Home · Lessons

Access management

How to manage AD group membership

Groups are how access is granted in Active Directory: shared folders, applications, VPN, and mailboxes are mostly controlled by group membership. Knowing what someone is in, and changing it carefully, is core help desk work.

1. Know what groups do

A group gives every member the same access. Add a user to the Finance group and they get what Finance gets. Remove them and it goes. Because one change can open or close a lot of doors, the request needs to say exactly what access is wanted, and who approved it.

2. Check current membership first

Before you change anything, list the groups the user is already in. It shows what they have, and it avoids adding something they already hold.

Get-ADPrincipalGroupMembership -Identity bshah

To go the other way and see who is in a group, ask the group. This is how you answer "who can open this mailbox?" or "who has access to this share?".

Get-ADGroupMember -Identity Shared-Mailbox-Nursing

3. Add a user to a group

Name the group and the member. Use the username, not the display name, because two people can share a name.

Add-ADGroupMember -Identity "Finance-Staff" -Members bshah

4. Remove a user from a group

Removal is the same shape. Remove only the groups the request names, since other groups may still apply.

Remove-ADGroupMember -Identity "Finance-Staff" -Members bshah

To remove every group, as in an offboarding, pipe the membership into the removal. Use that only when the user really is leaving.

Get-ADPrincipalGroupMembership -Identity cmendez | Remove-ADGroupMember -Members cmendez

5. Don't copy a colleague

"Give her the same access as Priya" sounds simple, but Priya may hold groups from an old role, or access she shouldn't have. Ask what the new person needs and who approves it, then grant exactly that. This follows the principle of least privilege: give the minimum access needed for the job.

The exception is when a manager has explicitly approved copying someone's access for a stated reason, such as covering a colleague's leave. Then it is fine to match their groups. Look at what the colleague holds first, write the approval and an end date in the ticket, and remove the access when the cover ends.

6. Check, then record

List the membership again to confirm the change, and ask the user to check that they can reach what they needed. Write the group, the approver, and the date in the ticket, so the change can be reviewed later.

Some groups are nested, which means a group can be a member of another group, so access can come from more than one place. Get-ADPrincipalGroupMembership shows direct memberships only, so check carefully before you conclude that a user does not have access.