Introduction

In a Windows Server 2003 Active Directory domain, security object users, groups, and computers are represented as account objects that exist within the directory hierarchy and can be created, modified, moved, and removed. Managing these security objects is an important part of the network administrator s job. Luckily, Microsoft has included many administrative tools, both graphical and command-line, with which you can manipulate and manage these accounts.

In this chapter, you will learn about how Windows Server 2003 treats users, groups, and computers in the Active Directory environment, and we will walk you through the process of using the common management tools, including Active Directory Users and Computers (ADUC) and other useful utilities. We will show you how to create and modify user, group, and computer accounts with ADUC, and you ll learn to automate account creation and import user accounts.

Groups are special objects that contain users, and security groups are used to simplify management of multiple user accounts by enabling you to apply permissions, user rights, and so forth to an entire group of users in a single operation instead of having to apply them to individual user accounts. You ll learn to identify and modify the scope of a group, manage group memberships, and find out to which domain groups a user belongs.