Chapter 7: Managing Active Directory Groups

In typical Active Directory environments, groups govern access. Groups can be used as distribution lists and/or in access control lists (ACLs) on file server shares and disks, for delegation in Active Directory itself, and to provide privileged access.

There are several built-in groups, such as the Domain Admins group and the Enterprise Admins group, which are used in many of the recipes in this book.

For several recipes in this chapter, multiple ways are shown that produce the same outcome. The Active Directory Users and Computers (dsa.msc) and the Active Directory Administrative Center (dsac.exe) tools provide graphical means to achieve your goals. Active Directory Administrative Center, however, has an important trick up its sleeve; through its PowerShell History feature, it provides the ability to see the Windows PowerShell cmdlets behind the clicks. The PowerShell-based methods in this chapter and the additional hints from Active...