I heard you loud and clear in my recent survey that maintaining Active Directory in a clean, organized and secure state is a real challenge. Indeed, I heard your pain so I’m going to start with user accounts. I have yet to do an audit where we didn’t find a significant (and frankly scary) amount of user accounts that no one could explain how and what they were for, how they got there and if they could be deleted. Not to mention dormant accounts, accounts of terminated admins which folks were afraid to delete, service accounts that didn’t look like they were being used, and the list goes on and on.
In this real-training-for-free™ session, I’ll show you scripts, reports and queries you can run against AD itself and against security logs to figure out the provenance, status and usage of user accounts so that you can figure out what can be deleted and what needs to be fixed.
Then, we’ll turn our attention on key best practices to keep user accounts clean, organized and secure going forward. I’ll discuss:
- Different methods for distinguishing between employees, contractors, service/application and shared accounts
- Practical ways to connect an employee’s HR record to their AD user account(s)
- The critical need for approvals and account owners and ways to implement this efficiently
- How to detect non-compliant accounts as soon as they are created
- Effective ways to handle necessary exceptions
- Reduce how many people can create new accounts in the first place
- Improving consistency through “template” accounts and PowerShell scripts
During my presentation, I will show you my very best options for accomplishing these tasks the DIY way and then I’ll ask Jonathan Sander to very briefly explain how Quest products can automate or often times eliminate the work altogether. I believe a lot of you out there are so busy that your organization can’t afford to have you managing AD the DIY/”poor admin’s” way. I think you’ll be suitably impressed. Either way, this will be real-training-for-free™ so don’t miss it!