Breadcrumbs

Windows Active Directory User Management

🔑 Create Active Directory users and groups that can be used to authenticate users and assign GermainUX Roles.

Create Active Directory users and groups that can be used to authenticate users and assign GermainUX Roles.

☑️ This process allows organizations to:

  • Manage GermainUX users through Microsoft Active Directory

  • Authenticate users with their Windows credentials

  • Assign GermainUX permissions through Active Directory groups

  • Centrally grant or revoke access

Note: The Active Directory groups must correspond to Roles configured in GermainUX. This page explains how to create the required users and groups in Active Directory. For the GermainUX authentication-provider configuration, see LDAP User Management.

📋 Before You Begin

You need:

Requirement

Administrative access to Active Directory

Administrative access to GermainUX

The Active Directory domain and organizational unit in which the users and groups will be created

The GermainUX Roles that must be mapped to Active Directory groups

The examples on this page use the following groups:

Active Directory Group

Purpose

germain_apm_admin

Grants the corresponding GermainUX administrator Role.

germain_apm_user

Grants the corresponding standard GermainUX user Role.

Use group names that match the Roles configured in your GermainUX environment.

🛠 Create Active Directory Groups

On a Windows server with the Active Directory management tools installed:

  1. Open Server Manager.

  2. From the upper-right Tools menu, select Active Directory Users and Computers.

    image-20230321-084431.png

  3. In the left navigation panel, expand the appropriate domain.

  4. Select the organizational unit in which the GermainUX groups will be maintained.

  5. Right-click the organizational unit and select New > Group.

  6. Enter the group name—for example, germain_apm_admin.

    image-20230321-084330.png

  7. Select the group scope and type required by your organization.

  8. Click OK.

  9. Repeat the procedure to create additional groups, such as germain_apm_user.

Ensure that every Active Directory group used for Role mapping has a corresponding Role in GermainUX.

To review GermainUX Roles, go to:

Germain Workspace > Left Menu > System > Auth Settings > User Roles

👥 Create Active Directory Users

If the required users do not already exist:

  1. In Active Directory Users and Computers, select the organizational unit in which users are managed.

  2. Right-click the organizational unit and select New > User.

  3. Enter the user’s:

    image-20230321-084348.png

  4. Click Next.

  5. Enter and confirm the initial password.

  6. Configure the password options according to your organization’s security policy.

  7. Click Next.

  8. Review the user information.

  9. Click Finish.

  10. Repeat the procedure for each additional user.

Attribute

First name

Last name

User logon name

Security recommendation: Apply your organization’s standard password-expiration, complexity, and account-protection policies. Do not enable Password never expires unless your security policy explicitly requires it.

👥 Add Users to Active Directory Groups

After creating or identifying the required users and groups:

  1. In Active Directory Users and Computers, locate the user.

  2. Right-click the user and select Properties.

  3. Open the Member Of tab.

  4. Click Add.

  5. Enter the Active Directory group name—for example, germain_apm_admin.

  6. Click Check Names to verify the group.

  7. Click OK.

  8. Click Apply, and then click OK again.

    image2019-4-23_11-21-45.png

  9. Repeat the procedure for each user and required group.

For example:

User Responsibility

Active Directory Group

GermainUX administrator

germain_apm_admin

Standard GermainUX user

germain_apm_user

Assign users only to the groups required for their responsibilities.

🔗 Configure Group-to-Role Mapping

GermainUX maps the user’s Active Directory group memberships to corresponding GermainUX Roles.

Confirm that:

Check

Each required Active Directory group has a matching GermainUX Role

Group and Role names use identical spelling and capitalization

Each GermainUX Role contains the appropriate permissions

Users belong only to the groups required for their responsibilities

The configured LDAP provider can retrieve the required users and groups

For instructions on configuring the authentication provider and group mapping, see LDAP User Management.

✅ Validate User Access

Test the integration with a non-administrator Active Directory account.

Confirm that:

Validation

The user can log in with their Active Directory credentials

Active Directory groups map to the expected GermainUX Roles

The user can access only authorized GermainUX features

The user can view only the permitted dashboards, data, and Session Replays

Removing the user from an Active Directory group removes the corresponding GermainUX permissions

Disabling the Active Directory account prevents access

🚫 Revoke Access

To revoke a user’s GermainUX access:

  1. Remove the user from the Active Directory groups mapped to GermainUX Roles, or disable the Active Directory account.

  2. Confirm that the user can no longer access GermainUX.

  3. Review any remaining Team assignments or active sessions when applicable.

Manage the user in Active Directory rather than creating or maintaining a separate GermainUX password.

Service: Authentication

Feature Availability: 8.6.0 or later