This guide covers users and groups in Windows Server step by step, with every setting in the order you will use it. Accounts are what Active Directory is for: users log on and groups bundle users so you can assign permissions once instead of a thousand times. This guide covers day-to-day account management on a Windows Server 2016 domain controller using Active Directory Users and Computers (ADUC).
dns LAB TOPOLOGY & PREREQUISITES
# example values used while writing and testing this guide
LAB VM
WINDOWS BUILD
VALIDATION
01constructionUsers and groups in Windows Server: Step 1: Open ADUC
On your domain controller, open Server Manager → Tools → Active Directory Users and Computers. Your domain appears as a container. Before creating objects, create an Organizational Unit (OU) (right-click the domain → New → Organizational Unit, for example Lab Users) so accounts have a structure you can manage with Group Policy.
02downloadStep 2: Create Users
Right-click your OU → New → User. Fill in first/last name and logon name, set the initial password, and uncheck “user must change password” only in throwaway lab accounts. The account is created disabled-safe by default with password expiry from the Default Domain Policy.
PowerShell equivalent: New-ADUser -Name "Sarah" -AccountPassword (Read-Host -AsSecureString) -Enabled $true -Path "OU=Lab Users,DC=lab,DC=local" In short, users and groups in Windows Server works best when you follow the order above and verify each step.
03usbStep 3: Create Groups
New → Group. Two concepts matter:
- Scope: Domain Local (permissions on resources), Global (accounts from this domain — the standard choice for role groups), Universal (multi-forest)
- Type: Security (used for permissions) vs Distribution (email lists)
A practical pattern: a Global group per role (GG-Server-Admins) placed into a Domain Local group (DL-Server-Permissions) that is granted rights on a server — the classic AGDLP strategy.
04terminalStep 4: Manage Memberships and Cleanup
Add members by opening a group’s Members tab or a user’s Member Of tab. For cleanup, disable accounts before deleting them, and remember deleted objects rest in the Deleted Objects container if AD Recycle Bin is enabled. In short, users and groups in Windows Server works best when you follow the order above and verify each step.
Related Content
How to Install and Configure a DHCP Server in Windows Server
Finish this lab, then continue down the track. Each guide builds on the one before it.