Last week I showed you how to create user accounts and user templates. So today, I’m going to show you how to put all of these users into a group.

Why would we want to do that? Well, let’s say for example that we have this one shared folder on our network that we want only our Sales Department to have access to.

Without groups in your Active Directory, you would have to go to each individual Sales Department user account and give that account access to that shared folder. That can take quite some time if you have, let’s say … 200 users in your Sales Department.

Instead, what we are going to do is, take all the Sales Department user accounts and put them in a Sales User Group. Now when I want to give access to all of my Sales Users to that shared folder, I just give the entire Sales Group access to it and voila! All Sales Users now have access to our shared folder!

That’s just so much easier, isn’t it? You can then take the Sales User Group and put it in a Sales Organizational Unit.

Organizational Unit is really just a folder for organizational purpose, to keep your Active Directory nice and clean. You can add different groups, computers and other resources to an Organizational Unit.

Enough talk, let me show you how you can accomplish all of this in your Windows Server 2008 Active Directory.

Creating an Organizational Unit

1. Start by opening up your Server Manager, then expand the Roles section.

2. Next expand the Active Directory Domain Services section and click on Active Directory Users and Computers.

3. At this point you should be able to see your domain. In our example we are using the Globomantics domain. Go ahead and expand your domain.

4. Now we need to create an Organizational Unit for a group to live in. In our example we are going to create an OU for our Ops Team.

To create a new Organization Unit, right-click on your domain name, point to the New option and then select Organizational Unit.

5. Type in the name of your OU and make sure that the box is checked next to Protect container from accidental deletion. When done, click OK.

6. We now have a new Organizational Unit in our Active Directory called OpsOU.

Creating a New Group

1. After you create an Organizational Unit in your Active Directory, you are ready to create your first group. Go ahead and select your OU and then right-click in the blank area.

2. Next, point to New and then select Group.

3. The next step is to name your Group, select the scope and then select the type.

In this example we are going to name our group OpsUSers. We are also going to leave the default selections for group scope, which is Global, and group type, which is Security. When you are ready, click OK.

4. Our new group has been created!

Moving Accounts Into a Group

1. In order to move pre-existing accounts into a group, you need to hold down the Control key and click on all the User or Computer accounts that you want to move into that group.

2. Then you need to right-click on any one of those accounts and select Add to a group.

3. Next, you need to type in the group name and let the machine find it.

In our example, I will type in OpsUsers and then click on the Check names button. Once the name is verified and group name is found, the text will become underlined and you can click the OK button. Since we know our group exists, we are going to click OK without verification.

4. Now all of these accounts are part of our OpsUsers group.

Note: Another way of accomplishing this would be to click on an account, hold it, then drag and drop it into a particular group. Depending on how much you like to use your mouse and how much time you have this may or may not be your preferred way of accomplishing this task.

Related posts:

• Windows Server 2008 Active Directory — Creating Users is Easy!
• Installing Software Using GPOs on Windows Server 2008
• Lesson 3: Active Directory Users and Groups in Windows Server 2008

Most of the time we create user accounts for people, however user accounts can also be created for applications or processes.

User accounts allow a person to access resources on a network. But we can just as easily deny access to certain resources on the network through the user account. That’s why, User Account Objects are quite important and very useful.

Today I’ll show you how easy it is to create a new user account, create a user template and how to use a template — all on your brand new Windows Server 2008!

Next week we’ll discuss User Groups and Organizational Units. Now, let’s get started with creating a user account.

Creating a New User Account

1. To start let’s go ahead and open up Server Manager

2. Then we will open up the Roles section — next to Active Directory Users and Computers section and finally the Active Directory Users and Computers.

You should now see your domain name.

3. We are going to click on our Users section where we are going to create a new User Account. To do so, right-click on the blank section, point to New and select User.

4. In this window you need to type in the user’s first name, middle initial and last name. Next you will need to create a user’s logon name.

In our example we are going to create a user account for Billy Miles and his logon name will be bmiles. When done, click on the Next button.

5. In the next window you will need to create a password for your new user and select appropriate options.

In our example we are going to have the user change his password at his next logon. You can also prevent a user from changing his password, set the password so that it will never expire or completely disable the account.

When you are done making your selections, click the Next button.

6. And finally, click on the Finish button to complete the creation of new User Account.

Creating a User Template

A user template in Active Directory will make your life a little easier, especially if you are creating users for a specific department, with exact same properties, and membership to the same user groups.

A user template is nothing more than a disabled user account that has all these settings already in place. The only thing you are doing is copying this account, adding a new name and a password.

You may have multiple user templates for multiple purposes with different settings and properties. There is no limit on the number of user templates, but keep in mind that they are there to help you, not to confuse you, so keep in mind less is better.

To create a user template, we are going to create a regular user account just like we did above. A little note here, you may want to add an * as the first character of the name so it floats at the top in AD and is much easier to find.

1. To start out, right-click on the empty space, point to new, and select User.

2. Type in the user’s name (with asterisks if so desired) and click Next.

3. Create the template’s password and do not forget to check the box next to the Account is disabled option. When ready, click Next.

4. Once the account is created, you can go ahead and add all the properties you need for that template. To do so, double-click on that account and navigate to a specific tab. Once done click OK.

Using a Template

1. Now in order to use that user template, we are going to select it, copy it and add the unique information such as user name, password, etc.

We can do that for as many users as needed. Let’s start by right-clicking on the template and selecting Copy.

2. Next we are going to enter the user’s name, login and password information while making sure the checkbox next to Account is disabled is unchecked.

3. Once we finish, our new user account is created with all the properties of the template account. Now wasn’t that easy!

Related posts:

• Server 2008 Active Directory User Groups — the Easy Way!
• Lesson 3: Active Directory Users and Groups in Windows Server 2008
• Windows Server 2008: Auditing Active Directory