Active Directory

Add users, join computers and apply security rules

Organise departments, create employee accounts, join PCs to the domain and enforce a screen lock with Group Policy.

Intermediate14 min read6 steps

OrganiseDepartments as OUs
UsersAccounts and groups
JoinConnect the PCs
PolicyApply the rules

What you need

A working domain, as built in the previous tutorial
A PowerShell window on the domain controller
PCs running a Pro or Enterprise edition of Windows, because Home editions cannot join a domain

Create a structure for your company

Organizational units (OUs) hold users and computers so you can manage them together. Keep the structure simple. The paths below match the corp.example.com placeholder, so change them to your own domain.

New-ADOrganizationalUnit -Name "Company" -Path "DC=corp,DC=example,DC=com"
New-ADOrganizationalUnit -Name "Users" -Path "OU=Company,DC=corp,DC=example,DC=com"
New-ADOrganizationalUnit -Name "Groups" -Path "OU=Company,DC=corp,DC=example,DC=com"

Create an employee account

The password is typed privately and the employee must change it at first sign-in, so nobody else keeps knowing it.

New-ADUser -Name "Rahim Uddin" `
  -SamAccountName "rahim" `
  -UserPrincipalName "[email protected]" `
  -Path "OU=Users,OU=Company,DC=corp,DC=example,DC=com" `
  -AccountPassword (Read-Host -AsSecureString "Temporary password") `
  -ChangePasswordAtLogon $true `
  -Enabled $true

Give access through groups

Grant permissions to a group, never to one person. When someone moves department, you change their group and all their access follows.

New-ADGroup -Name "Finance" -GroupScope Global -GroupCategory Security `
  -Path "OU=Groups,OU=Company,DC=corp,DC=example,DC=com"
Add-ADGroupMember -Identity "Finance" -Members "rahim"
Get-ADGroupMember -Identity "Finance"

4
Join a computer to the domain
Run this on the employee's PC in an Administrator PowerShell window. The PC must use the domain controller as its DNS server, or it will not find the domain.
```
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 192.168.10.10
Add-Computer -DomainName "corp.example.com" -Credential "CORP\Administrator" -Restart
```

Enforce a screen lock with Group Policy

This policy locks a screen after 10 minutes of inactivity for everyone in the Users OU, which is a simple protection for an unattended desk.

$key = "HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop"
New-GPO -Name "Screen Lock"
Set-GPRegistryValue -Name "Screen Lock" -Key $key -ValueName "ScreenSaveActive" -Type String -Value "1"
Set-GPRegistryValue -Name "Screen Lock" -Key $key -ValueName "ScreenSaverIsSecure" -Type String -Value "1"
Set-GPRegistryValue -Name "Screen Lock" -Key $key -ValueName "ScreenSaveTimeOut" -Type String -Value "600"
New-GPLink -Name "Screen Lock" -Target "OU=Users,OU=Company,DC=corp,DC=example,DC=com"

6
Check that the policy reached the PC
Sign in on the joined PC as the employee and run these commands. The Screen Lock policy should appear in the list of applied policies.
```
gpupdate /force
gpresult /r
```
Disable an account as soon as an employee leaves. Disabling first keeps their records available if you need them later.

Want this set up for your business?

We can plan, build and hand it over to your team.

Discuss your setup ↗

Next tutorialControl shared folder access with Active Directory groups →