Active Directory: Managing Groups, Computers and OUs

Explore managing computer objects in Active Directory, including joining computers to a domain, configuring computer accounts and secure channels, and performing offline domain join.

Create dedicated organizational units for client and server computer objects instead of using the default computers container to enable delegation and targeted group policy application.

Identify the computers container as the default location for computer accounts in Active Directory and learn why creating custom OUs improves GPO linkage and management.

Ensure you have permissions on the computer object, are in the local administrators group, stay under the machine account quota, and recreate computer object in the correct OU before joining.

Learn how to join a Windows computer to a domain by accessing the computer name tab in advanced system settings, providing domain credentials, and restarting after the join.

Understand how the computer account and domain establish a secure channel and what happens when trust fails. Reset the secure channel or rejoin the domain using AD tools.

Learn how a member computer stores its domain password as an LSA secret for the netlogon secure channel, and how to reset trust with netdom, nltest, dsmod, and PowerShell commands.

Learn how to perform an offline domain join by provisioning a domain join file with the disjoint command, transferring the save file, and rebooting to complete the join.

Plan the OU structure and implement delegation of control wizard to assign permissions by task, ensuring administrative tasks align with your organization's needs.

Plan and implement OUs in an Active Directory domain using location-based, resource-based, organization-based, multi-tenancy, and hybrid strategies to delegate administration, apply group policies, and manage objects efficiently.

Evaluate OU design in Active Directory through location-based, resource-based, organization-based, multi-tenant, and hybrid strategies. The knowledge check tests understanding of planning OUs and delegated administration.

Design the OU structure for administrative purposes and consistent GPO application, reflecting same control needs. Plan for change by managing inheritance and using lower-level OUs or security filtering for departments.

Explore considerations for using organizational units in Active Directory, including creating OUs with graphical tools or PowerShell, protecting them from accidental deletion, and moving them with permission implications.

Explore Active Directory OU design, delegation, and GPO application. Learn about inheritance, change management, and the practical steps to create or move OUs.

Explore how Active Directory delegation works, including OU-based permissions, inheritance, and security descriptors, and learn how to configure delegated admins and review access using the security tab.

Delegate Active Directory permissions by using object type delegation or role-based delegation, assigning rights to groups rather than individuals for targeted tasks across OUs and resources.

Explore tokens, security descriptors, and delegation methods in Active Directory, then validate understanding through knowledge-check questions on inheritance, role-based delegation, and the Delegation of Control Wizard.

Use Windows PowerShell to automate AD DS administration, manage groups, computer accounts, and OUs, perform bulk operations, query and modify objects, and work with comma-separated files.

Use Windows PowerShell to create, modify, and delete Active Directory groups, and manage group membership with commands to add, remove, and view group members.

Learn to manage Active Directory groups and memberships with PowerShell by creating security groups (global, domain local, universal), adding and removing members, and modifying group objects.

Add users and computers to security groups in Active Directory using PowerShell. Learn to add single or multiple members, from files or OUs, and verify results in the GUI.

Learn to manage computer accounts in Active Directory with PowerShell, add them to security groups using Add-ADGroupMember, and verify membership with Get-ADGroupMember for policy and deployment tasks.

Learn to nest security groups in Active Directory with PowerShell, explore domain local, global, and universal scopes, and perform bulk creation and member addition to a parent group.

List security group members with Get-ADGroupMember and Get-ADGroup, inspect object class, and export results to csv; remove members or groups with Remove-ADGroupMember and Remove-ADGroup, including bulk removal from csv.

Explore Windows PowerShell cmdlets to manage computers and OUs, including creating and deleting computer accounts with New-ADComputer, testing secure channels, resetting passwords, and organizing units with New-ADOrganizationalUnit.

Learn to manage computer objects in Active Directory with PowerShell: create, modify, move, and enable or disable computer accounts using New-ADComputer, Set-ADComputer, and Move-ADObject.

Enable, disable, and remove stale computer accounts in Active Directory with PowerShell. Follow security policies and regular reconciliations using Get-ADComputer, Enable-ADAccount, Disable-ADAccount, and Remove-ADComputer.

Learn the foundations of PowerShell, including pipelines, aliases, navigation, and common commands like Get-ChildItem, Get-Command, and Get-Help, to build scripts and manage objects.

Learn how WMI and CIM, built on DMTF standards, provide a common information repository via Windows PowerShell. Compare ad hoc WMI connections and session-based CIM connections through WinRM.

Explore the five FSMO roles—schema master, domain naming master, read master, infrastructure master, and PDC emulator master—and how they prevent replication conflicts by designating the controlling domain controllers.

Transfer or seize Fisma roles in an Active Directory environment, using GUI tools or NTDSUTIL and PowerShell, to move roles between domain controllers while understanding replication and last-resort seizing.