Lesson 2: Creating User and Computer Accounts

You use objects, user accounts, and computer accounts to represent users and computers so that you can control network access and manage the use of network resources. To add a user or a computer account to an OU, you must have the permission to add new objects to the OU. By default, members of the Administrators group have permission to add objects anywhere in the domain.

User accounts are employed to authenticate the user, as well as to assign permissions to gain access to network resources. You can use the Active Directory Users and Computers administrative tool on any available domain controller to create a new user account. After you create the account, it is replicated to all other domain controllers in the domain.

When you create the user account, you must first select the container in which to create it. You can create user accounts at the domain level, but doing so limits your delegation options and increases the complexity of managing your network. To create a domain user account, you would do the following:

1. Open the Active Directory Users and Computers administrative tool.
2. Right-click the OU in which you want to create the user account, point to New, and then click User. Figure 5.1 shows the New Object - User dialog box. The fields in Figure 5.1 are explained in Table 5.1.

Table 5.1 describes the domain user account options that you can configure.

Table 5.1 Configurable Domain User Account Options

Option	Description
First Name	The user's first name. This field or the Last Name field is required.
Initials	The user's initials. This field or the First Name or the Last Name field is required.
Last Name	The user's last name. This field or the First Name or the Initials field is required.
Full Name	The user's complete name. This name must be unique within the OU or container where you create the user account. Active Directory directory services display this name in the OU or container where the user account is located.
User Logon	The user's unique logon name based on your naming conventions. Name This is required and must be unique within the enterprise.
User Logon Name (Pre-Windows 2000)	The user's unique logon name that is used to log on from computers running earlier versions of Windows, such as Windows NT 4.0 or 3.51. This is required and must be unique within the domain.

Figure 5.1 The New Object - User dialog box

After you enter the information about the user, you can set the password requirements for the user account by clicking the Next button to display the password options shown in Figure 5.2.

Figure 5.2 The New Object - User dialog box's password settings

Table 5.2 describes the password options that you can configure.

Table 5.2 Configurable Password Options

Option	Description
Password	Enter the password that is used to authenticate the user. For greater security, you should always assign a password.
Confirm Password	Confirm the password by typing it a second time to make sure that you typed it correctly.
User Must Change Password At Next Logon	Select this check box if you want the user to change his or her password the first time that he or she logs on. This ensures that the user is the only person who knows the password.
User Cannot Change Password	Select this check box if you have more than one person using the same domain user account (such as Guest), or to maintain control over user account passwords. This allows only administrators to control passwords.
Password Never Expires	Select this check box if you want the password to never change.
Account Disabled	Select this check box to prevent the use of this account—for example, on an account for a new employee who has not yet started.

Each user account that you create is associated with a set of default attributes. You can use the attributes that you define for a domain user account to search for users in Active Directory directory services. For this reason, you should provide detailed attribute definitions for each domain user account that you create.

After you create a domain user account, you can configure personal and account attributes, logon options, and dial-in settings.

The tabs in the Properties dialog box for a user contain information about each user account. When the Advanced Features for the Active Directory Users and Computers snap-in are active, the tabs are General, Address, Account, Profile, Telephones, Organization, Published Certificates, Member Of, Dial-In, Object, Security, Environment, Sessions, Remote Control, and Terminal Services Profile.

Right-click the user account, and then click Properties to open the Properties dialog box for a user account.

In Active Directory directory services, you can easily move objects between OUs within your domain structure. Active Directory directory services simplify your job as an administrator by allowing you to move objects whenever organizational or administrative functions change. For example, when an employee moves from one department to another, it is a lot easier to move the user account than to have to delete the user account, recreate a new user account, and make sure that all rights and permissions are correctly reestablished.

When you move objects between OUs

• Permissions that are assigned directly to objects remain the same.
• The objects inherit permissions from the new OU. Any permissions inherited from the previous OU will no longer affect the objects.
• You can move multiple objects at the same time.

Similar to moving users, you use the Active Directory Users and Computers tool to move an object. In the Active Directory Users And Computers window, right-click the object you want to move, and then click Move. In the Move dialog box, click on the container that you want the object moved to, and then click OK.

In Active Directory directory services, you can also easily locate resources throughout the network, regardless of the physical location of the object. Use the Active Directory Users and Computers tool to locate groups in Active Directory directory services. Click Find on the Action menu in the Active Directory Users And Computers window to open the Find dialog box. The Find dialog box, shown in Figure 5.3, allows you to search Active Directory directory services to locate different types of objects. The search criteria that are available vary (as does the dialog box's title bar) depending on the type of object you selected in the Find list.

Figure 5.3 The Find dialog box

After a search successfully completes, the search results are displayed. You can then perform administrative functions on the objects that are listed. The functions that are available depend on the type of object you located. For example, if you searched for computer accounts, you can delete the computer account, disable or reset the computer account, move the computer account to another OU, or adjust the computer account's attributes.

