Users and groups are, undeniably, the bread and butter of Active Directory. When there is something wrong, missing, or absent in these two object types, service desk personnel will be the first to know, because colleagues will ring the number for help. On the other hand, when an error is in a colleague's personal interest, due to lingering privileges or absent identity and access management processes, don't expect a call.
It's imperative to get users right. It is estimated that 20% of all IT costs in any organization is related to password resets and account lockouts. As colleagues use their accounts for authentication, any hiccup will inevitably result in loss of productivity.
A best practice is to cooperate with the Human Resources (HR) department for user creation and user expiration. HR people know when a contract is (to be) terminated...
