Creating user and group accountsUser accounts are used to authenticate, authorize or deny access to resources for, and audit the activity of individual users on your network. A group account is a collection of user accounts that you can use to assign a set of permissions and rights to multiple users simultaneously. A group can also contain contacts, computers, and other groups. You can create user accounts and group accounts in Active Directory to manage domain users. You can also create user accounts and group accounts on a local computer to manage users specific to that computer.
Some of the most common tasks are creating user accounts in Active Directory, creating group accounts in Active Directory, creating user accounts on a local computer, andcreating groups on a local computer. You can also use the command line to create user and group accounts in Managing Active Directory from the command line or on a Managing local groups from the command line. For more information about other tasks for managing Active Directory user accounts and groups, see Manage Users, Groups, and Computers. For information about other tasks for managing user accounts and groups on a local computer, see Local Users and Groups How To....
To create a user account in Active Directory- Open Active Directory Users and Computers.
- In the console tree, right-click the folder in which you want to add a user account.
Where?
- Active Directory Users and Computers/domain node/folder
- Point to New, and then click User.
- In First name, type the user's first name.
- In Initials, type the user's initials.
- In Last name, type the user's last name.
- Modify Full name to add initials or reverse order of first and last names.
- In User logon name, type the user logon name, click the UPN suffix in the drop-down list, and then click Next.
If the user will use a different name to log on to computers running Windows 95, Windows 98, or Windows NT, then you can change the user logon name as it appears inUser logon name (pre-Windows 2000) to the different name.
- In PassWord and Confirm passWord, type the user's passWord, and then select the appropriate passWord options.
Notes
- To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure. For more information, see Default local groups,Default groups, and Using Run as.
- To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers.
- To add a user, you can also click
on the toolbar.
- To add a user, you can also copy any previously created user account.
- A new user account with the same name as a previously deleted user account does not automatically assume the permissions and group memberships of the previously deleted account because the security ID (SID) for each account is unique. To duplicate a deleted user account, all permissions and memberships must be manually recreated.
- When a user account is created with the new user wizard from within the details pane, you can quickly edit the user properties by closing the wizard, clicking the new account, and then pressing ENTER. To open the new user wizard from within the details pane, right-click in the details pane, click New, and then click User.
- For interoperability with other directory services, you can create an InetOrgPerson user object. To create a new inetOrgPerson, in step three, click InetOrgPerson instead of User.
- When creating a new user, the full name attribute is created in the FirstNameLastName format by default. The full name attribute also governs the display name format is shown in the global address list. You can change the display name format by using ADSI Edit. If you do so, this will also change the full name format. For more information, see article Q250455, "How to Change Display Names of Active Directory Users" in the Microsoft Knowledge Base.
To create a group account in Active Directory- Open Active Directory Users and Computers.
- In the console tree, right-click the folder in which you want to add a new group.
Where?
- Active Directory Users and Computers/domain node/folder
- Point to New, and then click Group.
- Type the name of the new group.
By default, the name you type is also entered as the pre-Windows 2000 name of the new group.
- In Group scope, click one of the options.
- In Group type, click one of the options.
Notes
To create a user account on a local computer- Open Computer Management.
- In the console tree, click Users.
Where?
- Computer Management/System Tools/Local Users and Groups/Users
- On the Action menu, click New User.
- Type the appropriate information in the dialog box.
- Select or clear the check boxes for:
- User must change passWord at next logon
- User cannot change passWord
- PassWord never expires
- Account is disabled
- Click Create, and then click Close.
Notes
To create a group on a local computer- Open Computer Management.
- In the console tree, click Groups.
Where?
- Computer Management/System Tools/Local Users and Groups/Groups
- On the Action menu, click New Group.
- In Group name, type a name for the new group.
- In Description, type a description of the new group.
- To add one or more users to a new group, click Add.
- In the Select Users, Computers, or Groups dialog box, do the following:
- To add a user or group account to this group, under Enter the object names to select, type the name of the user account or group account that you want to add, and then click OK.
- To add a computer account to this group, click Object Types, select the Computers check box, and then click OK. Under Enter the object names to select, type the name of the computer account that you want to add, and then click OK.
- In the New Group dialog box, click Create, and then click Close.
Notes
