7 Tips to simplify Active Directory Management 1.Investigate nested group memberships and manage appropriate group permissions. 2.Identify and manage available server shares and user permissions for confidential files and folders. 3.Learn more about Office 365 license management and reporting; identify inactive, licensed, and unlicensed Office 365 users. 4.Learn how to use ADManager Plus's 200+ reports to retrieve essential data from Active Directory, Exchange, Office 365, and Google Apps. 5.Practice effective account provisioning techniques that incorporate AD accounts, mailboxes, Office 365 mailboxes, Lync settings, profile paths, and home folders. 6.Automatically trace, quarantine, and clean up stale accounts from Active Directory. 7.Create a user management console for HR or branch heads to create and manage their teams' accounts.

1. 7 tips to simplify Active
Directory management
Harish Sekar
Technical consultant, Active Directory Solutions

2. Agenda
 Part 1: Gaining insight on Active Directory
 Part 2: 360* Active Directory management
 Part 3: Delegation demystified
 Part 4: Let’s automate Active Directory
 Question and answers

3. Part 1: Gaining insight on Active
Directory

4. Tip 1 – Observing accounts
 Every object needs
attention
 Account expired users,
password expired users,
disabled users – major
cause for internal hacks

5. Privileged accounts with unchanged
passwords
 Chances of account
compromise
 Monitor the password
activity
 Force them to change
password immediately

6. Restricting users access
 Avoid unnecessary
elevation of permissions
 Active Directory Users and
Computers doesn’t give you
enough visibility
 Formatting issues with
Powershell

7. Nested groups
User’s direct groups User’s nested groups

8. Users who have never logged on
 A security issue
 ADUC provides the option
of saved queries
 ‘When created’ should
be taken into
consideration

9. File server access

10. Tip 2 – Permission cleanup
 Find out who has access
to confidential data
 What level of access?
 Investigate subfolder
permissions
 Assign permissions only
for appropriate users

11. Tip 3 – Isolate admin and non-admin
accounts
 Enforce restrictions for
accessing,
File servers
Domain controllers
 Managing non-admin
accounts

12. Part 2: 360*Active Directory
Management

13. Tip 4 -Active Directory management
Active Directory
Exchange
(2003-2016)
Lync/skype
for business
Office 365
Organization
+ contact
information
Custom
platform Google
Apps
User/object(s)
Onboarding
Terminal
service

14. User creation templates

15. Bonus tip – Report on service accounts
 Challenges:
 Get a list of all computers
in the domain
 Report on all service
accounts present in each
computer
 Try doing this with
Powershell!

16. Part 3: Delegation demystified

17. Tip 5 – Have a checklist before
delegating actions
 Clarity of rights
 Precise restrictions
 Easy to revoke
 Handle native permissions
 Track changes

18. Shortcomings of the DoC wizard
 Supports a small set of delegation tasks, by default
 It’s a minute-to-minute delegation
 Modify ACLs later, if required
 No bird’s-eye view of delegation across your entire
Active Directory
 No way to “keep track” of what delegations you’ve
done
 View ACLs, if required

19. Roles: Task controllers

20. Keep track of the changes

21. Part 4: Let’s automate Active Directory

22. Tip 6 – Automate user provisioning
 Options that native tool offer
 What are the challenges?
 Account provisioning checklist
 An option to supervise account provisioning

23. Options that native tools offer
Active Directory users and
computers Scripts

24. Import-Csv .usercreationfile.csv | foreach-object {
$userprinicpalname = $_.SamAccountName +
"@{domainname}.com" New-ADUser -SamAccountName
$_.SamAccountName -UserPrincipalName
$userprinicpalname -Name $_.name -DisplayName $_.name -
GivenName $_.cn -SurName $_.sn -Department
$_.Department -Path "CN=Users,DC=biogen,DC=com" -
AccountPassword (ConvertTo-SecureString "Microsoft~1;" -
AsPlainText -force) -Enabled $True -PasswordNeverExpires
$True -PassThru }
Sample script for user creation

25. What are the challenges?
 The confirmation messages (Success/ failure) aren't
helpful
 Maintaining uniformity
 Handling duplicate entries
 Time consuming
 Creating accounts (AD, Office 365, Exchange,
Lync, Google apps.)

26. Automation: User creation

27. Tip 7 – Remove inactive objects
Benefits,
 Improves security for your domain
Inactive user objects (Admin accounts)
Inactive computer objects (Avoid name conflicts)
Effective utilization of licenses (Applications
that are licensed by number of users)

28. Create your own logic for automation

29. Supervise and execute automations

30. Joy Tip-free mobile apps!

31. Free online workshop
• Online classroom setup
• Week wise feature based workshop
• Instant answers to your questions
• Series would provide complete product understanding

32. Summary
 Script-free methods for retrieving information
 Non-invasive delegation model
 Advanced account provisioning methods
 Automating and supervising account de-
provisioning in Active Directory

33. Time to choose the right tools!

34. Thank you
hary@manageengine.com