Active Directory OU, User & Group Creation

Plan the OU Tree First

An OU is not just a folder. It is the unit you later use to apply Group Policy and to delegate small jobs like password resets - so design the tree around how the office is actually run, before you create a single account:

One top OU per site or branch - for example Delhi Office, Jaipur Office. Inside each site, child OUs by department or function - Accounts, Sales. Keep separate OUs for Users, Computers and Groups inside each site, because policies for people and machines are different. Add two utility OUs at the top: New Computers (a staging area for freshly joined machines) and Disabled Users (leavers stay here before deletion).

Create the OUs in dsa.msc

On the domain controller, open Active Directory Users and Computers from the Run box:

dsa.msc

Right-click the domain, choose New → Organizational Unit, and build the tree from your plan. On the creation dialog, tick Protect container from accidental deletion for every OU. PowerShell does the same job and is easier to repeat - and it protects the OU by default:

New-ADOrganizationalUnit -Name "Delhi Office" -Path "DC=office,DC=local"

Create Users with a Naming Rule

Right-click the department OU → New → User, and create each account inside its planned OU - never in the default Users container. Two decisions here decide how clean your directory stays:

Use one naming rule for logon names - for example firstname.lastname - decided once and never broken, even for similar names. Tick User must change password at next logon, so the password you set is only a one-time starter password. Fill in the department and description now - future you will thank present you during every audit.

The same account from PowerShell:

New-ADUser -Name "Rahul Sharma" -SamAccountName "rahul.sharma" -UserPrincipalName "[email protected]" -Path "OU=Accounts,OU=Delhi Office,DC=office,DC=local" -Enabled $true -ChangePasswordAtLogon $true

Create One Security Group per Resource

Groups are how permissions stay manageable. Inside the site's Groups OU, create one security group per resource - for example GRP-Accounts-Share for the accounts file share. A clear prefix like GRP- makes every group recognisable at a glance, and the group is a Security group with Global scope.

Then give the share's permission to the group only - never to a person. When someone changes department, you move their group membership; the share itself is never touched again.

Add Members, Give Rights to the Group

Add each user to the groups their job needs. From PowerShell, adding the example user to the accounts share group is one line:

Add-ADGroupMember -Identity "GRP-Accounts-Share" -Members "rahul.sharma"

Protect the Structure and Verify It

Finish with the two habits that separate a maintained directory from a lucky one. First, confirm every OU really is protected: right-click the OU → Properties → Object tab and check that Protect object from accidental deletion is on - one careless delete of an OU takes every user and computer inside it with it.

Second, verify the result: open each OU and confirm the user list shows accounts only in their planned OUs, and that nobody was left behind in the default containers. Then write down your naming rule and OU plan on one page and keep it with the server documentation, so the next admin follows the same structure instead of inventing a new one.