Information Technology Made Simple, Solutions Made Smart: 🏢 Active Directory and Group Policy Tutorial: Complete Windows Server Administration Guide

🏢 Active Directory and Group Policy Tutorial: Complete Windows Server Administration Guide

Active Directory (AD) and Group Policy (GPO) are essential technologies used by IT administrators to manage users, computers, permissions, security policies, and network resources in a Windows domain environment.

Organizations use Active Directory to centrally manage employee accounts and computers, while Group Policy helps administrators apply common configurations and security settings across multiple systems.

In this tutorial, we will learn how to install Active Directory, configure a domain, create users and groups, join computers to a domain, and manage systems using Group Policy.

📌 1. What Is Active Directory?

Active Directory Domain Services (AD DS) is a Microsoft directory service that stores information about network objects and provides centralized authentication and authorization.

It allows administrators to manage:

👤 User accounts
💻 Computer accounts
👥 Security groups
🏢 Organizational Units (OUs)
🔐 Authentication and permissions
📁 Shared network resources
⚙️ Group Policy settings

Important Active Directory Components

Component	Description
Domain	Logical administrative boundary for directory objects
Domain Controller (DC)	Server that provides AD DS authentication and directory services
Forest	Top-level AD structure containing one or more domains
Tree	Hierarchical collection of domains
Organizational Unit (OU)	Container used to organize directory objects
Schema	Defines object classes and attributes
Global Catalog	Helps locate objects across the forest
FSMO Roles	Special roles responsible for specific AD operations

🖥️ 2. Active Directory Architecture

A typical Windows domain environment looks like this:

             Active Directory Domain
                 corp.example.com
                        |
               Domain Controller
                    DC01
                        |
          ---------------------------
          |            |            |
       Users         Groups       Computers
          |            |            |
       Employee      IT Team      Client PCs
          |
       Group Policy
          |
     Central Management

Example Infrastructure

Server	Role	IP Address
DC01	Active Directory + DNS	192.168.1.10
FILE01	File Server	192.168.1.20
APP01	Application Server	192.168.1.30
CLIENT01	Windows Client	DHCP

Example domain: corp.example.com

Use a domain name that you own or a suitable internal subdomain of your registered domain.

⚙️ 3. Install Active Directory Domain Services (AD DS)

Active Directory Domain Services can be installed through Server Manager or PowerShell.

Method 1: Using Server Manager

Open Server Manager.
Select Manage.
Click Add Roles and Features.
Select Role-based or feature-based installation.
Select your server.
Choose Active Directory Domain Services.
Click Add Features.
Continue through the wizard.
Click Install.

Method 2: Using PowerShell

Open PowerShell as Administrator:

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

Verify installation:

Get-WindowsFeature AD-Domain-Services

🌐 4. Promote Server to Domain Controller

After installing AD DS, promote the server to a Domain Controller.

Create a New Forest

Example domain: corp.example.com

Run:

Install-ADDSForest -DomainName "corp.example.com" -InstallDNS

Follow the prompts and configure the Directory Services Restore Mode (DSRM) password.

The server will restart after the promotion process.

Verify Domain Controller

Run:

Get-ADDomain

Check domain controller discovery:

nltest /dsgetdc:corp.example.com

👤 5. Create Users in Active Directory

Active Directory Users and Computers (ADUC) is used to create and manage domain user accounts.

GUI Method

Open Server Manager.
Select Tools.
Open Active Directory Users and Computers.
Expand your domain.
Right-click the Users container or an appropriate OU.
Select New → User.
Enter the user's first name and username.
Set a temporary password.
Configure password-change options.
Finish the wizard.

