What Active Directory Does and Who Needs It

Active Directory is Windows Server's system for managing user accounts and computers across a network. If you have a Windows Server machine and multiple computers or users that need to log in with the same credentials, Active Directory lets you control them all from one place instead of setting up each account separately on each machine.

Most small offices and organizations use Active Directory to let employees log into any computer on the network with their own username and password, and to control what files and printers each person can access. If you are running a single standalone computer, you do not need Active Directory — the built-in user accounts in Windows are enough. But if you are managing more than a few computers or users, Active Directory saves time and reduces mistakes.

This guide covers adding users and computers to Active Directory on Windows Server 2016 and later. You will need administrator access to the server and basic familiarity with Windows.

Key Takeaways

  • Active Directory must be installed on a Windows Server machine before you can add users or computers to it.
  • Users are added through Active Directory Users and Computers, a built-in tool you open by searching for "dsa.msc" or finding it in Administrative Tools.
  • Computers join Active Directory by connecting to the network, then using the System settings to join the domain with the server's name.
  • Once a user is added to Active Directory and a computer is joined to the domain, that user can log into that computer using their network credentials.
  • Group Policy lets you control settings across multiple computers at once, which is one of the main reasons organizations use Active Directory.

Installing Active Directory on Your Server

Before you can add users or computers, Active Directory itself must be installed and running on your Windows Server machine. This is called promoting the server to a domain controller. Open Server Manager (which appears automatically when you log into Windows Server), click Add roles and features, and select Active Directory Domain Services from the list of roles.

After installation finishes, Server Manager will show a notification flag. Click it and select Promote this server to a domain controller. You will be asked to create a new forest and domain — for a small network, choose Add a new forest and give it a name like "company.local" or "office.local". The server will restart, and Active Directory will be ready to use.

If you are not sure whether Active Directory is already installed, open Server Manager and look at the left sidebar. If you see Active Directory Users and Computers listed, it is already set up. If not, follow the steps above.

Opening Active Directory Users and Computers

The tool for adding users and computers is called Active Directory Users and Computers. On your domain controller (the Windows Server machine), press the Windows key and type "dsa.msc" — this is the shortcut name for the tool. Press Enter, and the window will open.

You can also find it by opening Server Manager, clicking Tools in the top right, and selecting Active Directory Users and Computers from the dropdown menu. Either method opens the same tool.

The left side of the window shows your domain structure. You will see a folder for your domain (like "company.local"). Inside it are containers for different types of objects — Users, Computers, and others. This is where you will add new accounts.

Adding a New User to Active Directory

In Active Directory Users and Computers, expand your domain by clicking the arrow next to it. Right-click on the Users folder and select New, then User. A dialog box will open asking for the user's information.

Fill in the First name, Last name, and User logon name fields. The logon name is what the person will type to log in — something like "jsmith" or "john.smith". The system will suggest a full name automatically, but you can change it. Click Next.

On the next screen, enter a temporary password and confirm it. Check the box for User must change password at next logon — this forces the person to create their own password the first time they log in, which is more find than leaving a temporary password in place. Click Next, then Finish.

The new user now exists in Active Directory. They can log into any computer that is joined to your domain using their username and password. If you need to add many users at once, you can also import them from a CSV file using PowerShell, but the manual method above works for small numbers of accounts.

Joining a Computer to the Domain

Once users are created in Active Directory, computers need to join the domain so those users can log in. On the computer you want to add, open Settings and go to System > About. Scroll down and click Rename this PC (advanced).

In the System Properties window, click the Change button. A dialog will appear with a field for the computer name and a section below it labeled Member of. Select the Domain radio button and type the name of your domain (like "company.local"). Click OK.

Windows will ask for credentials to join the domain. Enter the username and password of an account that has permission to add computers — usually the administrator account you created when you set up Active Directory. The computer will join the domain and ask you to restart. After the restart, any user in Active Directory can log in to that computer.

If the computer cannot find the domain, make sure it is connected to the same network as the domain controller and that the domain controller's IP address is set as the DNS server in the computer's network settings. Without correct DNS, the computer cannot locate the domain.

Managing Users and Computers After They Are Added

Once users and computers are in Active Directory, you can manage them from the same tool. To reset a user's password, right-click their name in the Users folder and select Reset Password. To disable an account temporarily, right-click it and select Disable Account. To remove a user entirely, right-click and select Delete.

For computers, you can remove them from the domain by right-clicking in the Computers folder and selecting Delete. The computer itself will still work, but users will no longer be able to log in with their domain accounts — they will need local accounts instead.

You can also organize users and computers into groups and organizational units (OUs) to explore settings to multiple accounts at once. For example, you might create an OU called "Sales" and put all sales employees in it, then use Group Policy to give them access to shared sales folders. This is one of the main reasons organizations use Active Directory instead of managing each computer separately.

Troubleshooting Common Problems

If a user cannot log in after being added to Active Directory, check that the computer is actually joined to the domain. Open Settings > System > About and look for "Domain" under "PC name, domain, and workgroup settings". If it shows a workgroup instead, the computer has not joined the domain yet — follow the steps in the "Joining a Computer to the Domain" section above.

If a computer cannot join the domain, the most common cause is DNS. The computer needs to be able to find the domain controller by name. Go to Settings > Network & Internet > Ethernet (or Wi-Fi) > Change adapter options, right-click your connection, select Properties, then double-click Internet Protocol Version 4 (TCP/IPv4). Make sure the DNS server is set to the IP address of your domain controller, not to automatic. If you do not know the domain controller's IP address, open Command Prompt on the server and type "ipconfig" to find it.

If you see an error about permissions when trying to add a computer to the domain, make sure you are using an account that has administrator rights in Active Directory. The built-in Administrator account always works. If you are using a different account, it must be a member of the Domain Admins group.

Frequently Asked Questions

Can I add a Mac or Linux computer to Active Directory?

Not directly — Active Directory is designed for Windows. However, Mac and Linux computers can connect to Active Directory using third-party tools like Centrify or by configuring LDAP manually. For most small networks, it is simpler to keep Macs and Linux machines separate and manage them with their own tools.

What happens if I delete a user from Active Directory?

The user account is removed and they can no longer log into any computer on the domain. Any files they owned remain on the computers and servers, but they cannot access them. Deletion is permanent, so make sure you want to remove the account before you do it. If you just want to prevent someone from logging in temporarily, disable the account instead of deleting it.

Do I need a separate server just for Active Directory?

For small networks with fewer than 50 computers, you can run Active Directory on a regular Windows Server machine that also does other work. For larger networks, it is better to have a dedicated domain controller. You can also set up a second domain controller as a backup so that if the first one fails, users can still log in.

Can users log in if the domain controller is offline?

No — computers need to contact the domain controller to verify the username and password. If the server is down, users cannot log in with their domain accounts. They can only log in with local accounts if those exist on the computer. This is why organizations with important networks set up a second domain controller as a backup.

How do I change a user's password if they forgot it?

Open Active Directory Users and Computers, find the user in the Users folder, right-click their name, and select Reset Password. Enter a temporary password and click OK. Tell the user the temporary password, and they will be forced to change it the next time they log in. Make sure the "User must change password at next logon" box is checked so they cannot skip this step.