Home · Lessons

Account lifecycle

How to handle a department transfer in Active Directory

When someone moves to another department, their account has to move with them. The risk is leaving the old department's access in place, so the person quietly keeps access they no longer need. This lesson covers the order of steps, and what to keep.

1. Confirm who is moving, and where

Get the name, the old and new department, the start date, and who approved the move. Then check you have the right account. Two employees can share a name, and one of them may already work in the department being moved to. Search by name and compare the department on each result.

Get-ADUser -Filter "Name -eq 'Rosa Wilson'"

If two accounts come back, use the username and department from the ticket to pick the right one. If the ticket does not say, ask.

2. Move the account to the new OU

Organisational units, or OUs, group accounts by department. Move the account into the new department's OU.

Move-ADObject -Identity rwilson -TargetPath OU=Nursing,OU=Staff

The lab simplifies this command so you can use a short account name. In a real domain, Move-ADObject needs the account's full distinguished name as the identity, and a full distinguished name, including the DC= parts, as the target path. Look the account up first and copy its distinguished name.

3. Swap the department groups

Access usually comes from groups. Remove the person from the old department's group and add them to the new one.

Remove-ADGroupMember -Identity Pharmacy-Staff -Members rwilson
Add-ADGroupMember -Identity Nursing-Staff -Members rwilson

In a real domain, removing a group member asks you to confirm each time unless you add -Confirm:$false. The lab does not prompt.

4. Keep what still applies

Not every group belongs to a department. A building badge, for example, applies to all staff and should stay. Check the person's groups before removing anything, and remove only the ones tied to the old department. Removing everything is the offboarding process, and a transfer is not the same thing.

Get-ADPrincipalGroupMembership -Identity rwilson

5. Handle a handover period

Sometimes the old department asks for access to continue for a short time while the person finishes a handover. That is a reasonable request, but it needs an end date. Add the group back, write the end date in the ticket, and set a reminder to remove it. Temporary access that nobody remembers to end becomes permanent.

6. Record the change

Note who asked, who approved, the old and new department, the groups removed and added, anything kept on purpose, and any end date. A clear record helps when someone later asks why a person has, or has not got, a particular access.

What about cloud accounts?

In Microsoft Entra ID the same idea applies, with different tools. Some organisations also use rules that update group membership automatically from a person's department, so a transfer changes access without manual steps. This lesson covers manual changes in the on-premises directory.