03
Active Directory administration
Running a Windows domain: users, groups, OUs and Group Policy, plus the tickets help desks handle every day.
- Role
- Course and hands-on lab
- When
- 2026
- Relevant for
- IT SupportCloud & Infrastructure
example.local · synthetic lab domain
▾ OU=IT
- usrAlex Chen
- pcIT-LT-01
- grpHelpdesk-PasswordReset
▾ OU=Sales
- usr_Sales Templatetemplate
- usrJordan Patel
- pcSAL-LT-07
- grpSales-Staff
▾ OU=Finance
- usrPriya Shah
- usrDana Brown
- pcFIN-DT-03
- grpFinance-Share-RW
▾ OU=Warehouse
- usrSam Kim
- pcWH-PC-02
- grpWarehouse-Staff
▾ OU=Disabled Users
- (empty)
action log · T-1041
- ✓Find the user in Active Directory Users and Computers
PS> Get-ADUser p.shah -Properties LockedOut - ✓Account tab → Unlock account
PS> Unlock-ADAccount p.shah - ✓Reset Password…
PS> Set-ADAccountPassword p.shah -Reset - ✓Tick "User must change password at next logon"
PS> Set-ADUser p.shah -ChangePasswordAtLogon $true
What I told them“You're unlocked. Pick a new password when you sign in.”
My part
I built and ran my own lab domain through an Active Directory course, and keep detailed notes I use for recap.
Problem
Most organizations still run on Active Directory. Support and sysadmin work means knowing it well enough to fix access problems quickly and safely.
Approach
Set up a domain controller with DNS, organized users and computers into OUs by department, created security groups for access, joined a Windows client to the domain, and used Group Policy for password rules, mapped drives and desktop settings. Then practised the common tickets: lockouts, password resets, new starters, department moves and leavers.
Outcome
Hands-on practice with the everyday Active Directory tasks that support and sysadmin roles handle.
What I did
Domain controller and DNS
Set up a domain controller with DNS and joined a Windows client to the domain.
Windows ServerDNS Manager
Groups and scopes
Security groups for access, distribution groups for email; domain local, global and universal scopes.
Group Policy
Password and lockout policy, mapped drives and restricted settings; gpupdate and gpresult to apply and check.
Group Policy Management
Delegated password resets
Password resets delegated to a help desk group without full admin rights.
Lockouts and resets
Unlock, reset, and "must change password at next logon".
ADUCUnlock-ADAccount
Joiners, movers, leavers
Create from a template, move between OUs, disable and clean up.
Get-ADUser
Stack
- Windows Server
- Active Directory Domain Services
- DNS
- Group Policy
- ADUC
- PowerShell (basic)