6.6Managing users

User management in the browser requires the directory-management licence entitlement and the relevant ad:users:* permission. Managed user objects are those of class user or inetOrgPerson; computers and managed service accounts, which also descend from user in Active Directory, are handled separately.

To create a user

1. 1In the tree, right-click the organizational unit or container that should hold the user and choose New object here….
2. 2In the Create an object dialog, check the container shown under In this container.
3. 3Under What to create, select User. Only the kinds of object you are allowed to create are offered.
4. 4Fill in the fields described below.
5. 5Select Create.

The user is created, the container is re-read, and the new user is selected in the tree.

Note: A user logon name may not contain any of these characters: " / \ [ ] : ; | = , + * ? < > @

Important: If you leave Password empty, the account is created disabled: Active Directory will not enable an account without a password that meets the domain policy. Reset the password and enable the account later from the Actions menu.

The user Actions menu

Select a user and open Actions in the inspector header. The menu holds:

To enable or disable a user

1. 1Select the user and open Actions.
2. 2Choose Enable account or Disable account.
3. 3Confirm with Enable or Disable.

Disabling stops the person signing in; the account stays in the directory and can be enabled again.

To unlock a user

1. 1Select the user and open Actions.
2. 2Choose Unlock account.

If the account turns out not to be locked, nothing changes and you are told that the sign-in problem lies elsewhere.

Tip: Help-desk staff can use the menu to check lockout status: if Unlock account is greyed out, the account is not locked out.

To require a new password at next sign-in

1. 1Select the user, open Actions and choose Require a new password at next sign-in.
2. 2Confirm with Require.

The person is asked to set a new password at their next sign-in, and their current password stops working then. The entry is not shown while a change is already required.

To reset a user's password

1. 1Select the user, open Actions and choose Reset password….
2. 2Enter the New password and repeat it in Confirm password. The password must be at least 8 characters; the dialog shows "Passwords match" when the two agree.
3. 3Optionally select Require a new password at the next sign-in.
4. 4Select Reset password.

This is an administrative reset: the current password is not needed. The domain's own complexity and history rules, and any fine-grained password policy, are enforced by the domain controller and may demand more than 8 characters.

If the password is set but requiring a change at next sign-in fails, you see a warning saying so, with the reason; the new password remains in force.

To set or clear an account expiry date

1. 1Select the user, open Actions and choose Set account expiry… (or Change account expiry… if one is set).
2. 2Either select Never expires, or choose the Last day the account works. The dialog confirms the exact moment: the account stops working after 23:59:59 on that day, in your local time.
3. 3Select Save.

To rename a user

1. 1Select the user, open Actions and choose Rename….
2. 2Enter the New name and select Rename.

Important: Renaming changes the name in the tree only. The account keeps signing in with its current logon name. If the logon name should change too, edit sAMAccountName or userPrincipalName with the attribute editor (see 6.10).

To move a user

1. 1Select the user, open Actions and choose Move….
2. 2In Destination container, enter the distinguished name of the target organizational unit or container, for example OU=Staff,DC=example,DC=com.
3. 3Select Move.

The tree re-reads both the old and the new container and selects the user in its new place.

Tip: To get a container's distinguished name, right-click it in the tree and choose Copy DN, then paste it into the dialog.

Moving changes the account's distinguished name, so scripts, group policy links and saved filters that refer to it by distinguished name will need updating.

To delete a user

1. 1Select the user, open Actions and choose Delete account… — or right-click the user in the tree and choose Delete….
2. 2Read the confirmation, which names the account and its distinguished name, and select Delete account.

The account is removed from the directory and from every group. It cannot be undone from the browser. If the Active Directory Recycle Bin is enabled, a deleted object can be restored from Recycle Bin; see Chapter 7, Deleted objects (Recycle Bin).

A user's group memberships

The Groups tab lists the groups the selected user belongs to. Choose:

• Direct — groups the account is listed in directly.
• Including nested — all groups reached through nesting, resolved by the domain controller.

The primary group (normally Domain Users) is not listed, because Active Directory records it separately from group membership.

To add the user to a group (needs ad:groups:update and the management licence):

1. 1Select Add to group….
2. 2Type part of the group's name in Search groups by name.
3. 3Select a group in the results. Groups the user already belongs to are marked Member.

To remove the user from a group, switch to Direct and select Remove next to the group. Removal is only offered on the direct list, because a nested membership comes from another group and cannot be removed here without guessing which link to cut.

Every membership change is a change to the group, so it needs the group update permission, not the user one.