For the best web experience, please use IE11+, Chrome, Firefox, or Safari

Active Directory Management

Best practices for successfully managing your AD

Why you need Quest solutions for a comprehensive Active Directory disaster recovery plan 09:14
Active Directory management comprises a wide range of tasks, including setting up your domains and forests, keeping your AD organized and healthy, properly managing Group Policy, and ensuring business continuity with a comprehensive backup and recovery process.

Establish a sound AD structure

Establish a sound AD structure — or cleaning up the one you already have — is essential to efficient, effective Active Directory management. It will dramatically simplify your ability to manage your Group Policy, help you properly delegate administrative permissions to spread out the management workload without sacrificing security, and streamline common tasks like user account provisioning and reporting.

Establish domains

Establish domains

Establish domains

The basic unit of AD management is the Active Directory domain — a group of related users, computers, printers and other AD objects stored in a single AD database. Domains should be fairly stable entities, so set them up thoughtfully. For example, you might have a domain for your company’s Chicago office and a separate domain for your San Francisco office. Since a domain is a management boundary, your Chicago admins can’t delete users from your San Francisco domain, and your San Francisco admins can’t modify the permissions of users in the Chicago domain.

Create organizational units

Create organizational units

Create organizational units

To simplify AD management, group the objects in each domain into organizational units (OUs). OUs often mirror the organization's structure; for instance, you might have an OU for each department in your Chicago office: Sales, Marketing, IT, Legal and so on. Some OUs can be temporary — you might create OUs for different projects and dissolve them when the projects are over. However, it’s essential that these changes be made systematically; allowing ad-hoc modifications invariably results in a jumbled AD structure that’s much harder to understand and manage.

Define your schema

Define your schema

Define your schema

Think through your database schema. The schema contains formal definitions of every object class that can be created and every attribute that an AD object can have. Active Directory comes with a default schema, but you will likely need to adapt it to suit your specific business needs. Be sure to design your schema carefully during the planning phase, since changing it later can dramatically disrupt your business, because of the central role AD plays in authentication and authorizations.

Employ standard naming

Employ standard naming

Employ standard naming

Across all of levels – domain, OUs, schema – be sure to develop and follow standardized naming practices. That way, it’s easier for everyone to, for example, contact the right user or identify the machine in a particular conference room. It’s especially important to be systematic about naming AD security groups, so you can provision and re-provision users easily and accurately. It’s smart to also add a clear description of the purpose of each security group. It takes only a few seconds and can help you avoid serious problems later.

Monitor AD health

An IT environment is a dynamic place; you can’t simply set up your Active Directory and forget it, no matter how perfectly you plan your domains, OUs, schemas and so on. Users, computers, printers and other AD objects come and go, so you’ll need procedures for provisioning and deprovisioning, which should be automated as much as possible through approval-based workflows. You should also regularly identify inactive user and computer accounts so you can clean them up before they can be misused.

More broadly, you also need to monitor the health of your domain controllers and the replication of data between them in real time. Otherwise, users might very well experience problems logging in or accessing the resources they need to do their jobs.

Microsoft provides several Active Directory management tools, including Windows PowerShell, Active Directory Users and Computers (ADUC), Local Users and Groups, and the Active Directory Schema snap-ins for Microsoft Management Console (MMC). However, the functionality of native tools is limited; it’s awkward at best to keep switching between tools; and tasks are often manual, time-consuming and error-prone.

Closely track service accounts

Closely track service accounts

Closely track service accounts

Scripts and applications often need more access rights than a typical user account has. But you should not use an administrative account; that often grants the application more access than it needs and puts your admin account at increased risk of being compromised. Instead, the best practice is to create a service account for each application, and grant that account only the permissions it needs, as required by least privilege.

But don’t forget about these accounts. Since service accounts have access to important resources in your IT environment, it’s essential to track what each service account is doing. Proactively look for any unusual or unwarranted activity, which could be a sign that the account has been compromised and is being misused.

Manage Group Policy

Manage Group Policy

Manage Group Policy

Another critical aspect of Active Directory management is administering Group Policy. Group Policy is a set of policies, called Group Policy objects (GPOs), that can be applied to an entire domain or just to certain OUs. For instance, you can use Group Policy to require all users in your Chicago domain to use complex passwords, or to disallow the use of removable media on all computers in just the Finance OU of the Chicago domain. Microsoft provides hundreds of GPOs you can configure.

Group Policy is extremely powerful, so it’s critical to set it up right and carefully manage changes to it. A single improper change to a GPO could lead to downtime or a security breach. Unfortunately, native tools don’t make it easy to keep Group Policy under control.

