This Active Directory tutorial gives you the whole idea first: Active Directory (AD) is the address book and the security guard of a Windows network. Users are the people who sign in. Groups collect users, so you give a permission once instead of fifty times. Organizational units (OUs) are folders that keep everything tidy and carry Group Policy. If you remember one rule, make it this one: OUs are for organizing, groups are for permissions.

Watch the 8-minute video:

Below, we build all three in a real domain, corp.mouhimen.dev, with the clicks and the PowerShell for every step, and then fix the four errors beginners hit most.

What you need

• A domain controller (a Windows Server running Active Directory Domain Services). Ours is called DC01. No domain controller yet? The next post in this series sets one up from zero.
• Active Directory Users and Computers (ADUC). It’s on every domain controller, or on your own PC through RSAT (Settings > System > Optional features > “RSAT: Active Directory Domain Services and Lightweight Directory Services Tools”).
• The PowerShell ActiveDirectory module, which comes with the same RSAT feature.

Step 1: Understand how Active Directory is organized

A domain is one database of everything in your network, and the servers that hold it are domain controllers. Everything inside the domain is an object: a user, a computer, a group. When a laptop joins the domain it gets a computer account too, so AD knows every machine, not only every person.

Every object has an address called a distinguished name (DN). Read it right to left, like a postal address:

CN=Abd almouhimen Shamout,OU=Staff,OU=Mouhimen,DC=corp,DC=mouhimen,DC=dev

That says: in the domain corp.mouhimen.dev, inside the Mouhimen OU, inside the Staff OU, lives the user Abd almouhimen Shamout. You will paste DNs like this into PowerShell all the time.

Naming tip: name a new AD domain as a subdomain of a domain you really own (corp.mouhimen.dev), not .local. Microsoft recommends a registered name, and .local clashes with multicast DNS on Macs and some Linux devices.

Step 2: Create an OU structure

Open ADUC and you’ll see a folder called Users. Here is the first trap: Users is not an OU. It’s a default container, and you cannot link Group Policy to it. The same goes for the default Computers container. So we build our own tree:

1. Right-click the domain > New > Organizational Unit, and name it Mouhimen.
2. Leave “Protect container from accidental deletion” ticked.
3. Inside it, create Staff, Students, Computers, Groups and Service Accounts.

The same thing in PowerShell, one command per OU:

New-ADOrganizationalUnit -Name "Mouhimen" -Path "DC=corp,DC=mouhimen,DC=dev"

"Staff","Students","Computers","Groups","Service Accounts" | ForEach-Object {
    New-ADOrganizationalUnit -Name $_ -Path "OU=Mouhimen,DC=corp,DC=mouhimen,DC=dev"
}

Keep the tree shallow. Two or three levels is plenty. A seven-level tree (region, country, city, building, floor, department…) is hard to manage and hard to search.

Why do OUs matter so much? Two reasons:

• Group Policy. Link a policy, for example “lab PCs lock after 10 minutes”, to the Students OU, and every object inside gets it, while Staff doesn’t.
• Delegation. Right-click Students > Delegate Control, pick your Helpdesk group and tick “Reset user passwords and force password change at next logon”. The help desk can now reset student passwords without being Domain Admins.

Pro move: new computers that join the domain land in the default Computers container, where your GPOs can’t reach them. Send them to your own OU instead:

redircmp "OU=Computers,OU=Mouhimen,DC=corp,DC=mouhimen,DC=dev"

(redirusr does the same for new user accounts.)

Step 3: Create a user account

Right-click the Staff OU > New > User:

Field	Value
First name	Abd almouhimen
Last name	Shamout
User logon name	abd.shamout @corp.mouhimen.dev
Pre-Windows 2000 name	CORP\abd.shamout

The sign-in name (UPN) becomes abd.shamout@corp.mouhimen.dev. On the next page, set a first password and tick “User must change password at next logon”. The help desk should never know a user’s real password.

Then open the account’s Properties and fill in job title, department, office and email. Scripts, address books and Microsoft 365 sync read these fields later.

The same user in PowerShell:

New-ADUser -Name "Abd almouhimen Shamout" `
  -GivenName "Abd almouhimen" -Surname "Shamout" `
  -SamAccountName "abd.shamout" `
  -UserPrincipalName "abd.shamout@corp.mouhimen.dev" `
  -Path "OU=Staff,OU=Mouhimen,DC=corp,DC=mouhimen,DC=dev" `
  -Title "IT Support" -Department "IT" -EmailAddress "abd@mouhimen.dev" `
  -AccountPassword (Read-Host -AsSecureString "First password") `
  -ChangePasswordAtLogon $true -Enabled $true

Two jobs you’ll do every day are reset a password and unlock an account. Both are a right-click on the user (Reset Password…) or on the Account tab (Unlock account). To find someone fast, right-click the domain > Find, or:

Get-ADUser -Filter "Name -like '*Shamout*'" -Properties LockedOut, LastLogonDate |
  Select-Object Name, SamAccountName, LockedOut, LastLogonDate

Step 4: Use security groups for permissions

When you create a group, Windows asks for a type and a scope.

