What Active Directory is and why you add users to it

Active Directory is a directory service that Windows networks use to store information about users, computers, and other resources on your domain. When you add a user or computer to Active Directory, you are registering it with your network so that the domain controller can manage permissions, enforce security policies, and let people log in with a single set of credentials across multiple machines.

If you manage a small office network or a larger enterprise environment, you will spend time adding new user accounts and registering new computers. Active Directory makes this centralized rather than having to set up each machine separately. The process differs slightly depending on whether you are adding a user account or joining a computer to the domain.

Key Takeaways

  • You add user accounts through Active Directory Users and Computers, a built-in Windows tool you access by typing dsa.msc into the Run dialog on a domain-connected machine.
  • Creating a user requires you to right-click the organizational unit where you want the account to live, select New, then User, and fill in the user's name and logon name.
  • Computers join a domain either during Windows setup or afterward through System Properties, and they appear in Active Directory once the domain controller processes the join request.
  • New user accounts and computers do not inherit permissions until you assign them to security groups or explore Group Policy, so plan your group structure before you start adding accounts.
  • You need domain administrator credentials to add users and computers, and you must be running the tool on a machine that is already connected to the domain.

Opening Active Directory Users and Computers on your domain machine

Active Directory Users and Computers is a snap-in that runs inside the Microsoft Management Console. On any Windows machine that is joined to your domain, press Windows key + R to open the Run dialog, type dsa.msc, and press Enter. The tool will open and show your domain structure.

If you are on a domain-connected machine and the tool does not open, you may not have domain administrator rights. Ask your domain administrator to grant you the necessary permissions, or run the command as an administrator by typing runas /user:domain\adminaccount dsa.msc in Command Prompt and entering your admin password when prompted.

Once the tool is open, you will see your domain name at the top of the left panel. Expand it by clicking the arrow next to it. You will see organizational units (OUs) — folders that organize users, computers, and other objects. Most networks have separate OUs for different departments or purposes, such as "Sales Users" or "Workstations". Navigate to the OU where you want to add the new object.

Adding a new user account step by step

Right-click the organizational unit where you want the user account to appear. A context menu will open. Select New, then User. A dialog box titled "New Object - User" will appear.

Fill in the required fields. The First name, Last name, and Full name fields are straightforward. The User logon name is what the person will type to log in — for example, jsmith or john.smith. The domain suffix (the part after the @ symbol) will be filled in automatically based on your domain. Click Next.

On the next screen, enter a temporary password and confirm it. Check the box labeled User must change password at next logon so the person is forced to set their own password the first time they log in. This is a security best practice. Click Next, review the details, and click Finish.

The account is now created, but it has no permissions yet. You must add it to security groups to give it access to files, printers, and applications. Right-click the new user account, select Add to a group, and search for the groups that match the person's role — for example, "Sales Department" or "VPN Users". This step is critical; without group membership, the account exists but cannot do anything on the network.

Joining a computer to the domain

A new computer can join the domain during Windows installation or afterward. During setup, when Windows asks you to connect to a network, choose the option to join a domain and enter your domain name. You will be prompted for domain administrator credentials. The computer will restart and join the domain.

If the computer is already running Windows, you can join it to the domain later. Right-click This PC or My Computer on the desktop, select Properties, and look for a button or link labeled Change settings or Advanced system settings. In the System Properties window, click the Computer Name tab, then click Change. Select the radio button for Domain, enter your domain name, and click OK. You will be asked for domain administrator credentials. The computer will restart and join the domain.

After the computer restarts, it may take a few minutes for the domain controller to process the join request and create the computer object in Active Directory. If you open Active Directory Users and Computers and do not see the computer yet, wait a few minutes and refresh the view by pressing F5. The computer object will appear in the OU designated for workstations, usually named something like "Computers" or "Workstations".

Organizing users and computers with organizational units

Organizational units (OUs) are containers within Active Directory that let you group users and computers by department, location, function, or any other structure that makes sense for your organization. Before you add many accounts, plan your OU structure so that explore Group Policy and managing permissions is straightforward.

A typical structure might look like this: a top-level OU for your company, with child OUs for each department (Sales, IT, Finance), and within each department, separate OUs for users and computers. This makes it straightforward to explore different policies to different groups — for example, you might require a longer password for Finance users but not for Sales.

To create an OU, right-click the parent OU or domain, select New, then Organizational Unit. Enter a name and click OK. Once you have your OUs in place, add new users and computers to the appropriate OU from the start. Moving them later is possible but adds extra work.

Using Group Policy to manage new accounts and computers

Group Policy is how you enforce settings across users and computers in Active Directory. Once you have created users and computers and organized them into OUs, you can create Group Policy Objects (GPOs) that explore rules to those OUs.

For example, you might create a GPO that requires all users in the Finance OU to use a password at least 14 characters long, or a GPO that installs specific software on all computers in the Sales OU. Group Policy is powerful but complex; if you are new to it, start by reading the Group Policy documentation for your version of Windows Server, or consult your IT team if you are working in a larger environment.

The key point is that adding a user or computer to Active Directory is only the first step. To actually control what they can access and what rules they follow, you need to assign them to groups and explore Group Policy. Plan this structure before you start adding accounts, because reorganizing later is time-consuming.

When to call a professional

If you are setting up Active Directory for the first time, or if your network has more than a few dozen users, consider bringing in a professional to design your OU structure, security groups, and Group Policy strategy. A poorly designed Active Directory is hard to fix later and can create security gaps.

Also call a professional if you are unsure about domain administrator credentials, if you cannot open Active Directory Users and Computers, or if computers join the domain but do not appear in Active Directory after several minutes. These situations usually point to network or permissions issues that require hands-on troubleshooting.

Frequently Asked Questions

What is the difference between a user account and a computer object in Active Directory?

A user account represents a person who logs in to the network. A computer object represents a machine on the network. Both are stored in Active Directory, but they serve different purposes. Users need passwords and group memberships; computers need to be joined to the domain and may have different Group Policy applied to them.

Can I add a user to Active Directory without a computer being on the network?

Yes. User accounts exist in Active Directory independently of whether any computer is currently powered on or connected. You can create user accounts in advance, assign them to groups, and set up their permissions before they ever log in to a computer.

What happens if I add a user to the wrong organizational unit?

You can move the user to the correct OU later. Right-click the user account, select Move, and choose the correct OU. Any Group Policy that was applied to the old OU will stop explore, and any Group Policy on the new OU will begin to explore. This can take a few minutes to take effect on the user's computer.

Do I need to restart a computer after it joins the domain?

Yes. The computer must restart to complete the domain join process and load domain-specific settings. If you do not restart, the computer will not be fully integrated into the domain.

What should I do if a computer joins the domain but does not appear in Active Directory Users and Computers?

Wait a few minutes and refresh the view by pressing F5. The domain controller may still be processing the join request. If the computer still does not appear after five minutes, check that the computer is actually connected to the network and that it can reach the domain controller. You may also need to check the domain controller's event logs to see if there was an error during the join process.