Help Desk Introduction into using the Active Directory
An overview of how to use the Active Directory for new Help Desk Students
Help Desk Guide: Active Directory Overview
SA's active directory subtree is broken down into 5 sections:
Of these 5 sections the only two that you will need to use are “Groups” and “Workstations.
Managing Groups for User Access
There are three main Areas within the group’s structure that you will need to use most often.
All three are in Groups\Security
The "Software Deployment - Unlimited License" OU is for deploying software to computers on the AD. The only difference is that software is deployed to a computer name so when you add a computer you must select "Object Types" and make sure to check the "Computers" box.
While most SharePoint user administration is done within departments, we may need to use AD to add or remove users from SharePoints. There are found in SA\Groups\Security\SharePoint\*, and are broken down within divisions. For divisions that should be doing this themselves, please give them this reference link and offer to walk them through the process. This link is also a good refresher for HD staff.
The User Roles sections is all groups within groups. This is useful if you have a large number of users that have the same job position and require access to a large number of the same resources. An example of this is the SA-UR-Housing-RA group. This group will give access to the appropriate shares and software to all users within that group.
Before adding someone to a user role, confirm that the owner in the description either: a) made the request or b) approved the request. These roles have a lot of security permissions tied into them-- adding someone to the incorrect user role can give them privileges far above what they should have. Once you know that they should be in the user role, go to members and add them.
Finally, the Workstations folder contains all of the computer objects that we control. Moving the computer object into a different Organizational Unit in this section will cause our management system to apply different policy to that computer, once SCCM notices the change. An example move from the Rental Hardware OU to the Athletics OU looks likes this:
Find the computer to move (either by exploring the file tree or with a search)
In this example, SA-RNTL-4JT0K12. Right click, select move
Navigate to the new OU for the computer within the dialog box that pops up
Click ok! AD reflects this change, and the computer will be found in the Athletics OU. To force SCCM to notice the change, navigate to the athletics collection in SCCM and click "update membership". Once the computer can be found within the correct collection is SCCM, it will behave as if it is part of that collection once it checks in.