PowerShell Method

Create a user:

New-ADUser `
-Name "Rahul Patel" `
-GivenName "Rahul" `
-Surname "Patel" `
-SamAccountName "rahul.patel" `
-UserPrincipalName "rahul.patel@corp.example.com" `
-Enabled $true `
-AccountPassword (Read-Host "Enter Password" -AsSecureString)

Find a user:

Get-ADUser -Identity "rahul.patel"

Disable a user:

Disable-ADAccount -Identity "rahul.patel"

Enable a user:

Enable-ADAccount -Identity "rahul.patel"

Reset a password:

Set-ADAccountPassword -Identity "rahul.patel" -Reset

👥 6. Create Security Groups

Security groups help administrators assign permissions to multiple users instead of managing each account individually.

Example Groups

Group Name	Purpose
IT_Admins	IT administration
HR_Team	Human Resources access
Finance_Team	Finance department access
Sales_Team	Sales department access
Management	Management resources

Create a Group Using PowerShell

New-ADGroup `
-Name "IT_Admins" `
-GroupScope Global `
-GroupCategory Security `
-Path "CN=Users,DC=corp,DC=example,DC=com"

Add a user to a group:

Add-ADGroupMember -Identity "IT_Admins" -Members "rahul.patel"

View group members:

Get-ADGroupMember -Identity "IT_Admins"

🏢 7. What Is an Organizational Unit (OU)?

An Organizational Unit is a logical container used to organize Active Directory objects.

Administrators can create OUs according to departments, locations, or business functions.

Example OU Structure

corp.example.com
       |
       |--- Company
       |       |
       |       |--- IT
       |       |--- HR
       |       |--- Finance
       |       |--- Sales
       |
       |--- Servers
       |
       |--- Workstations
       |
       |--- Groups

Create an OU Using PowerShell

New-ADOrganizationalUnit `
-Name "IT" `
-Path "DC=corp,DC=example,DC=com"

Create another OU:

New-ADOrganizationalUnit `
-Name "HR" `
-Path "DC=corp,DC=example,DC=com"

💻 8. Join a Windows Computer to a Domain

A domain-joined computer can use centralized authentication and receive domain-based policies.

Requirements

Windows Pro, Enterprise, or Education edition.
Working network connectivity to the domain controller.
Correct DNS configuration pointing to the AD DNS server.
Valid domain credentials.
Correct system date and time.

GUI Method

Open Settings.
Go to System → About.
Select Advanced system settings or the domain/workgroup option.
Select Change.
Choose Domain.
Enter corp.example.com.
Provide authorized domain credentials.
Restart the computer.

PowerShell Method

Run PowerShell as Administrator:

Add-Computer -DomainName "corp.example.com" -Credential "CORP\Administrator" -Restart

Verify domain membership:

systeminfo | findstr /B /C:"Domain"

🔐 9. What Is Group Policy (GPO)?

Group Policy is a Windows feature that allows administrators to centrally configure user and computer settings across a domain.

Group Policy Objects can control:

Password policies
Account lockout policies
USB storage restrictions
Control Panel access
Windows Firewall settings
Windows Update settings
Desktop and Start Menu configurations
Software installation
Security restrictions
Script execution

Group Policy is managed through the Group Policy Management Console (GPMC).

⚙️ 10. How to Install Group Policy Management

On Windows Server, install the Group Policy Management feature.

PowerShell Command

Install-WindowsFeature GPMC -IncludeManagementTools

Open Group Policy Management:

gpmc.msc

You can also access it through:

Server Manager → Tools → Group Policy Management.

🛠️ 11. Create a New Group Policy Object

Example: Block access to Control Panel for a selected department.

Steps

Open Group Policy Management.
Expand Forest.
Expand Domains.
Select corp.example.com.
Right-click the target OU.
Select Create a GPO in this domain, and Link it here.
Enter a name such as Block Control Panel.
Right-click the GPO.
Select Edit.
Navigate to the required policy setting.
Enable the policy.
Close the editor.

Example policy path:

User Configuration → Policies → Administrative Templates → Control Panel → Prohibit access to Control Panel and PC settings.

Test this policy using a non-administrator domain user.

