hostname in the ticket for Active Directory. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for Active Directory happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.