AD DS - User Account

What is a user account?

User accounts give access to domain resources

In AD DS, all users who require access to network resources must have a user account. A user account is an AD DS object that contains all the information that's required to authenticate and authorize the user during the sign‑in process and build the user's access token.

With a user account, you can:

• Allow or deny users permission to sign in to a computer based on their user account identity.
• Authenticate users to the AD DS domain and give access to network resources.
• Grant users access to processes and services for a specific security context.
• Manage users’ access to resources such as properties, shared folders, files, directories, and printer queues.

How to create user accounts

Creating user accounts is easy

When you create a new user account, you must provide the Full Name, User Logon Name, and Password options.

1. Full Name. The First name and Last name attributes combine to create the Full name attribute. Full name is used as the Common Name (CN) and it must be unique within the container or OU.
2. User Logon Name. The User Logon follow the format user logon name@domain suffix.  The Domain Name System name of your domain is always available as a suffix. However, you can add other suffixes if they are needed.
3. Password. Several password options are available. As a best practice, you should always select User must change password at next logon.  This property enables you to force users to reset their password the next time that they log on. This is typically something that you might enable after you reset a user’s password.

How to add user account attributes

User accounts have many additional attributes

After you create a user account, you can configure additional account attributes. There are many attributes. Therefore, you must understand what these attributes are, and how you can use them in your organization.

The attributes of a user object fall into several broad categories: Account, Organization, Member of, Password Settings, Profile, and Extensions. The Account page has most of the day to day user information that's of interest.

1. Log on hours. This property defines when the account can be used to access domain computers. You can use the weekly calendar style view to define Logon permitted hours and Logon denied hours. For example, you could limit contractor or temporary personnel to certain office hours.
2. Log on to. Use this property to define which computers a user can use to log on to the domain. Specify the computer’s name and add it to a list of allowed computers.  For example, you could restrict access to a specific workstation in a department area.
3. Account expires

• (Never). If you set this value, you must remember to periodically update the password. However, you aren't forced to do this at a predetermined interval. Therefore, the account can never be locked out because of password expiration—a feature that's specifically important for service accounts.
• (End of). This setting is useful when you want to create temporary user accounts. For example, you might want to create user accounts for interns who will be at your company for just one year. You can set the account expiration date in advance