Create and manage AD DS users and groups
Provisioning and configuring Active Directory Domain Services (AD DS) users and groups means creating user accounts, service accounts, and computer accounts and placing them into logical containers called Organizational Units (OUs). OUs help apply group policies and delegate permissions to specific parts of the directory. The main tools for this work are Active Directory Users and Computers, Active Directory Administrative Center, and PowerShell. Administrators choose group scopes—global, domain local, or universal—and nest groups inside one another to simplify access control. OU placement and group nesting together enforce role-based access and delegation across on-premises AD DS and Microsoft Entra ID in a hybrid setup.
Create and Manage OUs
Organizational units group related objects such as users, groups, and computers. In a managed domain that is synchronized with Microsoft Entra ID, two default OUs exist: AADDC Computers holds all domain-joined computers, and AADDC Users contains users and groups that come from Microsoft Entra ID. Administrators can create custom OUs to match their own structure. Only objects created inside the managed domain can be moved into custom OUs; objects that sync from the cloud stay in the default OUs.
The Active Directory Administrative Center gives a graphical view for managing OUs, users, and groups. PowerShell automates the same tasks—for example, New-MgServicePrincipal creates a service principal, and Get-MgGroup lists user groups. Using the right tool depends on the task: the Administrative Center works well for one-off changes, while PowerShell handles bulk operations and scripting.
Delegation and Group Management
AD DS supports several group scopes that control where a group can be used:
- Global groups are used within the same domain.
- Domain local groups apply to resources in their own domain.
- Universal groups work across domains in a forest.
StudyCerts
StudyCerts