Good day, Cloud Gurus, and welcome back.
In this lesson,
we're going to take a moment to explore Active Directory
Domain Services, users, and groups.
Let's take a look at what we're going to cover.
First up,
we'll take a look at what exactly are user accounts.
Then we'll take a moment to understand
Active Directory Domain Services groups.
We'll take a moment to understand group scopes,
and then we'll go through
the user and group management tools
that are available to you,
and then we'll take a look at
the Active Directory recycle bin.
All right, let's get started.
So what are user accounts?
Well, a user account can be seen as a representation
of a person in the Active Directory database.
The user account mirrors the properties
of the actual person, including details like their name
and their department.
And all user accounts have a username and a password,
and user accounts are also a member
of one or more Active Directory groups.
And a user account is designed to serve 2 purposes.
The first is that it authenticates the user.
The domain controller confirms the person logging in
matches the user account in the database,
and each person should have their own unique user account
in Active Directory.
User accounts are also used to authorize
or deny access to domain resources.
This authorization might occur at log on.
Are they allowed to log on now?
Are they allowed to log on to this workstation?
But it also occurs after authentication.
Is this user allowed to access this given resource?
And this authorization is usually based on group memberships
and the log on process is typically completed
on a domain-joined computer.
Now, let's take a moment to understand
Active Directory Domain Services groups.
Now you can authorize access
to resources by granting that access
to each of the individual user accounts.
But as your company grows,
this will quickly get difficult to maintain
and permissions can easily get left behind
as a user changes roles within the company.
Groups allow you to authorize access
to resources using groups
instead of assigning that access to the users individually.
You can add the users as members of the group
and then grant access to the group instead of the user.
And this is very handy when users change,
you can simply remove the user from the group
and they no longer have all of the access
that was previously granted
through their membership to that group.
And groups can also be members of other groups,
and as you can imagine
this starts to get a little interesting.
And if this is not managed well,
it can actually end up being more effort
to maintain the groups
then it was to maintain the individual users.
When you create group,
you need to provide the group type and the group scope.
There are 2 types to be aware of.
The first of those is security groups.
You can use security groups in permission entries
in access control lists to help control the security
of that resource.
The other group type is distribution groups
and distribution groups are typically used
by email applications to distribute email.
Distribution groups are not security enabled
and you can't use them to provide access to resources,
and distribution groups are almost considered legacy now
and they've been almost entirely replaced
by Microsoft 365 Groups,
which is a concept that we'll cover
later in this course.
Security groups are our focus for this lesson.
Now that we understand the group types,
let's take a look at group scope.
When you create a group,
you need to provide the group scope.
The scope determines 2 things:
which users can be members
and where the group can be used to assign permissions.
And there are 4 group scopes to be aware of.
Let's take a look at them.
The first is local groups,
and local groups aren't an Active Directory group scope,
but rather a group scope that exists
solely on individual Windows computers.
Members of this group can be from anywhere
in the Active Directory forest.
And you can assign permissions only to local resources
meaning resources on that local computer.
And then we have domain local groups.
And domain local groups are stored
in the Active Directory database.
Domain local groups are primarily used to manage access
to resources or assigned management rights
and responsibilities.
Members of domain local groups
can be from anywhere in the Active Directory forest
but the resources must be in the local domain.
And then we have global groups,
and global groups are primarily used
to consolidate users who have similar characteristics.
The members can be only from the local domain
and they can be used to provide access
to resources anywhere in the forest.
And the last group scope to be aware of is universal groups.
You use this group type most often in multi-domain networks
because it combines the characteristics of both domain
local groups and global groups.
Members of universal groups can be from anywhere
in the forest.
And they can grant access to resources
anywhere in the forest.
But now you might be thinking, well, this is easy.
I'll just put everyone in universal groups
and they're not going to sign their access
and I don't even need to care about group scope.
But be warned,
universal groups and their members
are stored in the Global Catalog.
If all your groups were universal groups
it would greatly increase your Active Directory
replication traffic.
So you should use universal groups sparingly.
Now your head might be spinning
like mine was when I first learned about this.
So I'll give you a bit of a memory trick
that'll help you remember the group nesting strategy,
and that is A G U D L P
because this is the group nesting strategy recommended
by Microsoft in a multi-domain forest.
And that is that accounts should be placed
into global groups,
which are then placed into universal groups,
which are then placed into domain local groups,
and then those main local groups
are used to assign permissions.
Now in a single domain forest,
you don't need the universal groups.
You can simply add the global groups
directly to the domain local groups.
And I come up with a memory trick
to remember this group nesting strategy
and that is all good users download patches.
Use this nesting strategy
when you are adding users to groups in Active Directory.
Consolidate your user accounts into global groups.
Based on their role in the company,
you might have a global group
for your accounts payable staff
and another one for your service desk staff,
and then if you're in a multi-domain environment,
consolidate all of these global groups
into universal groups.
And then you add those universal groups
to a domain local group
and then you add that domain local group
to the resources access control list.
Now here's a tip for the exam.
While you can add groups as members of other groups,
domain local groups cannot be members
of either universal or global groups,
and that's why it's important to remember this
group nesting strategy.
All right, now let's take a look at some of the
user and group management tools.
The first and most common user and group management tool
to be aware of is Active Directory Users and Computers.
It's the oldest and most used tool, but because it's so old,
it doesn't include some of the newer functionality.
Another tool to be aware of
is the Active Directory Administrative Center.
It's the latest desktop application
and it provides all of the latest functionality.
Another important tool to be aware of is Windows PowerShell.
It's the latest command-line tool
and it provides full functionality
and it can be even used
to automate your Active Directory processes.
And the final tool to be aware of
is the Windows Admin Center.
It's the latest web-based tool available from Microsoft
but it's not specific to Active Directory user
and group management.
So we'll take a look at Windows Admin Center
later on in the course.
Now let's take a look at the Active Directory Recycle Bin.
The Active Directory Recycle Bin enables quick
and full restores of deleted Active Directory objects.
It's enabled and managed
using the Active Directory Administrative Center
or Windows PowerShell,
and it's important to know that
once the Active Directory Recycle Bin has been enabled
it can't be disabled
and you can enable the recycle bin
using the Enable-ADOptionalFeature PowerShell cmdlet.
All right, so what have we covered in this lesson?
It's important to remember
that user accounts are a representation of a person
in the Active Directory database,
including their username, their password,
and their group memberships,
and user accounts are used in authentication
and authorization with the domain controller.
And there are 2 group types to be aware of:
security groups and distribution groups.
And security groups are used to grant access to resources,
whereas distribution groups are largely considered
to be legacy these days
and replaced by Microsoft 365 Groups.
There are also four group scopes to be aware of,
local, domain local, global, and universal.
And finally, it's important to remember
that the Active Directory Recycle Bin
can be used to completely restore
deleted Active Directory users and groups.
All right, that wraps up this lesson.
Thanks for being with me
and I hope you found it useful.
And I look forward to seeing you in the next lesson.