In ADUC, click on Admin Accounts OU (inside TeamD Corp)
2
Right-click Admin Accounts → New → User
New Object - User (in Admin Accounts OU)
First name:Cory
Last name:Farris
Full name:Cory Farris (Admin)
User logon name:cfarrisD.admin@TeamD.hello
3
Click Next → password: AdminPass456! (DIFFERENT from employee)
☐ User must change password (leave UNCHECKED)
4
Next → Finish. Repeat for: htangD.admin, thallD.admin, jdD.admin, tmD.admin
Parts 4 & 5
Roles, Groups & Membership
Who belongs to what — the complete picture
Department Groups (in Groups OU)
Finance-Users-D
htangD
Sales-Users-D
thallD
HR-Users-D
jdDtmD
IT-Users-D
cfarrisD
Admin Groups
Domain Admins (built-in)
cfarrisD.admin
IT-Helpdesk-D
htangD.admin
# Create groups$g = "OU=Groups,OU=TeamD Corp,DC=TeamD,DC=hello"New-ADGroup-Name"Finance-Users-D"-GroupScope Global -GroupCategory Security -Path$gNew-ADGroup-Name"Sales-Users-D"-GroupScope Global -GroupCategory Security -Path$gNew-ADGroup-Name"HR-Users-D"-GroupScope Global -GroupCategory Security -Path$gNew-ADGroup-Name"IT-Users-D"-GroupScope Global -GroupCategory Security -Path$gNew-ADGroup-Name"IT-Helpdesk-D"-GroupScope Global -GroupCategory Security -Path$g# Add employees to department groupsAdd-ADGroupMember-Identity"Finance-Users-D"-Members"htangD"Add-ADGroupMember-Identity"Sales-Users-D"-Members"thallD"Add-ADGroupMember-Identity"HR-Users-D"-Members"jdD","tmD"Add-ADGroupMember-Identity"IT-Users-D"-Members"cfarrisD"# Add admins to admin groupsAdd-ADGroupMember-Identity"Domain Admins"-Members"cfarrisD.admin"Add-ADGroupMember-Identity"IT-Helpdesk-D"-Members"htangD.admin"
Double-click Finance-Users-D → Members tab → Add... → type htangD → Check Names → OK → Apply
4
Repeat for each group:
Sales-Users-D
Add thallD
HR-Users-D
Add jdD and tmD
IT-Users-D
Add cfarrisD
Domain Admins
Add cfarrisD.admin (find in Users container)
IT-Helpdesk-D
Add htangD.admin
Part 6
Delegation of Control
Give IT-Helpdesk-D (Hak's admin account) specific powers (GUI wizard only)
Helpdesk CAN do:
✅ Reset user passwords
✅ Unlock locked accounts
✅ Read user information
Helpdesk CANNOT do:
❌ Create users
❌ Delete users
❌ Modify groups
❌ Change GPO
Step A — Delegate Password Reset
1
Right-click "TeamD Corp" → Delegate Control... → Next
2
Click Add... → type IT-Helpdesk-D → Check Names → OK → Next
3
Check: ☑ Reset user passwords and force password change at next logon
4
Next → Finish
Step B — Delegate Unlock Accounts
5
Right-click "TeamD Corp" again → Delegate Control... → Next
6
Add IT-Helpdesk-D → Next
7
Select "Create a custom task to delegate" → Next
8
Select "Only the following objects..." → check User objects → Next
9
Check Property-specific → find and check: ☑ Read lockoutTime and ☑ Write lockoutTime
10
Next → Finish
📸
Screenshot the wizard summary before clicking Finish — required for your report!
Part 7
Verification & Testing
Prove each role works correctly — screenshot everything
Test
Log in as
What to do
Expected
1
TeamD\cfarrisD
Log into Win10 VM
✅ Success (change password prompt)
2
TeamD\cfarrisD.admin
Log into Win10 VM
✅ Success
3
TeamD\htangD.admin
Reset thallD's password
✅ Success (Helpdesk perm)
4
TeamD\htangD.admin
Unlock thallD's account
✅ Success (Helpdesk perm)
5
TeamD\cfarrisD
Try to reset a password
❌ Access Denied (correct!)
6
TeamD\htangD.admin
Try to create a new user
❌ Access Denied (correct!)
# Run as htangD.admin (Helpdesk)# Should SUCCEED — reset passwordSet-ADAccountPassword-Identity"thallD"-Reset-NewPassword (ConvertTo-SecureString "NewTemp789!" -AsPlainText -Force)
# Should SUCCEED — unlock accountUnlock-ADAccount-Identity"thallD"# Should FAIL — create user (Access Denied = correct!)New-ADUser-Name"Test"-Path"OU=IT,OU=TeamD Corp,DC=TeamD,DC=hello"
Test 3 — Reset Password:
1
Log into Win10 as TeamD\htangD.admin
2
Open dsa.msc → find Tony Hall in Sales OU
3
Right-click Tony Hall → Reset Password... → enter new password → OK
Test 4 — Unlock Account:
1
On a Win10 VM, try logging as thallD with WRONG password 5+ times to lock it
2
Back as htangD.admin in ADUC, double-click Tony Hall → Account tab
3
Check ☑ Unlock account → Apply → OK
Test 5 — Verify Least Privilege:
1
Log into Win10 as TeamD\cfarrisD (regular employee)
2
Open dsa.msc → try to reset someone's password → should get Access Denied
Part 8
Report Submission
What your team must submit
1. OU Diagram
Draw.io / PowerPoint / Visio showing your full tree
2. Naming Convention
Your 5-10 line standard (see slide 5)
3. Screenshots
OU structure in ADUC
All employee accounts
All admin accounts
Groups OU
Delegation wizard summary
Successful login
4. Summary Paragraph
Why OU structure matters
Why separate admin accounts
Why least privilege is critical
Sample Summary (rewrite in your own words)
OU structure organizes users, computers, and resources logically — making it easy to apply Group Policies and manage permissions as the network grows.
Separating admin and employee accounts limits damage if a daily-use account is compromised — attackers only get standard access, not domain control.
Least privilege gives users only the minimum permissions for their role. A helpdesk tech can reset passwords but not create users — limiting risk from mistakes or compromised accounts.