Active Directory and Group Policy basics for a growing office

A small office can run on shared passwords and a few computers for a surprisingly long time. Then someone leaves and nobody knows which accounts they used, a new person needs access to five different things, or a laptop is lost and you cannot tell what was on it. That is the point where a central directory earns its place. For Windows environments that means Active Directory, and Group Policy to configure computers consistently.

Decide who and what, not just how

Before creating anything, write down the people, the computers and the shared resources (file shares, printers, applications). Most mistakes in a directory come from building structure before agreeing what it is for.

Organise by function, not by person

Use organisational units (OUs) to group objects the way you manage them: workstations, laptops, servers, staff accounts, service accounts, disabled accounts. Avoid an OU per person or per team that changes every year. OUs exist mainly so you can link Group Policy to the right set of objects and delegate administration.

Give access to groups, never to individuals

The pattern that keeps a directory understandable:

1. Put people into groups named for a role or job (for example "Accounts", "Sales").
2. Give groups, not people, access to folders, printers and applications.
3. When someone joins, changes role or leaves, you change their group membership and nothing else.

This is also what makes an audit possible: "who can open the accounts folder?" becomes a question about one group.

Separate administrator accounts

Administrators should have two accounts: an ordinary one for email and browsing, and a separate one used only for administration. Never use a domain administrator account for daily work. A phishing email opened from an account that can change everything is how small incidents become large ones.

A baseline for Group Policy

Group Policy is powerful and easy to misuse. Start with a small, documented baseline:

• Password and account lockout rules that match your written policy.
• Automatic screen lock after a short idle time.
• Update settings so computers receive security updates on a predictable schedule.
• Drive and printer mappings by group, so people see what they need.
• Controls on removable storage where the data is sensitive.

Give each policy a clear name and a description of why it exists. A policy nobody can explain is a policy somebody will eventually delete by mistake.

Test before you apply to everyone

Create a test OU with one or two computers and a test user. Link a new policy there first and check the result with the built-in tools (the "gpresult" command on the computer, or the Group Policy Results wizard). Only then link it to the real OU. Change one thing at a time so you know which change caused a problem.

Plan for leavers

Write a short leaver procedure and use it every time: disable the account, move it to a "Disabled" OU, remove it from groups, handle their mailbox and files, and delete the account only after an agreed retention period. Disabling first is reversible. Deleting is not.

Back up the directory and write it down

The directory is the most important server on the network. Back it up in a way you have actually restored from, and keep a short document: the OU layout, the groups and what they allow, the baseline policies and the administrator accounts. When something breaks at an inconvenient time, that document is what you will be glad exists.