How do you stop the wrong people from reading sensitive files on a server while letting the right ones in? That is the core problem user and group management solves, and it is a question the CompTIA Server+ SK0-005 exam will absolutely test. Without this skill, a server is just a locked box with no doorman.
Jump to a section
A simple way to picture User and Group Management
The apartment building's master key system determines exactly which doors each resident can open. This physical system maps directly to user and group management on a server. Each resident is a user account -- a unique identity with a username and password. Each apartment door is a resource like a file folder or printer. The master key itself is analogous to a group membership. A building manager creates a 'Maintenance Staff' group and gives one key that opens all utility closets. Any resident added to that group automatically gains access to those closets without needing a separate key for each door.
Similarly, a company's IT administrator creates a 'Finance' group in Active Directory. They assign permissions to the accounting folder to that group. Then they add user accounts for accountants to the group. Those accountants instantly have access. If a new accountant joins, the admin simply adds their user account to the 'Finance' group -- no need to fiddle with individual permissions. If an accountant leaves, removing them from the group revokes access everywhere. This centralised control prevents chaos. Just as a building manager would go mad handing out individual keys for every room, an IT pro relies on groups to manage hundreds or thousands of user accounts efficiently. The group is the master key that simplifies permission management.
User and group management is the process of creating, organising, and controlling identities and their access to resources on a server. It is the digital equivalent of issuing ID badges and assigning key cards in an office. Every operating system -- Windows Server, Linux, macOS -- has a built-in system for managing who can log in and what they can do once they are logged in. For the SK0-005 exam, you need to understand three environments: local directories, Microsoft Entra ID (formerly known as Azure Active Directory), and LDAP-based directories like OpenLDAP.
Let us start with the basics. A user account is a unique identity for a person or a service (like a backup program). Each user account has a username and usually a password or other authentication method. On a standalone server, user accounts are stored in a local database on that machine. When you create a local user, the operating system creates a Security Identifier (SID) in Windows or a User ID (UID) in Linux. That SID or UID is how the operating system tracks permissions. Every time a user tries to access a file, the system checks the file's Access Control List (ACL) to see if that user's SID is allowed.
Groups are collections of user accounts. Instead of assigning permissions to each individual user, you assign permissions to a group and then add users to that group. This is far more efficient. For example, if you have 50 salespeople and 30 engineers, you create a 'Sales' group and an 'Engineering' group. You give the Sales group read permission to the sales folder and the Engineering group write permission to the engineering folder. When a new salesperson joins, you just add their user account to the Sales group -- they inherit all the permissions of that group. When someone leaves, you remove their account from the group, and access is revoked everywhere.
Now, the SK0-005 exam distinguishes three directory types:
Local directories: These are databases stored on the server itself. They are simple and suitable for small environments with one or a few servers. Each server has its own set of user accounts and groups. There is no central management -- if you have 10 servers, you must create the same user on all 10 machines manually. This is a nightmare at scale.
LDAP directories: Lightweight Directory Access Protocol (LDAP) is a standard protocol for accessing and maintaining distributed directory information. OpenLDAP is a popular open-source implementation. LDAP directories store user and group information in a hierarchical tree structure, like an organisational chart. Applications and servers can query the LDAP directory to authenticate users. LDAP is often used in Linux/Unix environments.
Microsoft Entra ID: This is Microsoft's cloud-based identity and access management service. It is not just for Azure cloud resources; it can also authenticate users for on-premises applications, Microsoft 365, and other SaaS tools. In the exam, remember that Microsoft Entra ID is the modern name for what many still call Azure Active Directory. It uses groups in a similar way but adds cloud capabilities like conditional access policies and multi-factor authentication.
Why does this matter? Because controlling access is a fundamental security principle. The principle of least privilege says that users should have only the permissions they need to do their job, no more. User and group management is the tool that makes this principle practical. Without groups, you would have to set permissions on every folder for every user individually -- an administrative disaster. With groups, you can manage access at scale.
The process of managing users and groups involves several tasks: creating user accounts, resetting passwords, disabling accounts when employees leave, creating groups, adding or removing members, and setting group permissions on resources. In Active Directory, you also have Organisational Units (OUs) which are containers that help organise users and groups -- like departments in a company. OUs allow you to apply Group Policy Objects (GPOs) to enforce settings across a set of users or computers.
