Create and Manage Active Directory Groups and OUs Flashcards
What is group nesting?
When a group is added as a member of another group.
Example: Global Groups into Universal Groups into Domain Local Groups
What is Microsoft’s best practice in terms of AD Group structure?
The acronym AGUDLP can be used to remember Microsoft’s best practice structure
Accounts > Global Groups > Universal Groups > Domain Local Groups
How do you convert groups in AD?
Within ADUC, navigate to a group’s Properties > General tab.
Under Group Scope, available options are displayed to convert to
What are the membership restrictions, permissions that can be assigned, and available conversion options for Global Groups?
Membership:
- Accounts from the same domain as parent GG.
- GGs from the same domain as parent GG
Permissions can be assigned in any domain.
Can convert to Universal Groups only when GG is not a member of another GG.`
What are the membership restrictions, permissions that can be assigned, and available conversion options for Universal Groups?
Membership:
- Accounts from any domain within the forest
- GGs from any domain within the forest
- UGs from any domain within the forest
Permissions can be assigned in any domain or forest.
Can be converted to a Domain Local Group or a GG. Can only convert to a GG if it is not a member of a UG.
What are the membership restrictions, permissions that can be assigned, and available conversion options for Domain Local Groups?
Membership:
- Accounts from any domain
- GGs from any domain
- UGs from any domain
- DLGs from any domain
Permissions can be assigned only within the same domain as the parent DLG
Can be converted to UGs only if DLG doesn’t contain other DLGs
How do you manage group membership using Group Policy?
Navigate to Group Policy Management > Domain > Default Domain Policy > right click, edit > Policies Windows Settings > Security Settings > Restricted Groups
This policy can be used to add members only to local groups.
How do you enumerate group membership?
Enumeration (listing) of group members is done in PowerShell by typing:
Get-ADGroupMember
How do you automate group membership management using PowerShell?
By using the New-ADUser, New-ADGroup, and Add-ADGroupMember cmdlets.
What PowerShell command can be used to create a new AD User?
New-ADUser -Name “” -SamAccountName “ -Path “OU=,DC=,DC=COM”
What PowerShell command can be used to create a new AD Group?
New-ADGroup -Name “” -SamAccountName -GroupCategory Security -GroupScope DomainLocal -Path “OU=,DC=,DC=COM
What PowerShell command can be used to add members to a group?
Add-ADGroupMember ,,
How do you delegate the creation and management of AD Groups and OUs?
Right click on OU > Delegate Control
Within the “Delegation of Control” wizard, on the Tasks to Delegate screen, different permissions can be assigned to groups/users.
How do you create a new OU?
Within ADUC, right click on domain/OU > New > OU
How do you create a new Group?
Within ADUC, right click on domain/OU > New > Group
