Create and manage AD DS users and groups

Create and manage AD DS users and groups

Provision and Configure AD DS Users and Groups

Provisioning and configuring Active Directory Domain Services (AD DS) users and groups means creating user accounts, service accounts, and computer accounts and placing them into logical containers called Organizational Units (OUs). OUs help apply group policies and delegate permissions to specific parts of the directory. The main tools for this work are Active Directory Users and Computers, Active Directory Administrative Center, and PowerShell. Administrators choose group scopes—global, domain local, or universal—and nest groups inside one another to simplify access control. OU placement and group nesting together enforce role-based access and delegation across on-premises AD DS and Microsoft Entra ID in a hybrid setup.

Create and Manage OUs

Organizational units group related objects such as users, groups, and computers. In a managed domain that is synchronized with Microsoft Entra ID, two default OUs exist: AADDC Computers holds all domain-joined computers, and AADDC Users contains users and groups that come from Microsoft Entra ID. Administrators can create custom OUs to match their own structure. Only objects created inside the managed domain can be moved into custom OUs; objects that sync from the cloud stay in the default OUs.

Use of Administrative Tools

The Active Directory Administrative Center gives a graphical view for managing OUs, users, and groups. PowerShell automates the same tasks—for example, New-MgServicePrincipal creates a service principal, and Get-MgGroup lists user groups. Using the right tool depends on the task: the Administrative Center works well for one-off changes, while PowerShell handles bulk operations and scripting.

Delegation and Group Management

AD DS supports several group scopes that control where a group can be used:

• Global groups are used within the same domain.
• Domain local groups apply to resources in their own domain.
• Universal groups work across domains in a forest.

Nested group membership means adding one group as a member of another. This reduces the number of permissions you assign directly. Delegation models let administrators grant specific rights over an OU, such as resetting passwords or creating new accounts, without giving full administrative access to the entire domain.

Synchronization in Hybrid Environments

In a hybrid deployment, on-premises AD DS synchronizes with Microsoft Entra Domain Services. The sync must correctly match user attributes such as sAMAccountName and objectGUID. Administrators create service principals and administrative groups in the cloud to manage both sides. Azure PowerShell and Microsoft Graph PowerShell handle the synchronization and management of hybrid resources, ensuring consistency between on-premises and cloud directories.

User Configuration

Configuring a user includes:

• Creating the account using Active Directory Users and Computers or PowerShell.
• Assigning roles through security groups like AAD DC Administrators, which gives elevated permissions over the managed domain.
• Managing passwords with policies that enforce complexity, expiration, and lockout rules.

By organizing objects into OUs, delegating tasks, and choosing the correct group scopes and nesting, administrators keep the directory secure and easy to manage whether it lives on-premises, in the cloud, or both.