1.Practical implementation

📌 Implementation Steps :

Open Active Directory Users and Computers (ADUC).

Create a new organizational unit named "ITStaff".

Create a new user account for the IT team (ITStaff2, ITStaff1, AdminIT).

This is the OU in which the IT employee will be able to create users.

For example, I'll create an OU called Employees, which will be the place to create new accounts.

I will add the users who have the permissions to the OU named Employee.
I started choosing the tasks I wanted to do :
- ✅ Create, delete, and manage user accounts → (But here we only want to create, so we'll fix that later).
- ✅ Reset user passwords and force password change at the next logon.
Next > Finish

We need to block Delete permission :
- Right click on the OU → Properties.
- Security Tab → Advanced

Click Edit → Modify Permissions: - I'll leave Create User Objects and Write All Properties. - ✅ I'll reset the password. - ❌ I'll remove Delete and Delete Subtree.

I logged in on the machine joined to the WE.local domain using the AdminIT account
Open Active Directory Users and Computers (ADUC) (it will have limited permissions) :
- Open Settings → Apps → Optional features
- Click Add a feature → Turn on RSAT: Active Directory Domain Services and Lightweight Directory Tools
- But a problem occurred, so I had to remove the host from the NAT, and then I executed this command.

After the length is fixed, I will return the network to the post only and return the device to the Internet so that I can do what is required :

Open Active Directory Users and Computers via search or from Run :
We will try what we did :
- Creating a new user in the Employees OU → ✅Successful:
- Resetting an existing user's password →
- ✅ Successful :
- Attempting to delete a user →
- Attempting to create a group or modify OU permissions →
  
  - ❌ should be rejected

Abdelwahab Shandy Linkedin GitHub