Domain users, groups and OUs¶

Exercise domain-users-groups-and-ous-annex.pdf · PDF

You have one desk, in one classroom. But your name is on many lists: the class register, the football team, the trip to Barcelona. One place to sit, many lists to belong to. The domain works exactly like that, and mixing the two up is the most common mistake in this whole topic.

Run this on dc1:

sudo samba-tool user list --full-dn

One line is Marta's: CN=Marta Soler,CN=Users,DC=tramuntana,DC=internal. Soon twelve people will be in that drawer called Users. Then the boss wants one rule for designers and another for developers. How will the domain know who is who?

What you will learn

What an organisational unit (OU) is and how it differs from a group
Read a distinguished name such as CN=Marta Soler,OU=Dev,DC=tramuntana,DC=internal
Create OUs, users and groups with samba-tool, and put users in groups
Check from a joined PC that a new user can sign in and carries the right group
Disable an account when somebody leaves, instead of deleting it
Why "Marta is in the OU Dev, so she can open the dev folder" is wrong

Reading a distinguished name¶

A distinguished name (DN) is the full path of an object in the directory.

Read it from right to left, like a postal address from the country down to the door:

CN=Marta Soler , CN=Users , DC=tramuntana , DC=internal
   the object     container    the domain: tramuntana.internal

DC=internal, DC=tramuntana → the domain (DC = domain component).
CN=Users → a built-in container. It is not an OU: no rules can be attached to it.
CN=Marta Soler → the object itself (CN = common name).

On this page the middle part becomes OU=Dev.

The desk and the lists¶

In the office, each person has one desk, in one department's room. And each person is on several lists: who may enter the server room, who plays football on Friday.

An organisational unit (OU) is a folder in the directory tree: the room where your desk is. A group is an object that contains members: a list you are on.

	Organisational unit (the room with your desk)	Group (a list you are on)
What it is	A folder in the directory tree	An object that contains members
How many per user	Exactly one: an object sits in one place	As many as needed
Used for	Keeping order, and attaching rules (Group Policy)	Giving permissions: "the group `dev` may write in this folder"
Appears in the DN	Yes: `OU=Dev`	No

flowchart TB
    DOM["<b>tramuntana.internal</b><br>the building"]
    DOM --> DEV["<b>OU=Dev</b><br>a room"]
    DOM --> DES["<b>OU=Design</b><br>a room"]
    DOM --> ADM["<b>OU=Admin</b><br>a room"]
    DEV --> M["Marta"]
    DEV --> P["Pau"]
    DES --> J["Joan"]
    ADM --> A["Aina"]
    G1(["<b>group dev</b><br>a list"]) -.->|"member"| M
    G1 -.->|"member"| P
    G2(["<b>group design</b><br>a list"]) -.->|"member"| J
    G3(["<b>group admin</b><br>a list"]) -.->|"member"| A

Careful: an OU opens nothing

"I put Marta in the OU Dev, so she can open the dev folder." No. An OU gives no access to anything. Permissions are given to groups. Companies usually have both with similar names, which is why they get confused: the OU Dev (capital letter, a place) and the group dev (a list).

The group admin is not the domain's administrators

At Tramuntana, admin is the administration department: Aina does the invoices. The people who administer the domain are in a group that already exists, Domain Admins.

Build the company in the directory¶

All of this runs on dc1 (ssh sysadmin@192.168.122.20). Type the names exactly: the Group Policy page uses them.

Three rooms¶

sudo samba-tool ou create "OU=Dev,DC=tramuntana,DC=internal"
sudo samba-tool ou create "OU=Design,DC=tramuntana,DC=internal"
sudo samba-tool ou create "OU=Admin,DC=tramuntana,DC=internal"
sudo samba-tool ou list

Each answers Added ou "OU=Dev,DC=tramuntana,DC=internal". The list shows the three, plus one that was already there: OU=Domain Controllers, where dc1 itself lives.

People at their desks¶

New users go straight into their OU; Marta, created earlier in Users, is moved:

sudo samba-tool user add joan --given-name=Joan --surname=Riera --userou="OU=Design"
sudo samba-tool user add aina --given-name=Aina --surname=Ferrer --userou="OU=Admin"
sudo samba-tool user add pau --given-name=Pau --surname=Mas --userou="OU=Dev" --must-change-at-next-login
sudo samba-tool user move marta "OU=Dev,DC=tramuntana,DC=internal"

Answers: User 'joan' added successfully and Moved user "marta" into "OU=Dev,DC=tramuntana,DC=internal". Notice that --userou takes the OU without the domain part, while ou create and user move take the full DN, with no spaces after the commas.

Try a test user with the password 1234: the domain answers the password is too short. It should be equal to or longer than 7 characters!. The domain's password policy, at work.

