Good day, Cloud Gurus, and welcome back.
In this lesson, we're going to take a look
at managing Active Directory Domain Services'
users and groups.
Let's take a look at what we're going to cover.
In this lesson, we're going to cement some of the concepts
that we learned in the previous lesson,
and we're going to go through a demo
of managing users and groups
using the range of tools that are available to us.
All right, let's take a look at a demo
of managing users and groups.
We have 2 domains in a single forest
and we'll manage the users and groups
using a domain controller
from each of the domains in the forest.
We'll go through the steps to create a user
and then we will create and manage groups,
including global groups, universal groups
and domain local groups.
And then finally,
we will enable the Active Directory recycle bin,
and then we will delete and restore a user.
Let's take a look at the demo.
All right, so here we are logged onto CORP-BNE-DC01.
We're going to go ahead
and use the Active Directory Administrative Center
to create and manage Active Directory users and groups.
We'll go ahead and open
the Active Directory Administrative Center
and then we'll select our domain in the left hand menu
and then we'll select the Users node.
Now we're going to go ahead and create a new user,
so we'll select New and then User.
All right, now we need to provide some details for the user.
We're going to provide the user's first name and last name
and then we'll go ahead
and provide the user's User Principle Name logon,
which they can use to log on to the Active Directory domain.
And now we're going to go ahead
and provide a password for this new user.
All right, and now let's take a look at
some of the password options that we can set.
It's a good idea to always have your users
change their password when they first log on,
but you can also, if you want to,
change the password options
to set the password never to expire
or set that the user can't change their password.
These are both not recommended
so we're just going to leave this
back at user must change password at next log on.
Now I want to point out some additional account
restrictions. If the user was only working
at the company for a short time,
you could have the user account expire on a set date
and you can also set that the user can only log on
during specific hours,
or you can set that the user
can only log on to specific computers.
All right, we'll go ahead and create Kristin now.
All right, with Kristin created,
we'll just navigate into the Users container
and then we'll scroll down to Kristin's account,
and I just want to show you
that user accounts can also be enabled or disabled.
All right, let's go ahead and create a global group.
We'll navigate back to our domain
and then we'll select the Users node again,
and then we'll select New and then we'll select Group.
Now we're going to create a global group
that we're going to place
all of our accounts payable staff into.
So we'll go ahead and create a group
with the name corporate accounts payable staff.
Now we're also going to go ahead
and make Kristin a member of this group.
So we'll scroll down to members
and then we'll select Add
and we'll add Kristin,
and then we'll go ahead and click OK
to create the corporate accounts payable staff group.
Now we're currently logged in
to the root domain in this forest.
We'll go ahead and select New and then Group.
This time, we're creating a universal group
and we're going to call this group
All Accounts Payable Staff,
and this group can be used
to house all of the global groups
from each of our domains in our forest.
So we'll go ahead
and add the global group that we just created
as a member of this group.
And then we can go OK to create this group.
All right, now that we've created
a few Active Directory objects,
I want to show you a very neat feature
in the Active Directory Administrative Center.
Active Directory Administrative Center
includes Windows PowerShell history.
So you can use this to work out
which PowerShell cmdlets you'd need to use
to automate these processes.
So I'll go ahead and open the Windows PowerShell history
and I'll scroll up to the top,
and you can see here that as we were completing steps
in the Active Directory Administrative Center,
it was actual running PowerShell in the backend.
All right, now we're halfway through
our group nesting strategy.
Let's jump over to the research domain
where the resources are that these users need to access.
All right, so here we are on RES-BNE-DC01
and we're going to go ahead and create
an accounts payable research data domain local group.
Now we could use the Active Directory Administrative Center
to create this group as well,
but I'm going to use
Active Directory Users and Computers instead. And
then we're going to right-click Users and select New Group.
Now, because we're going to use this group
to grant access to research data,
we're going to create a domain local group
and our group name is Accounts Payable Research Data
and we'll go ahead and select OK.
And now we're going to add our universal group,
all accounts payable staff, to the domain local group.
We'll double click the Domain Local Group
and then we'll select Members
and then we'll select Add
and then we're going to add in
our All Accounts Payable Staff universal group.
Now, is there anything else
that you think I might need to change here
before I continue?
You might've guessed correctly.
We need to change the location
because this universal group is in our root domain,
not in our child domain.
So we're going to go ahead and select Locations,
and then we're going to select
the root domain, corp.barrierreefaudio.com
and then we'll go, OK, and then Check Names,
and then we can go ahead and select OK.
And then we'll go ahead and select OK again.
All right, now with our group created,
we could then use this group
on the access control list of our resource,
like a database or a file server share,
to grant access to that resource.
And we'll cover granting access to things
like file servers, later on in the course.
For now, let's jump back to CORP-BNE-DC01
and we'll take a look at the Active Directory Recycle Bin.
All right, so here we are back on CORP-BNE-DC01.
I'm just going to go ahead
and minimize the Windows PowerShell history,
and then we've selected the CORP domain
in the left-hand menu
and we're going to go ahead
and enable the Active Directory Recycle Bin,
so we'll select Enable Recycle Bin.
And we just get a confirmation
indicating that once the recycle bin has been enabled,
it can't be disabled, so we'll select OK.
All right, now the Active Directory Recycle Bin
has been enabled for the forest.
It'll now replicate to all of the domain controllers
in the forest.
We need to refresh
the Active Directory Administrative Center
to see this change.
We'll go ahead and select OK
and then we'll go ahead and refresh
the Active Directory Administrative Center.
All right, now let's go ahead and delete the user account.
So we'll navigate into the Users node,
and then we'll delete Kristin.
All right, with Kristen deleted,
we'll now go ahead and navigate back to the domain
and then we'll select the deleted objects container,
and then we'll go ahead and restore Kristin.
All right, and it's as simple as that.
You can easily delete and restore
Active Directory users
using the Active Directory recycle bin.
All right, that concludes this demo.
Let's wrap up with a bit of a summary
of what we've covered in this lesson.
All right, so what have we covered in this lesson?
You can use the Active Directory Users and Computers console
to manage your users and groups
in the Active Directory database,
but the Active Directory Administrative Center
and Windows PowerShell provide the latest functionality,
including support for the Active Directory recycle bin.
And it's important to remember
a couple of key Windows PowerShell commandlets
and the first of these is New-ADUser
and it's used to create a new user
in the Active Directory database.
And when you need to update a user with PowerShell,
you use the Set-ADUser PowerShell cmdlet
to update an existing Active Directory user account.
All right, that concludes this lesson.
Thanks for being with me and I hope you found it useful,
and I look forward to seeing you in the next lesson.