Manage Active Directory users on a domain controller

Filter accounts by status, create users and manage passwords on a domain controller.

On a Windows domain controller, octoja adds an Active Directory tab to the device detail page. It lists the domain's user accounts, computers, and groups as the agent last collected them — and it lets you work on the directory without opening a remote session: create a user, reset a user's password, disable a user, and change a group's members.

Before you start

The Windows device must run the octoja agent and its inventory must contain the NTDS service.
Your user account must belong to a group that grants the Active Directory device action for that device. Set it under Administration → Groups: open the group, go to its Device Access tab, and enable Active Directory under Allowed actions.
Editing groups — and therefore handing out that action — requires the Group Management permission. Permissions are assigned per group under Administration → Groups as well.
Without the Active Directory device action the tab is hidden completely: a user who may not manage the directory does not see the directory data either.
The device must be online for every action that changes the directory, and for the Manage members dialog, because those are sent to the running agent. Browsing the three collected lists works whether the device is online or not.

Open the tab

Go to Devices and open the domain controller.
Select the Active Directory tab. It sits between Services and Software in the tab strip.

Where the data comes from

The agent reads the directory as part of its regular inventory run — every one to three hours by default — using the Active Directory PowerShell module that ships with every domain controller. The lists are not queried live when you open the tab, so they are exactly as fresh as the last inventory report. The one exception is a group's Manage members dialog, which reads the group's direct members live from the domain controller.

The line above the tables says which: Last collected <date>, or Not collected yet when no report has arrived yet. Refresh now asks the device to run an inventory scan immediately and reloads the tab when it finishes. That button is the same mechanism as the manual inventory trigger, so it additionally needs the Run Maintenance device action.

What the tab shows

Three cards, one per object type. Each has its own search box, sortable columns, 25 rows per page, and an Export CSV entry in the … menu that writes whatever the search box currently narrows the list down to.

Card	Columns	CSV file
Active Directory Users	Username, Status, First Name, Last Name, UPN, Organizational Unit, Last Sign-In, Password Last Set. Email, Title, and Member Of start hidden — switch them on from the Columns entry in the … menu	`ad-users.csv`
Active Directory Computers	Name, DNS Host Name, Operating System, Organizational Unit, Last Sign-In, Status	`ad-computers.csv`
Active Directory Groups	Name, Category, Scope, Members, Organizational Unit, Description	`ad-groups.csv`

The Organizational Unit column shows an object's path inside the domain, outermost unit first and separated by slashes: an account in OU=IT,OU=Staff reads Staff/IT. The domain components are left off. Member Of lists group names only, and Members in the groups card is a plain member count.

Users and computers show Enabled or Disabled in the Status column. Choose either value in the Status filter above the corresponding table. You can combine it with text search; use X to clear it. The filter only limits displayed and exported entries and does not change directory accounts.

Create a user

Click Create user at the top right of the Active Directory Users card. The Create Active Directory user dialog opens.

Field	What to enter
First Name, Last Name	Optional. They fill the account's first-name and last-name attributes and, combined, become the object's name in the directory (its CN); if you leave both empty, the user name is used instead. octoja does not set the display-name attribute, so it stays empty
UPN	Required — for example `user@corp.local`. The part in front of the `@` becomes the account's user name
New password	Required. Pre-filled with a freshly generated password; use the circular-arrow button to generate another, or type your own
Organizational unit	Required. The picker lists the organizational units collected from the domain, with the first one pre-selected. Only organizational units are offered, so a new account always lands in one
Email, Title	Optional. Written to the account's mail and title attributes
Member of (groups)	Optional. A checkbox list of the domain's groups with its own search box. The list shows up to 200 groups at a time — type in the search box to reach the rest
User must change password at next sign-in	Ticked by default. Clear it to let the account keep the password you set

Click Create user. octoja creates the account in the chosen organizational unit, enables it, and adds it to the groups you ticked. On success you get Active Directory user '<name>' was created. and the list reloads. If the domain rejects the request — a password that fails the domain policy, a user name that already exists — the dialog stays open and octoja shows Could not create Active Directory user '<name>'. together with the domain controller's own error text.

Reset a password

Every row of the users table ends with two icon buttons. The key icon (tooltip Reset password) opens Reset password for "<user>".

The New password field is already filled with a generated password and shown in clear text. Use the eye button to hide or show it, the copy button to put it on your clipboard, and the circular-arrow button to generate a different one. You can also type your own.
Leave User must change password at next sign-in ticked to force a change at the next logon, or clear it.
Copy the chosen password and keep it securely before resetting it.
Click Reset password.

The dialog closes as soon as you click Reset password. After a successful reset, octoja confirms with Password for Active Directory user '<user>' was reset. The password cannot be shown again afterwards.

Disable a user

The second icon in the row (tooltip Disable user) asks Disable user "<user>"? and explains that the account will be disabled and the user can no longer sign in. Click Confirm to go ahead or Cancel to back out.

On success octoja reports Active Directory user '<user>' was disabled. and reloads the tab. The account is switched off on the domain controller straight away, but the table still shows it as enabled: the lists come from the last inventory report, so the Disabled badge only appears once fresh directory data arrives — click Refresh now if you want to see it immediately. The button is unavailable on accounts the table already shows as disabled.

What this tab covers — and what stays on the domain controller

The Active Directory tab covers four write operations: create a user, reset a user's password, disable a user, and manage a group's direct members: every row of the Active Directory Groups card ends with a people icon (tooltip Manage members) that opens the group's member list — add or remove users, groups and computers there. Deleting accounts, re-enabling a disabled account, and renaming or moving objects stay with the Active Directory tools on the domain controller itself, and the computers card is read-only; opening a terminal or a remote desktop session from the same device page is one way to get there.

Tips

Both password fields suggest a 16-character password mixing upper case, lower case, digits, and punctuation, with the easily confused characters I, l, 1, O, and 0 left out — safe to read aloud or dictate over the phone.
Every action is written to the device's activity log under the source Remote Action, successful ones with the account name — Active Directory user '<name>' was disabled. and so on. A failed creation is logged with the account name too, as Could not create Active Directory user '<name>'. plus the domain controller's error text; a failed password reset or disable is logged only as The Active Directory action failed. plus that error text, without the account name. Passwords are never written to the log.
Every action runs on the domain controller itself, under the octoja agent's own Windows service account. octoja never asks you for domain credentials and never stores any.
If octoja cannot add a newly created account to one of the groups you ticked, the account is still created. Click Refresh now afterwards and check the Member Of column to confirm the memberships took effect.
The directory actions report back within about half a minute. Refresh now is the exception: it runs a whole inventory scan and can take several minutes. If a domain controller is busy or the device drops offline mid-action, octoja tells you that the device is not connected, or that the action timed out and may still finish on the device — check the directory before you retry.
When the tables stay empty on a machine you know is a domain controller, the agent could not read the directory. Confirm the device is online and click Refresh now; the tab fills up once an inventory report with directory data arrives.

Was this helpful?

Still need help? Ask the team