Active Directory users, groups and OUs

Start DC01 and sign in as SAATLAB\Administrator. Use PowerShell as administrator; the ActiveDirectory module loads by itself the first time you use one of its commands.

1Build the OU structure

Paste this whole block:

$base = 'DC=saatlab,DC=internal'
New-ADOrganizationalUnit -Name SAATLAB -Path $base
'Staff','Admin Accounts','Service Accounts','Groups','Servers','Workstations' |
    ForEach-Object { New-ADOrganizationalUnit -Name $_ -Path "OU=SAATLAB,$base" }
'Finance','IT','Sales' |
    ForEach-Object { New-ADOrganizationalUnit -Name $_ -Path "OU=Staff,OU=SAATLAB,$base" }
Get-ADOrganizationalUnit -Filter * -SearchBase "OU=SAATLAB,$base" | Sort-Object DistinguishedName | Select-Object -ExpandProperty DistinguishedName

You should see this:

OU=Admin Accounts,OU=SAATLAB,DC=saatlab,DC=internal
OU=Finance,OU=Staff,OU=SAATLAB,DC=saatlab,DC=internal
OU=Groups,OU=SAATLAB,DC=saatlab,DC=internal
OU=IT,OU=Staff,OU=SAATLAB,DC=saatlab,DC=internal
OU=SAATLAB,DC=saatlab,DC=internal
OU=Sales,OU=Staff,OU=SAATLAB,DC=saatlab,DC=internal
OU=Servers,OU=SAATLAB,DC=saatlab,DC=internal
OU=Service Accounts,OU=SAATLAB,DC=saatlab,DC=internal
OU=Staff,OU=SAATLAB,DC=saatlab,DC=internal
OU=Workstations,OU=SAATLAB,DC=saatlab,DC=internal

Each line is a distinguished name (DN): the object’s full path in AD, read right to left. OU=Finance,OU=Staff,OU=SAATLAB,DC=saatlab,DC=internal means “Finance, inside Staff, inside SAATLAB, in saatlab.internal”. You’ll use DNs constantly with -Path and -SearchBase.

✅ Checkpoint: Ten OUs are listed: SAATLAB itself and the nine inside it. Open Active Directory Users and Computers (dsa.msc) to see them as folders too.

2Create one user by hand

Run this. It asks for an initial password; use one that meets complexity rules:

$pw = Read-Host -AsSecureString 'Initial password'
New-ADUser -Name 'Priya Sharma' -GivenName Priya -Surname Sharma -SamAccountName priya.sharma `
    -UserPrincipalName priya.sharma@saatlab.internal -Department Finance -Title Accountant `
    -Path 'OU=Finance,OU=Staff,OU=SAATLAB,DC=saatlab,DC=internal' `
    -AccountPassword $pw -ChangePasswordAtLogon $true -Enabled $true
Get-ADUser priya.sharma | Select-Object Name, UserPrincipalName, Enabled

You should see this:

Name         UserPrincipalName             Enabled
----         -----------------             -------
Priya Sharma priya.sharma@saatlab.internal True

The backtick (`) at the end of a line continues the command on the next line. -ChangePasswordAtLogon forces Priya to choose her own password at first sign-in, so you never know it.

✅ Checkpoint: priya.sharma exists, is enabled, and lives in the Finance OU.

3Create five more users from a CSV file

Create the CSV:

@'
FirstName,LastName,Department,Title
Arjun,Rao,Finance,Finance Manager
Meena,Iyer,Finance,Payroll Officer
Rahul,Verma,IT,System Administrator
Sneha,Reddy,IT,Helpdesk Engineer
Kiran,Das,Sales,Sales Executive
'@ | Set-Content C:\Lab\users.csv

Import it (same $pw from step 2):

Import-Csv C:\Lab\users.csv | ForEach-Object {
    $sam = ('{0}.{1}' -f $_.FirstName, $_.LastName).ToLower()
    New-ADUser -Name "$($_.FirstName) $($_.LastName)" -GivenName $_.FirstName -Surname $_.LastName `
        -SamAccountName $sam -UserPrincipalName "$sam@saatlab.internal" `
        -Department $_.Department -Title $_.Title `
        -Path "OU=$($_.Department),OU=Staff,OU=SAATLAB,DC=saatlab,DC=internal" `
        -AccountPassword $pw -ChangePasswordAtLogon $true -Enabled $true
    "Created $sam"
}

