When administering Windows Server 2008, one of the tools you’ll use most often is Active Directory Users And Computers. Here’s a quick guided tour of the tool and some of the changes that have occurred since Windows Server 2003.

—————————————————————–

Of the administrative tools used by Windows administrators, Active Directory Users and Computers is very likely to be near the top of the management arsenal. Present in Windows and Active Directory since the birth of Windows 2000, which jettisoned the old NT-style directory, Active Directory Users and Computers has made an unscathed transition to Windows Server 2008. Let’s look at the Active Directory Users and Computers tool in Windows Server 2008 and outline what it does, how it works, and how to perform common tasks in the tool.

What it does

Active Directory Users and Computers serves as the primary entry point for management of user, group, and computer objects in Active Directory. Active Directory objects contain the information necessary for the item including descriptions, file system rights, security identifiers, application rights, and directory information.

Active Directory Users and Computers allows you to create, modify, and delete objects in the directory. Objects in Active Directory do not–and usually are not–all thrown into one huge group. Instead, objects are nested inside groups called Organizational Units which, in turn, can house additional organizational units. As such, the directory really becomes a tree of sorts, with the organizational units as the limbs and the individual objects as leaves.

Often, organizations create Active Directory structures that mirror their organization structures. For example, an organization might have separate organization units for Sales and Engineering, with different policies for each and with structures that make the most sense for the department and for the security needs for each group. This allows you to design an Active Directory tree that mirrors an organization and to delegate authority to users or to other IT people in appropriate areas. For more information about how to design an Active Directory tree, see the article, Design your Active Directory tree with security in mind.

Some of the common tasks accomplished with Active Directory Users and Computers include:

• Adding new users to Active Directory
• Changing passwords
• Granting rights to file servers
• Allowing remote access to the network
• Setting login and logout scripts
• Controlling when users can use the network
• Creating security groups - with either static or dynamic membership

Many applications, including Exchange Server, Terminal Services and System Center add capability to Active Directory. Sometimes, these applications add extensions to Active Directory Users and Computers to allow management of objects related to the new product. For example, if you add Terminal Services to your network, you can use Active Directory Users and Computers to control how long a user can stay connected to your Terminal Server.

With Exchange 2003 and below, Microsoft provided extensions for Active Directory Users and Computers that allowed some Exchange object management. With Exchange 2007, Microsoft has moved away from this management paradigm, but many products still work in this fashion.

How things are different in Windows Server 2008

You’ll experience the greatest culture shock if you’re moving from Windows NT directly to Windows Server 2008. Microsoft has made many changes to its administration utilities over the years. Active Directory Users and Computers does the job of two different Windows NT utilities. For user and group administration, Active Directory Users and Computers replaces User Manager For Domains. When it comes to controlling servers and member workstations, Active Directory Users and Computers replaces Server Manager.

The change isn’t so great when you move from Windows 2000 Server or Windows Server 2003 to Windows Server 2008. Active Directory Users and Computers does the same thing in all versions, but has undergone some enhancement over time. In addition, you’ll find a few new objects and properties available in Windows Server 2008 that weren’t available in earlier versions of Windows Server.

Most notably, Microsoft has added an Attribute Editor tab to every object that allows administrators an easy way to quickly change the value of any Active Directory object’s attributes. This is long overdue!

Finding your way around

There are a couple of ways to use Active Directory Users and Computers in Windows Server 2008. Regardless of the method you use to start the tool, you should log in to the server as an administrative user.

First, you can use the new Server Manager tool and Browse to Roles | Active Directory Domain Services | Active Directory Users and Computer. Figure A below shows you this tool in the context of Server Manager.

Figure A

Active Directory Users and Computers through Server Manager

The second method is to start Active Directory Users and Computers directly, which is how the tool was used in previous versions of Windows. To do so, click Start | All Programs | Administrative Tools | Active Directory Users and Computers. When you do, you’ll see the screen shown in Figure B. This article uses this method to manage Active Directory Users and Computers.

Figure B

Active Directory Users and Computers

If you’ve ever worked with Microsoft Management Console (MMC) before, the layout should be familiar. Across the top notice the set of pull-down menus. Beneath the menu bar is a button bar that provides quick access to frequently used procedures. Finally, you’ll see two panes. The left pane provides a tree view of your Active Directory structure. The right pane shows the objects for containers highlighted in the left pane.

Menu choices

Pull-down menus you can access include:

• File: In the File menu lies the Options menu, which allows you to clean up console information. You can also quit Active Directory Users and Computers by clicking Exit.
• Action: This menu allows you to perform different actions depending on which container object you’ve selected. For example, if you select the Users container, you might see the Delegate Control menu option and options that allow you to create new users and groups, but if you select a particular User object, you’ll see actions about what you can do to a user, such as resetting passwords and disabling accounts. When the domain object is selected, this menu contains options to raise the domain functional level and to modify the servers that are considered operations masters, such as the PDC emulator and the schema master.
• View: This menu choice allows you to customize the appearance of Active Directory Users and Computers. You can change how objects appear, how many columns Active Directory Users and Computers displays, and filter out objects you don’t want to appear.
• Window: This menu choice allows you to display multiple MMC windows and control how those windows appear on your server.
• Help: As would be expected, this choice allows you to access Active Directory Users and Computers Help files.

The button bar

As in most MMCs, the button bar in Active Directory Users and Computers closely resembles a Web browser. Like browser buttons, these buttons are relatively self explanatory. Left to right, these buttons are:

• Back to previous selection
• Forward to next selection (if you previously used Back)
• Move up one level in the Active Directory hierarchy
• Show/Hide console tree
• Paste
• Get properties for current object
• Refresh
• Export List
• Help
• Show/Hide action pane
• Create a new user object in the current container
• Create a new group in the current container
• Create a new organizational unit in the current container
• Create a filter to see only specific types of objects
• Find objects
• Add selected objects to a group

You’ll notice that as you go from container to container in the left pane, buttons sometimes will become unavailable. For example, if you go to the Computers container, you can’t use the Create New Organizational Unit button.

Take special note of the Show/Hide action pane button. In most of their new products, Microsoft has moved to a screen layout that includes what they call an action pane. The action pane provides quick access to all of the functions available with regard to a particular object.

In Figure C below, note that the user object named Administrator is selected. In the Action pane on the right, there are two More Actions options. One is below the Users heading and provides shortcut access to the same options that would be available if you right-clicked Users container. Likewise, underneath the Administrator heading, the More Actions button provides quick access to the options that would be available if you were to right-click the Administrator user.

Figure C

The Action Pane provides quick access to the functions available to an object.

Before you proceed through the rest of this article, make sure you are looking at the Advanced view, which gives you a look at many more objects and containers. Of course, the more access you have, the easier it is to make a mistake, so be careful, too. Figure C above was taken when the Advanced view was active. To enable Advanced mode, choose View | Advanced Features.

The Console Tree

The left pane is called the Console Tree. This tree displays all of the container objects for Active Directory. Navigate through the Console Tree by clicking the plus signs to expand the various options/containers. As you expand the tree, you’ll start to get to Active Directory objects. The default objects you’ll find in Windows Server 2008’s Console Tree are: