Active Directory is the central system for managing identities and resources in a Windows environment. In this guide, we'll cover the fundamentals of managing users and groups — essential building blocks of security and IT organization.

What is Active Directory?

Active Directory (AD) is a directory service offered by Microsoft since Windows Server 2000. It centralizes the management of users, computers, printers, and other network resources within a Windows infrastructure.

Beyond being a simple directory, AD is the foundation of security in an enterprise Windows environment:

  • Centralized authentication: a user signs in once (Single Sign-On)
  • Rights management: granular permission definitions on resources
  • Policy enforcement: GPOs (Group Policy Objects) let you configure workstations
  • Audit and compliance: full traceability of access and changes

Users

A user in Active Directory is the entity representing a person or service that needs to access network resources. Every user has:

  • A samAccountName (e.g. "ngabriele") — the unique Windows identifier
  • A userPrincipalName (e.g. "ngabriele@domain.fr") — email format
  • A password managed by AD
  • Custom attributes (title, department, phone, etc.)

Creating a user

Through the graphical interface (Active Directory Users and Computers) or in PowerShell, using the New-ADUser cmdlet with the name, SamAccountName, UPN, OU path, and a secure password.

Groups

Groups let you manage access rights collectively. An AD group contains users, other groups, or computers. There are two types of groups:

Security Groups

Used to control access to resources (shares, printers, NTFS permissions). This is the most common type.

Distribution Groups

Used mainly for messaging, in particular to create mailing lists.

Best practices for groups

  • Clear naming: GRP_DEPT_FUNCTION_PERMISSION
  • Granularity: create groups for specific needs
  • Nesting: use inheritance to simplify management
  • Documentation: keep an up-to-date list of groups

Clean user and group management isn't just a security matter — it's also a question of long-term maintainability.

Day-to-day management

As an administrator, you'll be expected to:

  1. Create users when people join
  2. Update groups when roles change
  3. Disable users when people leave
  4. Reset passwords
  5. Audit group memberships

Conclusion

Mastering user and group management in Active Directory is fundamental for any system administrator. It's an important responsibility that requires rigor and a good understanding of the organization's needs.