What is Active Directory Users & Computers

Hello, this is Paul Hill. And in this lecture I'm going to be talking to you about Active Directory users and computers. You're going to learn what it is as well as how to open and use the console. Active Directory users and computers, also known as Active Directory or AD for short, is a tool that is installed by default when a server has the Active Directory domain services role installed. In other words, when you're working with a domain controller, you can expect to see Active Directory installed on the server. Now you can also install active directory by installing the remote server administration tool set or set, but you will have to connect to a domain controller in order for that to work properly. Now, just as the name implies, Active Directory is a live directory or database that stores user accounts and their passwords, computers, printers, file shares, security groups and their respective permissions. A group could be made up of users, computers, printers or file shares. Now, the reason why we use groups within Active Directory is frequently for security purposes. Now you can use ad and group policy together to assign specific permissions for objects within Active Directory. The purpose of Active Directory is to handle security authentication across the domain. It's very, very important. If you want to work in the IT field, you have to understand it. Now, one of the ways that ad does this is by only allowing authorized users to log on to the network. Active Directory also provides centralized security management of your network resources by storing things like the usernames and passwords in one location instead of the administrator. Need to store this information on each individual computer. Now, the most common task that you need to know how to do with an Active Directory and everybody does this. Everyone who's worked with Active Directory knows how to do this is reset user passwords and create or delete user accounts. For example, every time a new employee is hired at your company, they will need log in credentials. Now you will need to create their account and help them log in for the first time. And quite often as we all know, people are going to forget their passwords and they're going to ask you to reset them. Now, if you do not have Active Directory, you would need to create a local user account on each computer in your company. Also, every time you had to reset a password for that user, you would need to do it on each computer that they had an account on. So here we're creating John and his passwords. And then if we have to reset the passwords, we have to go back to each computer and reset the password on all of them. You can see they're changing the red representing the new password for that user account. Now, this example not only applies to user accounts, but other objects that can be stored within Active Directory like computers, printers, file shares and security groups. So in this example we have the username John and his password stored on our domain controller, which has active directory, and all of those computers go to Active Directory and query the server for his password. So if you need to change it, you just change it in one spot on the domain controller and we are good to go. Okay, so no more resetting his password ten times over or five times over. Imagine if you had 5000 computers on your network and you had to reset a password for John. Well, you'd have to reset it 5000 times. And that's that's crazy. A big waste of money. So we don't want to do that. All right. So now that you understand what Active Directory is, let's learn about the interface. Now, I am logged in to my domain controller here called IP DC zero one IP standing for instructor Paul and DC standing for domain controller and zero one standing for the first domain controller in my domain. Now my domain is called instructor Qualcomm because that's my website and I just thought it would fit. So you need to be logged in to your domain if you'd like to follow along. Or you can just watch and see what I do. All right. So the way we start Active Directory or Add for short is to click in server manager. We can select tools and we can choose Active Directory users and computers from this list here. Now, if you don't know how to open server manager, that's easy. Click the start button and it'll appear in the top left corner. Server Manager. Okay. So now the Active Directory users and computers console will appear. Now this window looks like those other ones that you may have seen before if you're familiar with DNS or Dhcp. On the left we have our navigation pane and on the right we have the contents of our current location. Now on the menu we have file action, view and help. Now, within the file menu, you can either choose the options or you can exit Active Directory within options. You can delete any changes that you've made to the view of Active Directory users and computers. And of course, exit acts just like you'd expect it to. The action menu is the exact same menu that you'll get when you right click on an object within either the navigation or the contents pane. The View column allows you to quickly add or remove columns so that you can show or hide additional information as necessary. Most importantly, you can enable advanced features, and this viewing mode shows a lot of hidden and useful content that you would otherwise not be able to find. The filter options allows you to show or hide certain object types within the contents pane. Now this can be useful when you have several different object types like we can see here, like if multiple users, multiple groups, multiple contacts and say you're just looking for a particular computer, we can say show only the following type and we can check computer and all the other type will be hidden. Okay, so we're not going to do that. We're going to click Cancel. The customize option allows you to further customize your view within the Active Directory users and computers console by showing or hiding different