The lists¶

sudo samba-tool group add dev --groupou="OU=Dev" --description="Development"
sudo samba-tool group add design --groupou="OU=Design" --description="Design"
sudo samba-tool group add admin --groupou="OU=Admin" --description="Administration"
sudo samba-tool group addmembers dev marta,pau
sudo samba-tool group addmembers design joan
sudo samba-tool group addmembers admin aina

Answers: Added group dev, Added members to group dev, and so on.

Read what you built¶

sudo samba-tool group listmembers dev
sudo samba-tool user getgroups marta
sudo samba-tool ou listobjects "OU=Dev,DC=tramuntana,DC=internal"
sudo samba-tool user list --full-dn

Command	Output	What it shows
`group listmembers dev`	`marta`, `pau`	The list
`user getgroups marta`	`Domain Users`, `dev`	Every user is in Domain Users automatically
`ou listobjects "OU=Dev,..."`	`CN=dev,OU=Dev`, `CN=Pau Mas,OU=Dev`, `CN=Marta Soler,OU=Dev`	The room holds two users and the group: a group is an object too
`user list --full-dn`	`CN=Marta Soler,OU=Dev,DC=tramuntana,DC=internal`	Marta's new address

From the client¶

On win11, sign out and sign in as TRAMUNTANA\joan, who has never used this PC and has no account on it. whoami /groups lists TRAMUNTANA\design. Then sign in as TRAMUNTANA\pau: Windows makes him choose a new password before he gets in. That was --must-change-at-next-login: from now on, not even the administrator who created the account knows his password.

When somebody leaves¶

Pau's internship ends:

sudo samba-tool user disable pau

His sign-in on win11 is refused, and nothing was deleted. sudo samba-tool user enable pau answers Enabled user 'pau'. The rule in companies: disable first, delete months later, once you are sure nobody needs his files or history. And notice what just happened: one command, every PC of the company. Compare that with the 12 local accounts of a workgroup.

The same tree, with a mouse

Windows' remote administration tools (RSAT) add the console Active Directory Users and Computers (dsa.msc) to win11. Install them in an administrator PowerShell:

Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0
Add-WindowsCapability -Online -Name Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0

Open dsa.msc as TRAMUNTANA\Administrator: the tree you built from a Linux terminal is there, in Microsoft's own console, and WIN11 sits in the container Computers.

Key takeaways¶

A distinguished name is an object's full path, read right to left: CN (the object), OU (the room), DC (the domain).
An OU is where an object is filed — exactly one per object — and where rules are attached.
A group is a list of members — as many as you like — and is what you give permissions to.
samba-tool ou create, user add --userou, user move, group add and group addmembers build the company in the directory.
Every user is automatically in Domain Users; the domain's administrators are in Domain Admins.
When somebody leaves, disable the account: one command stops their logins on every PC.

Quick check¶

1. In how many OUs can the user marta be at the same time?

Exactly one
As many as needed
Three, one per department
None, because users never go in OUs

An object sits in one place in the tree, like a desk in one room. A user can be in many groups, but in only one OU.

2. You want everyone in development to write in the folder dev. To what do you give the permission?

The group dev
The OU Dev
The whole domain
The container Users

Permissions go to groups. The OU only decides where the account is filed and which rules reach it; it opens nothing.

3. In CN=Joan Riera,OU=Design,DC=tramuntana,DC=internal, which part is the domain?

DC=tramuntana,DC=internal
CN=Joan Riera
OU=Design
CN=Joan Riera,OU=Design

Read a DN right to left: the DC parts are the domain tramuntana.internal, then the OU Design, then the object, Joan Riera.

4. An employee leaves the company today. What do you do first with the account?

Disable it
Delete it
Rename it
Move it to the container Users

Disabling stops logins on every PC at once and keeps the account, its groups and its history. You delete it later, when you are sure nothing depends on it.

5. Why is the domain group admin not the group of the domain's administrators?

admin is Aina's department; the domain's administrators are in Domain Admins
admin is a built-in group that only Samba understands
admin only works on Linux clients, not on Windows
admin has no members until Group Policy fills it

The group admin was created for the administration department. The accounts that manage the domain belong to the built-in group Domain Admins.

6. What did the option --must-change-at-next-login do for pau?

Windows made him choose a new password before he could sign in
It disabled his account until the next day
It moved him into the OU Dev at his first login
It let him sign in without any password once

With that option the user must set his own password at the first sign-in, so the administrator who created the account no longer knows it.

7. A new designer, Laia, joins Tramuntana. Select the two steps that let her sign in anywhere and open the design folder.

Create her user in the OU Design
Add her to the group design
Create a local account called laia on every PC
Add her to Domain Admins so she can open folders

The OU files her where the design rules will reach her; the group gives her the permissions on the folder. One domain account works on every joined PC, and making her a domain administrator would break least privilege.

The directory now looks like the company: three rooms, four people, three lists. Next, a rule hangs on the door of the Design room and every designer's PC obeys it — Group Policy and domain resources.