You should see this:

Created arjun.rao
Created meena.iyer
Created rahul.verma
Created sneha.reddy
Created kiran.das

Check all staff:

Get-ADUser -Filter * -SearchBase 'OU=Staff,OU=SAATLAB,DC=saatlab,DC=internal' -Properties Department |
    Sort-Object Department, Name | Format-Table Name, SamAccountName, Department, Enabled -AutoSize

You should see this:

Name         SamAccountName Department Enabled
----         -------------- ---------- -------
Arjun Rao    arjun.rao      Finance    True
Meena Iyer   meena.iyer     Finance    True
Priya Sharma priya.sharma   Finance    True
Rahul Verma  rahul.verma    IT         True
Sneha Reddy  sneha.reddy    IT         True
Kiran Das    kiran.das      Sales      True

Notice -Properties Department: Get-ADUser only returns a handful of properties unless you ask, exactly the trap from Lesson 7’s work story. This CSV pattern is how admins onboard a whole team in one go.

✅ Checkpoint: Six users appear, each in the OU for their department.

4Create groups the AGDLP way

Paste this whole block:

$groups = 'OU=Groups,OU=SAATLAB,DC=saatlab,DC=internal'
New-ADGroup -Name GG_Finance -GroupScope Global -GroupCategory Security -Path $groups
New-ADGroup -Name DL_FinanceShare_Modify -GroupScope DomainLocal -GroupCategory Security -Path $groups
Add-ADGroupMember -Identity GG_Finance -Members priya.sharma, arjun.rao, meena.iyer
Add-ADGroupMember -Identity DL_FinanceShare_Modify -Members GG_Finance
Get-ADGroupMember -Identity DL_FinanceShare_Modify -Recursive | Sort-Object Name | Select-Object Name, SamAccountName

You should see this:

Name         SamAccountName
----         --------------
Arjun Rao    arjun.rao
Meena Iyer   meena.iyer
Priya Sharma priya.sharma

-Recursive looks through nested groups, so you see the people who really get access through DL_FinanceShare_Modify. In Lesson 16 you’ll give this group Modify permission on the Finance share.

✅ Checkpoint: DL_FinanceShare_Modify contains GG_Finance, and the recursive list shows the three Finance users.

5Turn on the AD Recycle Bin

Run this:

Enable-ADOptionalFeature -Identity 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target saatlab.internal -Confirm:$false
Get-ADOptionalFeature -Filter "Name -eq 'Recycle Bin Feature'" | Select-Object Name, EnabledScopes

You should see something like this:

Name                EnabledScopes
----                -------------
Recycle Bin Feature {CN=Partitions,CN=Configuration,DC=saatlab,DC=internal, CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=saatlab,DC=internal}

This is a one-way switch for the whole forest. Every production forest should have it on.

✅ Checkpoint: EnabledScopes is no longer empty.

6Delete a user and bring them back

Delete Kiran, then restore:

Remove-ADUser -Identity kiran.das -Confirm:$false
Get-ADObject -Filter "SamAccountName -eq 'kiran.das'" -IncludeDeletedObjects | Restore-ADObject
Get-ADUser kiran.das -Properties Department | Select-Object Name, Department, Enabled, DistinguishedName

You should see this:

Name      Department Enabled DistinguishedName
----      ---------- ------- -----------------
Kiran Das Sales      True    CN=Kiran Das,OU=Sales,OU=Staff,OU=SAATLAB,DC=saatlab,DC=internal

Kiran is back in the same OU with the same department, password and group memberships. Without the Recycle Bin, you’d be restoring from a system state backup instead.

✅ Checkpoint: kiran.das is restored, enabled and back in the Sales OU.

7Delegate password resets to the helpdesk

Open Active Directory Users and Computers (dsa.msc). Create a global group GG_Helpdesk in the Groups OU and add Sneha Reddy.

Then right-click the Staff OU, choose Delegate Control, add GG_Helpdesk, and tick Reset user passwords and force password change at next logon. Finish the wizard.

Sneha can now reset passwords for staff, and only for staff, without being a Domain Admin. That’s the least-privilege idea you’ll use everywhere from Lesson 22 on.

✅ Checkpoint: GG_Helpdesk exists with Sneha in it, and the Staff OU’s Security tab (Advanced Features on) shows the delegated permission.