Active Directory Fundamentals

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A directory is a tree of accounts, not a spreadsheet

Active Directory is the account database for a Windows domain, and it depends on DNS. A domain controller that cannot resolve its own names is a domain controller in trouble. Sites describe the network so clients find a nearby controller. You do not design sites in the same hour you create a user. You notice when a client is talking to a controller on the other side of a slow link.

An OU is a container you can delegate and that Group Policy can link to. A container that is not an OU, such as the default Users container, is a poor place to keep attaching policy. Put people and computers in OUs that match how you delegate: a place, a team, or a tier of admin. Do not build an OU for every attribute you might filter on. Groups exist for that.

Groups grant access. Users go in groups. Groups go on resources. Nesting is useful and becomes a maze when nobody drew it. A user with a direct permission on a file share, plus three nested groups, is a permission you will not be able to explain. Prefer one model and write it down. The Group Policy guide is how a setting reaches the OU. This page is the account and the group.

Search with a filter you can read. Get-ADUser and an LDAP filter answer who matches. They do not change anyone. The filter builder and the Get-ADUser builder on this site draft the query. A filter is not a place to hide a change. If the query returns more people than you can name, narrow it before any later Set- command exists.

One lab user in one OU, in one group

The lab domain is one you can break. Create an OU named Lab. Create a user whose name cannot be confused with a real person. Create a group named Lab-Readers. Put the user in the group. The ticket has the OU path, the samAccountName, and the group. You do not enable a remote-access flag, and you do not put the user in Domain Admins to see if the account works.

Search for the user with Get-ADUser and a filter on that samAccountName. The result is one user. Search for the group and list members. The result is that one user. The LDAP filter builder should produce a filter that matches this test and would not match every person in the domain. If the draft filter is (objectClass=user) and nothing else, it is a draft to narrow.

Delegation, if you need it, is a named group of admins on that OU, for the tasks they actually do, not Full Control because the wizard offered it. Write the delegated group in the ticket. A second admin account is how you test delegation. Your own Domain Admin account can do everything and proves nothing about the delegated group.

DNS for the domain is healthy before you call the lab a success: the client you used can find a controller. If it cannot, fix DNS as its own problem. Do not create a second domain because the first lookup failed.

A change you can finish

Production changes are one user or one group in a window until the OU design is already there. Moving a user between OUs can change which policies apply. The Group Policy guide says to look at the resulting set before you move a hundred people.

Rollback is moving the user back, or removing the group membership you added. Disable is not delete. Delete is a later decision with a backup of the directory you already practise.

Confirm you are in the lab domain or the OU the ticket named.
Create or pick the OU. Do not use the default Users container for a new design.
Create the user and the group. Put the user in the group.
Query with a filter that returns that user and not the whole domain.
Test a delegated admin only if delegation is part of the ticket.
Confirm DNS still finds a controller from a client.
Write the rollback as a move or a membership removal, not a delete.

Mistakes that outlive the command

Active Directory fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

Putting day-to-day people in Domain Admins, Enterprise Admins, or Schema Admins.
A filter with no name, run as a preview of a change, that matches everyone.
OUs that copy the org chart so deeply that nobody can delegate them.
Direct permissions on resources plus groups, so the effective access is a story.
Moving users between OUs without checking Group Policy results.
Deleting an account to see if anyone complains. Disable it.
Building a new domain because a DNS suffix was wrong.
Testing delegation while still logged in as a domain admin, which hides a broken ACL.

Decisions to write down before the window

Decision 1 for Active Directory. The OU path is in the ticket. New people do not land in the default Users container. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 2 for Active Directory. Access is a group. The user is a member. The resource points at the group. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 3 for Active Directory. Privileged groups are empty of day-to-day accounts. Admin work uses a separate admin account. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 4 for Active Directory. The search filter names the person or the group. A filter that can match everyone is not a change preview. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 5 for Active Directory. Delegation is a named group and a named task. Full Control is not the default. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 6 for Active Directory. A move between OUs includes a Group Policy check from that guide. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 7 for Active Directory. Disable is the first undo. Delete waits for the directory backup you already restore in drills. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 8 for Active Directory. DNS is a precondition. A failed lookup stops the account work. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 9 for Active Directory. The lab user is obviously a lab user. The name cannot be mistaken for a colleague. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 10 for Active Directory. The builders' drafts were narrowed before they were used on a real domain. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 11 for Active Directory. A second person read the OU path and the group name. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Active Directory checks before the account is used

Check 1 in Active Directory checks before the account is used. The domain you edited is the domain in the ticket. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 2 in Active Directory checks before the account is used. The user is in the OU you named, not in Users. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 3 in Active Directory checks before the account is used. The user is in the group you named and not in a privileged group. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 4 in Active Directory checks before the account is used. Get-ADUser with the filter returns one user. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 5 in Active Directory checks before the account is used. A member listing of the group shows that user. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 6 in Active Directory checks before the account is used. A client can find a domain controller by DNS. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 7 in Active Directory checks before the account is used. Delegation, if any, was tested as the delegated account. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 8 in Active Directory checks before the account is used. No remote-access or admin flag was set as a shortcut. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 9 in Active Directory checks before the account is used. Rollback is disable or un-nest, and it is written down. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 10 in Active Directory checks before the account is used. The filter draft cannot match the whole domain. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 11 in Active Directory checks before the account is used. A second person read the samAccountName. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 12 in Active Directory checks before the account is used. Group Policy links on the OU were looked at if the OU is new. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 13 in Active Directory checks before the account is used. The account's password was set by the person who will use it, not stored in the ticket. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 14 in Active Directory checks before the account is used. The hostname in the prompt matches the hostname in the ticket for Active Directory. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 15 in Active Directory checks before the account is used. The result line includes the time and the person, not only the command. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 16 in Active Directory checks before the account is used. You can point at the rollback value without searching a chat history. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 17 in Active Directory checks before the account is used. Done is a sentence a second person can repeat: the proof for Active Directory happened, and the next host is not started early. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar. A published page is linked. The others are named until they are published.