For the exam, you need to know the default groups in Windows Server: Administrators (full control), Users (standard rights), Guests (limited access), and Domain Admins (for domain controllers). In Linux, common groups are root (superuser), sudo (ability to run commands as root), and users (regular accounts). You must also understand the difference between a local group and a domain group. A local group exists only on one machine; a domain group exists in Active Directory and can be used across multiple servers in that domain.
Finally, the examiner expects you to know how to perform these tasks using the appropriate tools: in Windows, you might use Active Directory Users and Computers (ADUC) for domain accounts, or Local Users and Groups snap-in for local accounts. In Linux, you use commands like useradd, usermod, groupadd, and passwd. The exam will test your ability to choose the right tool for the scenario.
Plan Group Structure
Before creating any accounts, map out the departments, roles, and resource access needs. Decide which groups you need (e.g., Sales, Engineering) and whether they will be local, domain, or cloud-based. This planning avoids messy reorganisations later.
Create Groups
Using the appropriate tool (Active Directory Users and Computers for domain groups, lusrmgr.msc for local Windows, groupadd for Linux), create the security groups. Assign a descriptive name and, in Active Directory, set the group scope (Global, Domain Local, or Universal) according to the AGDLP rule.
Assign Permissions to Resources
On the shared folders, printers, or applications that need controlled access, grant permissions to the groups rather than individuals. For example, add the 'Sales_Group' with 'Modify' permissions to the Sales folder's ACL. This ensures that any future member automatically inherits the access.
Create User Accounts
For each person who needs access, create a user account with a unique username and a strong initial password. Set account properties like full name, department, and, in Active Directory, specify the OU where the object should reside for organisational purposes.
Add Users to Groups
Navigate to the user's properties and add them to the relevant groups (e.g., add a new sales hire to the Sales_Group). Alternatively, open the group's properties and add users there. The user now inherits all permissions assigned to that group.
Test Access and Document
Log in as the new user and verify they can access the intended resources and cannot access anything else. Document the group memberships and permissions in a change log or IT knowledge base for future reference.
Manage Lifecycle (Disable, Remove, Delete)
When an employee leaves or changes roles, disable their account first (or remove them from groups). Disabling the account prevents login while preserving the account for audit purposes. If needed, delete the account after a retention period.
Imagine you are a junior IT administrator at a medium-sized company called 'GreenLeaf Manufacturing' with 200 employees. You are handed a new Windows Server that will host a shared drive with departmental folders. Your task is to set up access so that only the appropriate staff can view or edit each folder. Here is exactly how you would use user and group management in a real business.
First, you plan the groups. You look at the company's organisational chart and identify the main departments: Sales, Marketing, Engineering, HR, and Finance. You decide to create a domain group for each department. In Active Directory Users and Computers (ADUC), you right-click on the 'Groups' container and create five new security groups: 'Sales_Group', 'Marketing_Group', 'Engineering_Group', 'HR_Group', and 'Finance_Group'. You set the group type to 'Security' (used for permissions) and the scope to 'Global' (usable within the domain).
Next, you create the shared folders on the server. For each department, you create a folder, e.g., D:\Shares\Sales, D:\Shares\Marketing, etc. Then you set permissions on each folder:
Right-click the Sales folder, go to Properties > Security > Edit.
Add the 'Sales_Group' and give it 'Modify' permission (read, write, delete).
Remove the default 'Users' group so that only Sales_Group members can access it.
Repeat for each department folder.
Now you need to add user accounts. You go back to ADUC, find the 'Users' container, and create a user account for each employee. For example, you create 'John.Doe' with a temporary password and set it to require a password change at next login. You fill in his name, email, and department.
Then you add John to the appropriate group. You open his properties, go to the 'Member Of' tab, click 'Add', and select 'Sales_Group'. John now has access to the Sales folder. You do this for all 200 employees, adding them to their respective department groups. If an employee works in multiple departments (e.g., a manager who oversees Sales and Marketing), you add them to both groups.
A few weeks later, Jane from Engineering leaves the company. You disable her user account immediately to prevent any access. Then you open her properties and remove her from the Engineering_Group. Even if her account were still enabled, removing her from the group revokes access to the Engineering folder. You also move her account to a 'Disabled Users' OU for record-keeping.
A new hire, Mike, joins Sales. You create his user account and add him to Sales_Group. Within minutes, he can access the Sales folder. No need to touch the folder permissions again.
