Domain administration basics: users, groups, GPO
You learn from scratch to manage users, groups and organisational units in Active Directory, apply Group Policy and organise them along least-privilege lines.
Level 101 · 13 lessons · 12 practice labs
Lessons
The directory
- The idea of a directory service: identity in one place
- Joining a computer to the domain
- Organisational units: structure and delegation
- Short task: build an OU structure for a small company
Users and groups
- Managing users with samba-tool and PowerShell
- Group types and scopes
- Granting access through groups (AGDLP)
- Account steps when people join and leave
- Short task: move a share’s permissions from users to groups
Group Policy
- Creating and linking a GPO
- Distributing basic security settings with GPO
- Finding out why a GPO doesn’t apply
- Capstone: set up accounts, groups and policies for a new branch
Practice labs
- Build an OU structure for a new branch: Create sub-OUs for users, computers and groups and list the structure.
- Delegate password reset rights to the help desk: Grant password reset on the branch OU only and test it with the help desk account.
- Find an over-broad delegation and narrow it: Review the permissions on the OU, find the group given full control and reduce it to the needed right only.
- Create an account for a new starter and add it to a group: Create the user in the right OU, force a password change at first logon and add it to the department group.
- Disable a leaver’s account and remove its groups: Disable the account, remove its group memberships and move it to the leavers OU.
- Move share permissions from users to groups: Find permissions granted directly to users, create a role group and grant access through the group.
- Fix a group created with the wrong scope: Rearrange a department group made universal to follow AGDLP and show access still works.
- Find a hidden membership that comes through nested groups: Work out which share a user reaches through nested groups and break the unneeded chain.
- Roll out a screen lock setting with a GPO: Create a ten-minute screen lock GPO, link it to the OU and show it applies on the client.
- Find why a GPO does not apply: Inspect the result with gpresult, fix the security filtering or link problem and try again.
- Work out why a policy is overridden on an OU blocking inheritance: Explain the precedence between blocked inheritance and an enforced link and make the wanted setting take effect.
- Run the account flow end to end for a joiner, a mover and a leaver: In a three-person scenario create the account in the right OU, strip the mover’s old groups, disable and move the leaver, and record each step.
About this course
You learn from scratch to manage users, groups and organisational units in Active Directory, apply Group Policy and organise them along least-privilege lines.
What you will learn
- The directory
- Users and groups
- Group Policy
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.