Moving From Local Accounts to AD Accounts - Lots to Learn!

[Darrenb]

Hi all,

We have 25 Win XP Pro clients, a Win 2003 Standard server running Exchange 2003 set up as PDC, and another Win 2003 standard server acting as a file server.

All the clients are configured with local accounts. We would like to move from this set-up to having everyone log in to the domain, so that we can have control over users password policies and make it easier to set-up new PC's.

I'm completely new to Active Directory, and have inherited everything from an IT employee who's left. Needless to say, I have a few questions:

1) Everyone already has an account on the domain and a mailbox. Logging into to the domain account from their PC is treated like a new user, and therefore all their settings created under their local account are lost. Is there any way of avoiding having to set-up each users personal settings again?

2) Looking in 'Active Directory Users & Computers', my predecessor configured an OU (I think that's what they're called, they look like folders!) under the domain called 'Exchange Users' and another OU within this called 'Local'. Within 'Local' are all 25 user accounts. Looking in the 'Group Policy Snap-in' there is only a 'Default Domain Policy' and no other policies or settings created/configured.

Is it safe for me to create some new OU's that follow our department structure (accounts, sales, warehouse, etc.) and then drag-and-drop the users from 'Local' into these OU's and use 'Create and Link a GPO' within the Group Policy Management on each of these departments to specify individual policies? Do I modify the 'Default Domain Policy' to contain settings that apply to everyone (for example, password length, age etc.), and then create an individual policy on each of the department OU's to contain department specific settings?

3) I want to give some users the ability to create/delete printers and add/remove programs. How do I go about doing this, as I can't see any options in the domains policies.

I've got a spare PC and set up a few user accounts to test everything before I change actual users!

Many thanks for taking the time to read through, I know it's a lot to ask!

Regards,
Darren

 

[58sniper]

set up as PDC

I think you mean a DC. There is no PDC in Windows 2000 or later.

You can go to the machines, have them log into their domain accounts. It will create a new user profile on the machine. Then log on as an admin and copy the old profile to the new profile location on the workstation.

As for OUs, you could create GPOs for each, with specific settings for each OU, and the default settings in the default policy - just like you said.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[whyguy]

In a simple domain structure it is common to create OU's for users and others for computers. Some do it by location, or in your case you could do it by department.

One of the primary reasons for OU's and segregating objects is to allow separate control and configuration of the objects in the OU. Also to segregate which Group Policies are applied to which OU's. Some GPOs apply to computers and some apply only to users. You will need to create your own GPOs except for the Default Domain Policy.

It should be safe for you to create additional OU's and drag and drop the objects into them.

You could have a Finance OU, and:
FINANCE
Users
Computers

You would then delegate authority to who you want to control the user objects, and who you want to manage the computer objects.

"Delegation" of permissions can be very granular so this is an area you need to look more into. Look for the "Delegation of Control Wizard" articles or help.

 

[karlisi]

By copying don't forget to set permissions for profile.
How to copy user profiles in Windows XP

http://www.petri.co.il/copy_user_profiles_in_windows_xp.htm

===
Karlis
ECDL; MCSA