Later, the company decides to give the HR team additional access to a new 'HR_Shared' folder. You create the folder and assign 'HR_Group' Modify permissions. Every HR member instantly has access because they are already in the group. This is the power of group-based management.
In a real environment, you would also use Organisational Units (OUs) to structure the users and groups by department or location, making it easier to apply policies (like password complexity rules) via Group Policy. But the core workflow remains the same: create groups, set permissions on resources, add users to groups. This is what an IT professional does daily.
The SK0-005 exam tests your knowledge of user and group management across three directory types: local, LDAP, and Microsoft Entra ID. Expect multiple-choice questions that describe a scenario and ask you to choose the correct tool or procedure. Here is what you need to focus on.
First, know the default groups and their permissions. In Windows Server, the key groups are:
Administrators: full control over the server.
Domain Admins: full control over the entire domain (only exists on domain controllers).
Users: standard user rights, cannot modify system settings.
Guests: very limited access, often disabled by default.
Backup Operators: can back up and restore files regardless of permissions.
Print Operators: can manage printers.
Second, understand the difference between local groups and domain groups. A local group exists only on one server. A domain group exists in Active Directory and can be used across all servers in the domain. For example, if you add 'Sales_Group' to the ACL of a folder on a file server, any member of that group (which is a domain group) can access it from any domain-joined computer. A local group only works on that specific machine.
Third, be clear on the three group scopes in Active Directory:
- Global groups: contain user accounts from the same domain; can be used across the forest. - Domain local groups: contain users and global groups from any domain; used to assign permissions on resources within the same domain. - Universal groups: contain users from any domain; used for permissions across multiple domains. The exam will test which scope to use for assigning permissions versus organising users. A common trap: they might ask whether you should create a global group and add it to a domain local group, or directly assign permissions to a global group. The correct pattern is: place user accounts into global groups, then place global groups into domain local groups, and assign permissions to the domain local group. This is the AGDLP rule (Accounts, Global, Domain Local, Permissions).
Fourth, know the principles of least privilege and role-based access control (RBAC). RBAC is a model where permissions are assigned to roles (groups) rather than individuals. The exam might ask you to identify the best way to grant a temporary worker access for two weeks. The correct answer is to create a group, assign the needed permissions, add the user to the group, and set an expiration on the group membership or account.
Fifth, be aware of common commands and tools for local management:
Windows: Local Users and Groups snap-in (lusrmgr.msc), net user, net localgroup commands, and Computer Management.
Linux: useradd, usermod, userdel, groupadd, groupmod, groupdel, passwd, and the /etc/passwd, /etc/shadow, /etc/group files.
Microsoft Entra ID: Microsoft Entra admin centre, Microsoft Graph PowerShell, and Azure CLI.
LDAP: ldapadd, ldapmodify, ldapdelete, and tools like Apache Directory Studio.
Sixth, watch out for traps about password policies. The exam may ask which setting controls complexity. Answer: Group Policy (or Password Settings Container in AD) sets minimum length, complexity requirements, and lockout thresholds. Local accounts can have separate policies via secpol.msc.
Seventh, understand the concept of a service account. A service account is a user account created specifically for running a service (like SQL Server or a backup service). These accounts often need high privileges but should not be used for interactive logins. The exam might ask why you should not give a service account interactive logon rights.
Finally, remember that Microsoft Entra ID is the current name. The exam might still use 'Azure Active Directory' in older questions, but the correct terminology in current CompTIA exams is 'Microsoft Entra ID'. Use it in your answers.
Traps to avoid:
Confusing local groups with domain groups.
Thinking that deleting a user account removes all their permissions -- it does not always clean up inherited permissions, but disabling the account is usually sufficient.
Assuming that built-in groups like 'Everyone' include anonymous users -- they do not, but 'Authenticated Users' does not include guests.
Forgetting that Linux uses UID and GID numbers; root is UID 0.
User accounts are unique identities for people or services; groups are collections of user accounts that simplify permission assignment.
Always apply the principle of least privilege: give users only the permissions necessary to perform their jobs.
In Windows, use the ADDLP (Accounts, Domain Local, Global, Permissions) or AGDLP pattern to structure group memberships correctly.
Microsoft Entra ID is the cloud-based identity service formerly known as Azure Active Directory; use this name in the exam.
Linux uses useradd, usermod, and userdel commands to manage local users; groups are managed with groupadd, groupmod, and groupdel.