  • Disable PST file creation
  • Add frequently used sites to users’ browsers
  • Map useful network drives
  • Set custom registry values on all computers
  • Deploy standard operating systems and other software to all Windows Server machines and other computers
  • Run certain scripts on computer startup or shutdown or user login or logout

Implement change control

Implement change control

Implement change control

Any improper change to Active Directory or Group Policy — whether it’s deliberate or accidental — can disrupt critical services and block legitimate user access to resources, hurting business operations. To avoid issues, be sure to plan, document and test all changes, and be sure you can roll back any change that causes unexpected issues.

In addition, it’s invaluable to be able to prevent changes to your most important AD objects, including powerful administrative security groups and crucial GPOs. Quest Change Auditor and GPOADmin streamline change control to strengthen Active Directory management.

Ensure business continuity

Last but by no means least, proper Active Directory management ensures business continuity. This is achieved through reliable backup and recovery processes and automating repetitive AD tasks.

Back up and recover

Back up and recover

Back up and recover

To ensure productivity and business continuity, you need to regularly back up your AD and be able to quickly recover from any incident or disaster at the object and attribute level, the directory level and the operating system level across the entire forest . While the AD Recycle Bin enables quick recovery of some recently deleted objects, it is not — and was never meant to be — an enterprise backup and recovery solution.

The value of having complete and reliable backups of Active Directory is aptly illustrated by the case of international shipping giant Maersk, which was a victim of the NotPetya attack in 2017. Within hours of the malware being released into its network, Maersk was effectively crippled. Nearly every one of its 150 domain controllers worldwide was down — and the company didn’t have a single backup of Active Directory to use to restore operations. Fortunately for the company, one DC in Ghana happened to be offline when the malware struck, which meant its data was still intact. However, the bandwidth at the Ghana office was so slow that uploading the data from the DC would have taken days, and no one there had a British visa, so the recovery team had to undertake a kind of relay race involving multi-hour flights to bring the precious machine to the company’s UK headquarters. But finally, they were able to use the machine to rebuild the other DCs.

Automate AD tasks

Automate AD tasks

Automate AD tasks

Many Active Directory management tasks are quite tedious and time-consuming, which increases the risk that they will be put off or done incorrectly. Automation can slash IT workload while eliminating human error and ensuring timely completion of important but routine tasks. For example, all of the following tasks are prime candidates for at least some level of automation:

  • User account creation, modification and removal
  • Computer provisioning and decommissioning
  • Software deployment and patching
  • Inventory
  • Reporting
  • Directory cleanup
Where can I get help with my AD environment?

Where can I get help with my AD environment?

Quest is the go-to vendor for Active Directory solutions. We can help you manage, secure, migrate and report on your AD environment to drive your business forward. Here’s where you can learn more:

7 Question Quiz - How good is your AD Backup and Recovery Solution?

Blogs

Quest Active Directory Security Assessments Reveal Top 4 Issues: #1 Service Accounts (Part 1 of 3)

Quest Active Directory Security Assessments Reveal Top 4 Issues: #1 Service Accounts (Part 1 of 3)

In Part 1 of our Quest Security Assessment series, we focus on the top vulnerabilities we have discovered in Active Directory: Service Accounts.

How to Continue Your AD Migration When Everyone is at Home

How to Continue Your AD Migration When Everyone is at Home

Some AD Migrations must continue, even in this health crisis. This post outlines how you can move your migration forward even with a remote workforce.

In the Fog of War, You Need Options…Not Just One but Many! Quest Has You Covered.

In the Fog of War, You Need Options…Not Just One but Many! Quest Has You Covered.

When it comes to disaster recovery, you need a solution that fits your situation. Find out how Recovery Manager for Active Directory delivers both power & flexibility.

Insider’s Guide to a Malware Event — In Case of Fire, Break Glass

Insider’s Guide to a Malware Event — In Case of Fire, Break Glass

Malware can spread at an alarming rate. To protect your organization from these attacks, having a comprehensive, flexible disaster recovery plan is essential. Learn more.

Be Very Afraid — When It Comes to AD Disaster Recovery, You Need Choices!

Be Very Afraid — When It Comes to AD Disaster Recovery, You Need Choices!

Learn about the true danger of malware attacks, why a solid disaster recovery plan is essential, and how to do AD recovery right the first time.

The Many Colors of AD Security – Microsoft Red Forest, Orange Forest, Greenfield or Blue?

The Many Colors of AD Security – Microsoft Red Forest, Orange Forest, Greenfield or Blue?

Discover the different models of Active Directory (AD) security, including the Red and Orange Forest models, Greenfield migrations, and Blue Team.

Get started now

Your go-to vendor for Active Directory management.