In this practice, you will create user accounts based on information given in Exercise 1. After creating the user accounts you will modify the user account properties, specifically the logon hours properties, for one of the user accounts. You will test the user account you modified to verify that the logon restrictions you set up are working, and finally, you will move two of the user accounts from the OU in which they were created to another OU.

In this exercise, you will create four user accounts.

1. In the console tree, right-click Production, point to New, and then click User.

Notice that the New Object - User dialog box shows that the new user account is being created in the location domain.com/Production.

2. Create the user account by typing User in the First Name box, One in the Last Name box, and User1 in the User Logon Name box.
3. If you are on a network where there are multiple domains, in the box to the right of the User Logon Name box, select @domain.com.

4. Click Next to continue.
5. In the Password and Confirm Password boxes, use the information in the following table to determine the password to type or whether you should leave these boxes blank (you are not assigning a password). Use the information in the table to determine how to set the password options as well.

First name	Last name	User logon name	Password	Change password
User	One	User1	Blank	Must
User	Two	User2	Blank	Must
User	Three	User3	User3	Must
User	Four	User4	User4	Cannot

6. After you have assigned the appropriate password options, click Next.
7. Verify that the user account options are correct, and then click Finish.

Notice that the user account that you just created now appears in the details pane of the Active Directory Users And Computers window.

8. Repeat steps 1-7 to create User Two, User Three, and User Four in the Production OU. Add all four of these new user accounts to the Print Operators group.

In this exercise, you will configure the Logon Hours properties for one of the user accounts that you created in Exercise 1.

1. In the Production OU, right-click User2, and then click Properties.
2. Click the Account tab, and then click Logon Hours.

By default, when can a user log on?

Answer

3. Restrict User2's logon hours, so that User2 can only log on from 6:00 PM until 6:00 AM.

4. Click OK to close the Logon Hours For User Two dialog box.
5. Click OK to close the User Two Properties dialog box, and then close the Active Directory Users And Computers window.

In this exercise, you will log on using User One, for which you will need to change the password, and then you will log on using User Two, for which you modified the logon hours in Exercise 2, to test the effects of the account settings.

1. Log off the Administrator account by clicking Start, clicking Shut Down, and selecting Log Off Administrator in the drop-down list. Then click OK.
2. When the Welcome To Windows box appears, press CTRL+ALT+DELETE.
3. Select the contents in the User Name box, and attempt to log on as User1 with no password.

Windows 2000 displays a Logon Message message box, indicating that you must change your password.

4. Click OK.

The Change Password dialog box appears.

5. In the Change Password dialog box, in the New Password and Confirm New Password boxes, type User1 and then click OK.

Windows 2000 displays the Change Password message box indicating that your password was changed.

6. Click OK to close the Change Password message box.

Were you able to successfully log on as User1? Why or why not?

7. Log off the User One account, and repeat steps 2 - 6 for User Two; use User2 as the new password.

Were you able to successfully log on as User Two? Why or why not?

Answer

User One and User Three have been transferred from Production to Administration. In this exercise, you will move the user objects for User One and User Three to reflect the transfer.

1. Log on as Administrator, and open Active Directory Users And Computers from the Start menu.
2. In the Production OU, select both User One and User Three, right-click, and then click Move.
3. In the Move dialog box, expand your domain, click Administration, and then click OK.

Notice that the user accounts that you moved no longer appear in the Production OU.

4. To verify that the user accounts were moved to the correct location, in the console tree, click Administration.

Notice that the user objects for User One and User Three are now located in the Administration OU.

5. Close the Active Directory Users And Computers window.
6. Log off.

Computer accounts are similar to user accounts in that they can be used to authenticate and audit the computer, as well as being used to assign permissions to gain access to network resources.

Since all domain controllers in a Windows 2000 domain are peers, you can use the Active Directory Users and Computers tool on any available domain controller to create a new computer account. After you create the account, Active Directory directory services replicate it to all other domain controllers in the domain.

When you create the computer account, select the container in which to create it. You can create computer accounts at the domain level, but doing so limits your delegation options and increases the complexity of managing your network. To create a computer account, you also use the Active Directory Users and Computers tool. Right-click on the container in which you want to create the computer account, point to New, and then click Computer. Type in the name of the computer.

For added security, you might want to change the selection in the User Or Group box. You can enter any user or group to join a computer to a domain. During the process of joining the computer to the domain, a dialog box appears that prompts you for an account that has the right to join the computer to the domain. The person who joins the computer to the domain must enter a user name and password that matches the value you designate in this box. As with user accounts, each computer account that you create is associated with a set of default attributes. You can use the attributes that you define for a computer account to search for a computer in the Active Directory directory services. For this reason, you should provide detailed attribute definitions for each computer account that you create.

You use objects, user accounts, and computer accounts to represent users and computers so that you can control network access and manage the use of network resources. To add a user or a computer account to an OU, you must have the permission to add new objects to the OU. By default, members of the Administrators group have permission to add objects anywhere in the domain. User accounts are employed to authenticate the user, as well as to assign permissions to gain access to network resources. You can use the Active Directory Users and Computers tool on any available domain controller to create a new user account. After you create the account, it is replicated to all other domain controllers in the domain.