U-M Windows Forest
How-To Documents
Get Help

Active Directory Users, Groups and OUs

August 2008

Table of Contents  

Organizational Units (OUs)

OUs are Active Directory (AD) containers that hold other AD objects. They have three main functions:

Unlike in some other systems, Active Directory OUs are not security principles, so you cannot assign a common set of permissions to all the users in an OU. You can only assign permissions to users and groups.


ZOOM [+]

People OU

Users in the MCommunity Directory are provisioned to the People OU, so you won't need to create any uniqname user accounts. There are several ways to manage these users (these will be explained below).

Note: Users' AD passwords may not, by default, be the same as their UMICH passwords. See Resetting Passwords.

Organizations OU

Each unit that joins the Active Directory will have an Organizations OU.

Unit administrators can create additional OUs, computers and server objects, groups, and non-uniqname users in their Organizations OU. All objects except OUs must conform to the naming conventions of dept-whatever.

You are not allowed to create user objects with uniqnames or using the uniqname naming convention of 3-8 alphabetic characters. You must create user objects that follow the above naming convention. For administrative accounts, there is an exception that allows you to add a number to the end of a uniqname to create a user name.

Group Policies can be applied to your Organizations OU or any of the sub OUs.

Accounts OU (Optional)

Each unit that joins Active Directory will have an Accounts OU. Using this OU is optional and many units will choose not to use it in order to simplify their administration.

A more complex and detailed use of these users and their attributes can be accomplished by choosing to fully manage your users. In many cases, this is unnecessary and extra work. See the U-M Windows Central Accounts Service page for an explanation.

Managing Users

All users with uniqnames are already provisioned in the People OU of Active Directory. You can manage many aspects of these users without needing to manage the users in your Accounts OU.

Resetting Passwords

Users can reset their Active Directory password to match their UMICH password. They do this by changing their UMICH password at the Password Change web form.

Users should always log on to Windows resources using the following format: umroot\uniqname

Managing Groups

It is best to assign permissions to groups rather than individuals. As an OU admin, you can create Security Groups, add users and then assign permissions to resources.

To create groups:

  1. Using Active Directory Users and Computers, navigate to your OU and then to the Groups OU.

  2. Right-click and select New Group. The default Global Security Group is fine for most purposes.

  3. Enter the group name, which must follow one of the two naming conventions:

    • unit-anything
      (using the AD prefix assigned to your unit when you requested your OU)
      example: hsg-assistants

    • UnitAnyThing
      example: Housing Assistants
      This type of group is better suited if you plan on using Exchange and want to use the group as a distribution list and have it show up in the Global Address List.

  4. Don't mail enable the group unless you are using the ITS Exchange service. See the Exchange website for more info.

  5. Open the newly created group and add members.

  6. Assign permissions to group. This step depends on the specific permissions you want to give the group.