• Type: Security groups grant permissions. Distribution groups are only email lists. Choose Security.
• Scope: in a single domain, Global is the normal choice for groups of people. Domain local groups are for permissions on a resource, like a folder or a printer. Universal groups are for forests with many domains.

Create IT-Staff in the Groups OU and add the user:

New-ADGroup -Name "IT-Staff" -GroupScope Global -GroupCategory Security `
  -Path "OU=Groups,OU=Mouhimen,DC=corp,DC=mouhimen,DC=dev"
Add-ADGroupMember -Identity "IT-Staff" -Members "abd.shamout"

Now the golden rule: give permissions to the group, never to the person. On the \\FS01\IT share, open Security, add CORP\IT-Staff and allow Modify. When someone joins the team, add them to the group and the folder just works. When they leave, remove them and the access is gone. No hunting through folder permissions.

In bigger networks you’ll meet AGDLP: Accounts go into Global groups, global groups go into Domain Local groups (for example DL-FS01-IT-Modify), and the Permission goes on the domain local group. Start simple with one global group per team, but know the name.

A tip from my college: semester groups

I run Active Directory at a college, and every semester hundreds of new students arrive. I don’t create them by hand: I import them from a CSV file into the Students OU, and each student also joins a semester group such as Students-2026-Fall.

When the semester ends, I don’t hunt for accounts one by one. One line disables the whole term:

Get-ADGroupMember "Students-2026-Fall" | Disable-ADAccount

The lesson: name your groups so a script can find them. Pick one pattern (Students-<Year>-<Term>) and keep it. A group called new group final (2) helps nobody. I walk through the full bulk import, including Microsoft 365 licensing, in Bulk-create Active Directory users and license them with Microsoft 365 groups.

Errors and fixes

1. “Windows cannot access \\FS01\IT. You do not have permission…” right after you added the user to the group.
Group membership is read when the user signs in, so their sign-in ticket still has the old list. Ask them to sign out and sign back in, then check:

whoami /groups

If CORP\IT-Staff is in the list, the folder opens.

2. “The referenced account is currently locked out and may not be logged on to.”
Unlock it on the Account tab, or:

Unlock-ADAccount -Identity abd.shamout

If it locks again within minutes, an old password is saved somewhere: a phone’s mail app, a mapped drive, a Wi-Fi profile or Windows Credential Manager.

3. “The password does not meet the password policy requirements.”
The default domain policy needs at least 7 characters, characters from 3 of these 4 types (upper case, lower case, numbers, symbols), and no user name inside. abd123 fails; Blue-Kettle-2026! passes. Make it longer and try again.

4. “You do not have sufficient privileges to delete Mouhimen, or this object is protected from accidental deletion.”
Turn on View > Advanced Features, open the OU’s Properties > Object tab, untick “Protect object from accidental deletion”, then delete it. That box just saved you from a mistake, so leave it on for every other OU.

FAQ

Is Active Directory the same as Microsoft Entra ID (Azure AD)?
No. Active Directory Domain Services runs on your own domain controllers and manages domain-joined PCs, Group Policy and file shares. Microsoft Entra ID is Microsoft’s cloud identity service for Microsoft 365 and SaaS apps. Many organizations sync the two with Entra Connect.

What’s the difference between an OU and a group?
An OU is a folder that organizes objects and is where you link Group Policy and delegate admin rights. A group is a list of members that you use to grant permissions. One object lives in exactly one OU but can belong to many groups.

Can I link Group Policy to the default Users or Computers folder?
No. They’re containers, not OUs. Move your objects into your own OUs, and use redircmp and redirusr so new objects land there automatically.

Global or domain local group: which should I create?
For a team of people in a single domain, create a global group. Use domain local groups when you follow AGDLP and want one group per resource permission.

Do I need PowerShell to manage Active Directory?
Not for daily work: ADUC covers everything in this tutorial. PowerShell pays off as soon as you repeat a task, like creating many users or disabling a semester’s accounts.

Keep learning

• Bulk-create Active Directory users and license them with Microsoft 365 groups
• Stop paying for users who left: clean up inactive Microsoft 365 accounts with PowerShell
• One DNS zone, five subdomains: internal DNS and Nginx done right
• Next in this series: Active Directory Domain Services: Set Up a Domain Controller (Fri 6 Nov 2026)

Sources

• Microsoft Learn, Active Directory Domain Services overview: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview
• Microsoft Learn, Creating an organizational unit design: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/creating-an-organizational-unit-design
• Microsoft Learn, Active Directory security groups: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups
• Microsoft Learn, Redirect the users and computers containers: https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/redirect-users-computers-containers
• Microsoft Learn, Password must meet complexity requirements: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements
• Microsoft Learn, New-ADUser: https://learn.microsoft.com/en-us/powershell/module/activedirectory/new-aduser
• Microsoft Learn, New-ADOrganizationalUnit: https://learn.microsoft.com/en-us/powershell/module/activedirectory/new-adorganizationalunit