📋 12. Important Group Policy Settings for IT Administrators

Policy	Purpose
Password Policy	Enforce password requirements
Account Lockout Policy	Lock accounts after repeated failed logins
USB Storage Restriction	Restrict removable storage
Control Panel Restriction	Limit Control Panel access
Windows Firewall	Configure firewall settings
Windows Update	Manage update policies
Screen Lock	Configure inactivity lock
Desktop Wallpaper	Set corporate wallpaper
Command Prompt Restriction	Restrict Command Prompt access
Software Restriction	Control application execution

Important: Some policies apply to users, while others apply to computers. Always verify the policy location and scope before deployment.

🔄 13. Group Policy Processing Order

Group Policy is processed using the following order:

<text weight="semibold" color="default">LSDOU</text>

L – Local Policy: Local computer policies.
S – Site Policy: Active Directory site-linked policies.
D – Domain Policy: Domain-linked policies.
OU – Organizational Unit Policy: OU-linked policies, from parent to child.

Where multiple policies configure the same setting, precedence and policy-processing rules determine the effective result. Enforced links, inheritance blocking, security filtering, and WMI filters can change the outcome.

🔍 14. Useful Group Policy Commands

Refresh Group Policy:

gpupdate /force

View applied Group Policies:

gpresult /r

Generate Group Policy HTML report:

gpresult /h C:\GPOReport.html

Open Local Group Policy Editor:

gpedit.msc

Open Group Policy Management:

gpmc.msc

Check Resultant Set of Policy:

rsop.msc

🔐 15. Active Directory Security Best Practices

For a secure Active Directory environment, follow these recommendations:

Use strong passwords and appropriate password policies.
Enable Multi-Factor Authentication through supported identity solutions.
Apply the principle of least privilege.
Avoid using Domain Administrator accounts for daily work.
Keep Domain Controllers updated.
Restrict privileged group membership.
Enable appropriate auditing.
Monitor failed logins and suspicious activities.
Use Windows LAPS for local administrator password management.
Maintain regular System State backups.
Protect Domain Controllers from unnecessary application installations.
Review inactive user and computer accounts.
Use secure administrative workstations for privileged tasks.
Monitor Active Directory replication and health.

🧰 16. Important Active Directory Administration Tools

Tool	Command	Purpose
Active Directory Users and Computers	`dsa.msc`	User and computer management
Group Policy Management	`gpmc.msc`	GPO management
Active Directory Domains and Trusts	`domain.msc`	Domain and trust management
Active Directory Sites and Services	`dssite.msc`	Site and replication topology
Local Group Policy Editor	`gpedit.msc`	Local policy management
ADSI Edit	`adsiedit.msc`	Advanced directory object management
DNS Manager	`dnsmgmt.msc`	DNS management
Event Viewer	`eventvwr.msc`	Event and security log monitoring

🚨 17. Common Active Directory and Group Policy Troubleshooting

Problem	Possible Cause	Recommended Check
Domain login failure	DNS or connectivity issue	Check DNS and network
Domain join failure	Incorrect DNS or credentials	Verify DNS and domain access
GPO not applying	Incorrect OU or security filtering	Check GPMC and `gpresult`
User cannot access shared folders	Permission issue	Check share and NTFS permissions
Account locked	Repeated failed authentication	Review security logs
AD replication failure	DNS or connectivity issue	Run `repadmin`
Domain Controller not found	DNS or network issue	Run `nltest`
Password not updating	Replication or policy issue	Check domain controller and password settings

Useful Troubleshooting Commands

Check domain controller discovery:

nltest /dsgetdc:corp.example.com

Check Active Directory health:

dcdiag

Check replication summary:

repadmin /replsummary

Display replication partners:

repadmin /showrepl

Check DNS records:

nslookup corp.example.com

View Group Policy results:

gpresult /h C:\GPOReport.html

🎯 18. Practical Active Directory Lab for Beginners

Build a small virtual lab to understand real-world Windows domain administration.

