[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 632
  • Last Modified:

Link or associate Active Directory user accounts to other user accounts ?

We have a Windows Server 2008 domain where we set up new business owners. Often times later on, they'll hire business managers and other staff of their own, and request new email accounts, etc. We create them as seperate accounts, organized into one of 3 OU's. Is there a good way to link or associate AD accounts to other specific AD accounts ? The main problem we're having is that we don't necessarily have a great record of these staff & manager accounts when a business owner terminates or leaves the system, and they become abandoned in our AD.

Thanks!

0
budgetblinds
Asked:
budgetblinds
  • 2
2 Solutions
 
sire_harveyCommented:
Several things you can do here. First of all should be a form the Business owners fill out to aquire a new User Account. That way you have a record of users coming in.
Second thing i would do is use the AD User account field "Managed By" and point it at that employee's manager.
Third thing i would do is have a form the Managers fill out when staff / contractors leave. That way you can disable the account and also have a record of the AD change.

It sounds more like a managerial process issue, than an IT issue.
0
 
budgetblindsAuthor Commented:
Appreciate the response, but we have forms in place for entering & exiting the system. Again, that only revolves around the business owners; not employees they hire after they are an owener. Legal & the forms only care about the people writing us checks; not their staff.

Was not aware of the "Managed By" capability in 2008 AD. I'll take a look at that. Was hoping for some kind of feature where I could link a few AD accounts together, then where one of the accounts couldn't be deleted without un-linking or deleting the other accounts as well.

Thanks
0
 
Mike KlineCommented:
After reading your response no way that I know of to do what you want  (can't delete User Object A unless User Account B is deleted first)

There are tools to try and identify old/abandoned accounts

Old computer by Joe Richards is a good one

http://www.joeware.net/freetools/tools/oldcmp/index.htm

Works with users with the -users switch.

We use it for computers and users.  We disable after 120 days and delete after 180.

Thanks

Mike
0
 
budgetblindsAuthor Commented:
Seems unfortunately there is no way to do exactly what we were hoping. Thanks for the suggestions.
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now