Creating User Accounts Creating User Accounts In this demonstration, we are going to create some user accounts. To do this, we are going to click Tools and Server Manager and open Active Directory Users and Computers. When you create your user accounts, you want to make sure you create them in the appropriate organizational unit. For this demonstration, we are going to be creating some users in our Research group that we have created here, in our Research and Development group. To create a user, you can either click the new user button up here, in the toolbar, or you can right-click the OU. Let's go ahead and rightclick the OU Research and Development, go to New, and go down to User. Adding User Information In this window, we can see we need to specify some identifying information for the new users. We will enter the ﬁrst and last name. As you can see, when we do that, it automatically creates the full name here for us. For the logon name, you should have a standard naming scheme to make creating and managing users as easy as possible. Typically, organizations will sometimes use the ﬁrst letter of the ﬁrst name followed by the full last name. However, sometimes that can get confusing. If you make a user account with the name John Smith, and you have a Jane Smith, both users would be jsmith. To accommodate, sometimes you can use the employee's middle initial in the logon name. But whatever naming scheme you use, just make sure it is consistent. A lot of companies have started using the ﬁrst name, period, last name; and sometimes you may have so many of the same named users, you may have to use numbers. Whatever scheme you choose, though, just make sure you keep it consistent. We have just created our test.user. Here, we are going to use the username Tuser. As you can see, the @Corp.TestOutDemo.com is called the UPN sufﬁx. When it is combined with a logon to create the user Tuser @Corp.TestOutDemo.com, it is called the UPN, the user principle name. If you have multiple UPN sufﬁxes to choose from, you can click this drop-down arrow, here, and select a different one. On this system, we only have one UPN sufﬁx to choose from. Passwords We are going to go ahead and click Next to create this user. It is going to prompt us for a password. We need to enter a new password for this user. It is a good idea to pick a particular password scheme for new users. Always make sure to select the User must change password at next logon option. This forces the user to change the password to one of their own choosing the next time they log on. That way, you do not have users keeping the same password. One thing to note here is a security risk. Do not always use the same password for every new user. Make sure to mix it up. A lot of security analysts will tell you to actually randomize the password for every new user. Most large companies are trying to do that. That way, you cannot guess a new user's password just because they are a new employee. Very rarely do we want to select the User cannot change password option, because this would actually prevent our users from being able to change their own password. However, some situations might call for it. Pre-Staging For example, we would not want the user account on a public kiosk machine to be able to change its password. The Password never expires option is primarily used for service accounts, but this option overrides the domain password policy, and also presents a security risk. There are much better ways to go about this, but if you understand the implications, you can select this option if you absolutely need to. Whenever you are doing something in advance, it's called pre-staging. For example, let's say Test User is not going to start work for two weeks, but we are creating it right now. If this is the case, when you know the user is not going to be used immediately, it is best to leave the account disabled. In that case, the account will not be active until you enable it. We are going to go ahead and put in the password here. Hit Next and Finish. As you can see here, this little down arrow right here next to this user means the account is disabled. We can easily enable it by right-clicking and go to Enable Account. In addition, we can disable accounts from here, if we do the same. For example, this Wendy Potts account, we can go here and say Disable Account. This is useful when we know that a user account might not be used for a while--for example, if an employee goes on vacation or takes an extended leave of absence. We can also reset the user's password if we need to. And we can also add a new user to a group if we right-click this menu, as well. Summary That's it for this demonstration. In this demonstration, we learned about creating user accounts. We learned how to create a user account in a speciﬁc organizational unit. We learned what information is needed when creating users. We learned the different options we can select during user creation. We learned how to enable and disable user accounts for pre-staging or other uses, such as if an employee goes on leave.