components. For most administrators, the default configuration will work just fine. All right, so I'm going to click okay and under help. This menu allows you to quickly access the Help topics and the Tech Center website. You can also view the version of Microsoft Management Console or MSI and Active Directory users and computers. Most of the time you're not going to be using this help little tab here. If you're running into an issue, just go ahead and do yourself a favor and Google the issue. You'll probably get results a lot faster. Now, below that, you will see several action buttons. First, you have navigational arrows and this will allow you to quickly navigate forwards and backwards through the Active Directory structure. Next, you have several buttons that will change depending on what type of object you've selected. Now, a general rule of thumb, if you hover over the buttons, you will get a tooltip telling you what each button does and what it is used for, not the left side of the console. We can see our navigation pane at the top. You're going to see saved queries and the name of your domain, which in my case is instructor Dot. Yours will likely be different. Now save queries is commonly ignored by many administrators. It allows you to quickly locate things like expired or locked out user accounts or user accounts who have not logged in within the last 30 days and more. As the name implies, you can create these searches and save them for later use. This can make redundant tasks much easier now. Instructor Qualcomm refers to the domain that Active Directory is servicing. You can right click on the domain and complete several actions. First, we can delegate control of the domain. By default. There's a set of users and a set of groups that have control over this domain, and you can extend that by delegating control of the domain. You can also delegate control of particular OUS, but we may get into that more later. Now, the fine button allows you to locate objects within this domain. You can view this as a search button. Think of it like the Google of Active Directory. If you need to find something, you can right click and choose find and you will be able to type in the name of what you're looking for. And you can see that here. So we could choose what kind of object that we're looking for and we can choose where we want to search. And then we just type in the name that we're looking for and click find now. Okay. You may change domains by selecting the change domain option. Now, you would do this if you had a sub domain to instruct napolcom like lessons or courses. Instructor popcom and the like. Okay, but we can see here if I click browse, I only have instructor Paul. If I had a sub domain or a trusted domain, you would see them listed here. We can also change domain controllers. But since I only have one domain controller in my domain. Again, you're only seeing the one IP 01. instructor.com. This is the only domain controller that I have up and running, so it's the only one we're going to see here. The raised domain functional level option is used to enable Active Directory features when you have multiple domain controllers on a network. Now some features are only available when all of your servers are updated to the latest version available. For example, if you have a 2012 domain controller and a 2016 domain controller both servicing the same network, your domain's functional level will be that of the 2012 domain controller, meaning that the server cannot use the new features of 2016, but only the features that are included in 2012. If you were to upgrade the 2012 server to the 2016, you could then raise your domain's functional level to enable the new features. If I click this option, I can see that my domain functional level is Windows Server 2016. Since I do not have any older domain controllers on the network. The operation Master's option allows you to choose which servers operate master roles like the schema master, domain name naming, master relative identified or ID master Primary domain controller emulator, also known as PDC Emulator and the Infrastructure Master. If you have multiple domain controllers on your network. You can choose what server has, what roles. Now, this is something you would need to do when you remove a domain controller from the network. Now Active Directory Domain Services is a multi-master enabled database, which means several domain controllers can make changes to the database. Allowing multiple domain controllers to write changes to the database can sometimes cause conflicting updates to occur. Now, this is where Operation Master steps in to resolve this issue by only allowing certain domain controllers to make changes to certain parts of Active Directory domain services. Now, since we don't have any additional domain controllers, we can click the change button, but there's no other domain controllers on the network to transfer the roles to. So we're going to click okay and we'll click close. Now, if we right click, we have the new option here and we can do all kinds of things like create computers, users, groups, all that. We're going to get into that more. So under here we have all tasks. Again, it's kind of a repeat of what you see above. You can do the resultant set of policy which allows you to see what kind of group policy objects are being applied to this domain or whatever object you're clicking on. We're going to get into more of that later. Again, if we choose properties, we can see the domain name and we can see the description and we can see who it is managed by. Now, this information is very important. It's just information that if you want to provide it to other people within your domain, other administrators, you can do that right here. Okay. So now I'm going to close out of this window and that is all we're going to cover in this lecture. So now you have a basic understanding of what Active Directory is and what it is used for. Now, great job getting through this lecture. I'm looking forward to seeing you in the next one.