Lesson 14: Creating and

Managing Active Directory

Users and Computers
MOAC 70-410: Installing and Configuring
Windows Server 2012
 Overview
• Exam Objective 5.2: Create and Manage
Active Directory Users and Computers
• Creating User Objects
• Creating Computer Objects
• Managing Active Directory Objects

© 2013 John Wiley & Sons, Inc. 2

 Creating User Objects
Lesson 14: Creating and Managing Active
Directory Users and Computers

© 2013 John Wiley & Sons, Inc. 3

 Creating User Objects
• The user account is the primary method for
authentication on a network.
• Usernames and passwords are validated at
log on by comparing entered information to
the information stored in the AD DS
database.

© 2013 John Wiley & Sons, Inc. 4

 Types of Users
• Local users: These accounts can only
access resources on the local computer
and are stored in the local Security Account
Manager (SAM) database on the computer
where they reside.
• Domain users: These accounts can access
AD DS or network-based resources, such as
shared folders and printers.
o Account information for these users is stored in
the AD DS database and replicated to all
domain controllers within the same domain.

© 2013 John Wiley & Sons, Inc. 5

 Built-In User Accounts
Administrator and Guest
• On a member server or standalone server: The
built-in local Administrator account has full
control of all files as well as complete
management permissions for the local
computer.
• On a domain controller: The built-in
Administrator account created in Active
Directory has full control of the domain in which
it was created.
The Administrator account cannot be deleted,
but it can be renamed.

© 2013 John Wiley & Sons, Inc. 6

 Administrator Account
Security Guidelines
• Rename the Administrator account
• Set a strong password
• Limit knowledge of administrator passwords
to only a few people
• Do not use the Administrator account for
daily non-administrative tasks

© 2013 John Wiley & Sons, Inc. 7

 Guest Account
• This built-in account is used to provide
temporary access to the network for a user
such as a vendor representative or a
temporary employee.
• It cannot be deleted, but it can and should
be renamed.
• This account is disabled by default and is
not assigned a default password.

© 2013 John Wiley & Sons, Inc. 8

 Managing Disabled
Accounts
• Disabling a user account prevents anyone
from using it to log on to the domain until an
administrator with the appropriate
permissions enables it again.
• You can disable user accounts manually.
• It is also possible for a system to
automatically disable them for security
reasons.
• It is a simple Disable/Enable option in the
GUI interface.

© 2013 John Wiley & Sons, Inc. 9

 User Account
Demonstration

© 2013 John Wiley & Sons, Inc. 10

 Creating Computer Objects
Lesson 14: Creating and Managing Active
Directory Users and Computers

© 2013 John Wiley & Sons, Inc. 11

 Computer Objects
• Consist of properties that specify the
computer’s name, where it is located, and
who is permitted to manage it.
• Inherit group policy settings from container
objects such as domains, sites, and
organizational units.
• Can be members of groups and inherit
permissions from group objects.

© 2013 John Wiley & Sons, Inc. 12

 Adding a Computer
to a Domain
• Creating a computer account: Create a new
computer object in Active Directory and assign
the name of an actual computer on the
network.
• Joining the computer to the domain: The system
contacts a domain controller, establishes a trust
relationship with the domain, locates (or
creates) a computer object corresponding to
the computer’s name, alters its security identifier
(SID) to match that of the computer object,
and modifies its group memberships.

© 2013 John Wiley & Sons, Inc. 13

 Adding a Computer
to a Domain
Two ways to create AD computer objects:
• Create the computer objects in advance
using an Active Directory tool, so that the
computers can locate the existing objects
when they join the domain.
• Begin the joining process first and let the
computer create its own computer object.

© 2013 John Wiley & Sons, Inc. 14

 Lesson Summary
• The user account is the primary means by which
people using an Active Directory Domain Services
network access resources.
• One of the most common tasks for administrators is
the creation of Active Directory user objects.
Windows Server 2012 includes several tools you can
use to create objects.
• Windows Server 2012 has redesigned the Active
Directory Administrative Center (ADAC)
application, first introduced in Windows Server 2008
R2, to fully incorporate new features such as the
Active Directory Recycle Bin and fine-grained
password policies. You can also use the tool to
create and manage AD DS user accounts.

© 2013 John Wiley & Sons, Inc. 15

 Lesson Summary
• Microsoft Excel and Microsoft Exchange are two
common applications in which you can have a number
of users, along with their accompanying information, to
add to the AD DS database. In these cases, you can
export information from the applications by saving it to a
file in Comma-Separated Values (CSV) format.
• LDIFDE.exe is a utility that has the same basic
functionality as CSVDE.exe and provides the ability to
modify existing records in Active Directory.
• Because an AD DS network uses a centralized directory,
there has to be some means of tracking the actual
computers that are part of the domain. To do this, Active
Directory uses computer accounts, which are realized in
the form of computers objects in the Active Directory
database.

© 2013 John Wiley & Sons, Inc. 16

 Lesson Summary
• The process of actually joining a computer to a
domain must occur at the computer itself and be
performed by a member of the computer’s local
Administrators group.
• Administrators typically join computers to domains
while the computers are connected to the network
and have access to a domain controller. However,
in some situations administrators may want to set up
computers without access to a domain controller,
such as a new branch office installation. In these
cases, it is possible to perform an offline domain
join, using a command line program called
Djoin.exe.

© 2013 John Wiley & Sons, Inc. 17

Copyright 2013 John Wiley & Sons, Inc.
All rights reserved. Reproduction or translation of this work beyond that
named in Section 117 of the 1976 United States Copyright Act without the
express written consent of the copyright owner is unlawful. Requests for
further information should be addressed to the Permissions Department, John
Wiley & Sons, Inc. The purchaser may make back-up copies for his/her own
use only and not for distribution or resale. The Publisher assumes no
responsibility for errors, omissions, or damages, caused by the use of these
programs or from the use of the information contained herein.