In an organization where every computer has its own local account and every system has a separate username, two chronic problems arise: users cannot remember so many passwords, and the technical team does not know exactly who has access to what. When an employee leaves the organization, they may still have access to some systems weeks later.
What does Active Directory do?
Active Directory is Microsoft's directory service, keeping users, computers and groups in a centralized database. Each user has an account used to sign in to computers, shared folders, printers, email and many other systems.
Key Benefits
- Single sign-on: One username and password for most organizational resources.
- Centralized management: Create, modify or disable an account in a single place.
- Groups and roles: Access is granted to groups rather than individuals, and when an employee changes roles, only their group membership changes.
- Group Policy: Security settings, passwords, updates and software are applied consistently across all computers.
Design and Security Tips
Have at least two Domain Controllers so that if one fails, users can still sign in.
Separate administrative accounts from everyday accounts and keep their number limited.
Define an appropriate password policy and account lockout after failed attempts.
Regularly review inactive accounts and departed employees.
Keep a separate backup of Active Directory and test its recovery.
Employee onboarding and offboarding process
The greatest value of centralized identity management shows on employees' first and last days. With a defined process, a new hire has access to all required tools from day one, and an employee who leaves the organization is removed from all systems the same day.
Modern Shabakeh Partak designs and implements Microsoft data center services for organizations, including Active Directory, Group Policy and related services.