Removing a user from a group immediately revokes all permissions that were granted via that group membership.
Built-in groups like Administrators, Domain Admins, and Backup Operators have special privileges that should be carefully guarded.
Organisational Units (OUs) help organise users and groups for easier management and policy application, but they are not security principals themselves.
These come up on the exam all the time. Here's how to tell them apart.
Local Group
Exists only on one machine
Cannot be used across multiple servers
Managed via Local Users and Groups or net localgroup
Domain Group
Exists in Active Directory forest
Can be used on any domain-joined computer
Managed via Active Directory Users and Computers
Global Group Scope
Can contain user accounts from the same domain only
Can be added to other groups (domain local or universal)
Used to organise users by job function
Domain Local Group Scope
Can contain users, global groups, and universal groups from any domain
Cannot be nested inside other domain local groups
Used to assign permissions to resources in the same domain
Security Group
Has a Security Identifier (SID) for permissions
Can be assigned to ACLs
Used for access control
Distribution Group
Does not have a SID
Cannot be assigned permissions
Used only for email distribution lists
Local User Account
Stored in the local SAM database on the server
Cannot be used for cloud services
No built-in multi-factor authentication
Microsoft Entra ID User Account
Stored in the cloud Microsoft Entra ID tenant
Can access Microsoft 365, Azure, and other SaaS apps
Supports conditional access and MFA
Mistake
If I delete a user account, all files owned by that user are automatically deleted too.
Correct
Deleting a user account does not delete their files. The files become orphaned and are assigned the owner's SID (a number) instead of a name. An administrator can adopt those files manually.
This mistake comes from confusing user accounts with their personal data. In many home operating systems, deleting a user profile also deletes their folder, but on a server, files are separate assets that persist.
Mistake
Adding a user to the Administrators group gives them the same permissions as the built-in Administrator account, no matter what.
Correct
Adding a user to the Administrators group gives them full administrative rights on that server, but the built-in Administrator account has some unique properties (e.g., cannot be locked out, can bypass certain restrictions). The rights are nearly identical, but there are subtle differences.
People assume all administrators are exactly equal, but the built-in Administrator account has special protections because it is the default recovery account.
Mistake
Groups in Active Directory are only used for file permissions.
Correct
Groups are used for many purposes: assigning permissions to files, printers, and applications; distributing email distribution lists (mail-enabled security groups); applying Group Policy settings via security filtering; and managing remote desktop access.
Beginners often think of groups solely for file access because that is the most visible use, but AD groups have broader roles.
Mistake
If a user is a member of multiple groups, they get the intersection of permissions (only what all groups allow).
Correct
Permissions are additive. If a user belongs to Group A (read) and Group B (write), they get both read and write -- the union of permissions. The exception is when a deny permission explicitly overrides allow.
People think of groups as restricting each other, but Windows and Linux combine permissions from all groups a user is in. This leads to accidentally giving too much access when users are added to multiple groups.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A local user account exists only on the computer where it is created. It can only log into that machine. A domain user account is stored in Active Directory (or Microsoft Entra ID) and can log into any computer that is joined to the domain, using a single username and password.
Use the 'useradd' command followed by the username. For example: 'sudo useradd jdoe'. Then set a password with 'sudo passwd jdoe'. You can also specify options like '-m' to create a home directory or '-G' to add the user to supplementary groups immediately.
A security group can be used to assign permissions to resources (it has a Security Identifier). A distribution group is used only for email distribution lists and cannot be assigned permissions. When managing access, always use security groups.
AGDLP stands for Accounts, Global groups, Domain Local groups, Permissions. It is a best practice for structuring group memberships in Active Directory. You place user accounts into global groups, then nest those global groups into domain local groups, and assign permissions to the domain local groups. This makes permission management scalable and easier to delegate.
Yes, you can rename a user account in both Windows and Linux. In Windows, use Active Directory Users and Computers or the 'net user /rename' command. In Linux, use 'usermod -l newname oldname'. Renaming preserves the SID or UID, so permissions and group memberships remain intact.
The 'Everyone' group includes all users who access the system, including guest and anonymous users. 'Authenticated Users' includes only users who have logged on with a valid username and password, excluding guests. For security, use 'Authenticated Users' rather than 'Everyone' to avoid granting access to unknown visitors.
You've finished User and Group Management. Continue through the SK0-005 study guide to build a complete picture of the exam.
Done with this chapter?