Lab Requirements

Machine	Operating System	Role
DC01	Windows Server 2025	Domain Controller + DNS
CLIENT01	Windows 11 Pro	Domain Client
CLIENT02	Windows 11 Pro	Domain Client
FILE01	Windows Server 2025	File Server

Practical Tasks

Install Windows Server 2025.
Configure a static IP address.
Install Active Directory Domain Services.
Create a new domain.
Configure DNS.
Create department-wise OUs.
Create users and security groups.
Join Windows client machines to the domain.
Create and link Group Policy Objects.
Configure password and account lockout policies.
Restrict Control Panel access for selected users.
Create shared folders and assign permissions.
Test Group Policy updates.
Monitor Active Directory logs and replication.

Learning tip: Use a private virtual network and test policies with standard user accounts before applying them to production systems.

🏁 Conclusion

Active Directory and Group Policy are fundamental technologies for Windows Server administration.

Active Directory provides centralized identity and access management, while Group Policy enables administrators to control security settings and configurations across domain-connected computers.

By practicing AD DS installation, domain configuration, user management, OU creation, GPO deployment, and troubleshooting, IT professionals can build the skills required for System Administrator, Windows Server Administrator, and IT Infrastructure Engineer roles.

Learn Active Directory. Master Group Policy. Manage IT Infrastructure Efficiently!

🌐 About ITSolution4U

ITSolution4U — Learn | Solve | Grow

💻 Explore practical tutorials covering:

🔹 IT Support & Troubleshooting

🔹 Networking & Cybersecurity

🔹 Hardware & Software Solutions

🔹 Technology Updates & Career Opportunities

🔹 Windows Server & System Administration

👨‍💻 Author: Er. Ashok Prajapati

🌍 Website: https://www.itsolution4u.in

📧 Email: info@itsolution4u.in

📱 Contact: +91 9824974641

Information Technology Made Simple, Solutions Made Smart.

🔖 Hashtags

#ActiveDirectory #GroupPolicy #WindowsServer #ADDS #GPO #DomainController #SystemAdministrator #WindowsAdministration #MicrosoftServer #ActiveDirectoryUsers #GroupPolicyManagement #DNS #DHCP #PowerShell #ITInfrastructure #NetworkAdministration #CyberSecurity #ServerManagement #ITSupport #WindowsServer2025 #ITSolution4U #ErAshokPrajapatiHacker

Pages

🏢 Active Directory and Group Policy Tutorial: Complete Windows Server Administration Guide - ITSolution4U

📌 1. What Is Active Directory?

Important Active Directory Components

🖥️ 2. Active Directory Architecture

Example Infrastructure

⚙️ 3. Install Active Directory Domain Services (AD DS)

Method 1: Using Server Manager

Method 2: Using PowerShell

🌐 4. Promote Server to Domain Controller

Create a New Forest

Verify Domain Controller

👤 5. Create Users in Active Directory

GUI Method

PowerShell Method

👥 6. Create Security Groups

Example Groups

Create a Group Using PowerShell

🏢 7. What Is an Organizational Unit (OU)?

Example OU Structure

Create an OU Using PowerShell

💻 8. Join a Windows Computer to a Domain

Requirements

GUI Method

PowerShell Method

🔐 9. What Is Group Policy (GPO)?

⚙️ 10. How to Install Group Policy Management

PowerShell Command

🛠️ 11. Create a New Group Policy Object

Steps

📋 12. Important Group Policy Settings for IT Administrators

🔄 13. Group Policy Processing Order

🔍 14. Useful Group Policy Commands

🔐 15. Active Directory Security Best Practices

🧰 16. Important Active Directory Administration Tools

🚨 17. Common Active Directory and Group Policy Troubleshooting

Useful Troubleshooting Commands

🎯 18. Practical Active Directory Lab for Beginners

Lab Requirements

Practical Tasks

🏁 Conclusion

🌐 About ITSolution4U

🔖 Hashtags