> ## Documentation Index
> Fetch the complete documentation index at: https://docs.germainux.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Windows Active Directory User Management

> Create Active Directory users and groups that can be used to authenticate users and assign GermainUX Roles.

Service
`Authentication`

Availability
8.6.0 or later

> **[Active Directory Accounts](#create-active-directory-users-and-groups-that-can-be-used-to-authenticate-users-and-assign-germainux-roles)**
>
> Users and groups for roles

> **[Create Active Directory Groups](#create-active-directory-groups)**
>
> Build AD groups in server

> **[Create Active Directory Users](#create-active-directory-users)**
>
> Add users with initial passwords

> **[Add Users to Active Directory Groups](#add-users-to-active-directory-groups)**
>
> Assign users via Member Of

## Create Active Directory users and groups that can be used to authenticate users and assign GermainUX Roles.

Create Active Directory users and groups that can be used to authenticate users and assign GermainUX Roles.

This process allows organizations to:

* Manage GermainUX users through Microsoft Active Directory
* Authenticate users with their Windows credentials
* Assign GermainUX permissions through Active Directory groups
* Centrally grant or revoke access

> [!NOTE]
>
> **Note:** The Active Directory groups must correspond to Roles configured in GermainUX. This page explains how to create the required users and groups in Active Directory. For the GermainUX authentication-provider configuration, see [LDAP User Management](/main/ldap-user-management.md).

## Before You Begin

You need:

* Administrative access to Active Directory
* Administrative access to GermainUX
* The Active Directory domain and organizational unit in which the users and groups will be created
* The GermainUX Roles that must be mapped to Active Directory groups

The examples on this page use the following groups:

| Active Directory Group | Purpose |
| - | - |
| `germain_apm_admin` | Grants the corresponding GermainUX administrator Role. |
| `germain_apm_user` | Grants the corresponding standard GermainUX user Role. |

Use group names that match the Roles configured in your GermainUX environment.

## Create Active Directory Groups

On a Windows server with the Active Directory management tools installed:

1. Open **Server Manager**.
2. From the upper-right **Tools** menu, select **Active Directory Users and Computers**.

   ![Windows Active Directory User Management: Create Active Directory Groups](https://mintcdn.com/germain-ux/aRWpCtnP62NYAs5c/images/main/windows-active-directory-user-management/image-20230321-084431.png?fit=max\&auto=format\&n=aRWpCtnP62NYAs5c\&q=85\&s=6d1a727dbd6b679e9f868b3879ee8f3b)
3. In the left navigation panel, expand the appropriate domain.
4. Select the organizational unit in which the GermainUX groups will be maintained.
5. Right-click the organizational unit and select **New > Group**.
6. Enter the group name—for example, `germain_apm_admin`.

   ![Windows Active Directory User Management: Create Active Directory Groups, image 2](https://mintcdn.com/germain-ux/aRWpCtnP62NYAs5c/images/main/windows-active-directory-user-management/image-20230321-084330.png?fit=max\&auto=format\&n=aRWpCtnP62NYAs5c\&q=85\&s=57c27b180c8224fd419f5b9546133675)
7. Select the group scope and type required by your organization.
8. Click **OK**.
9. Repeat the procedure to create additional groups, such as `germain_apm_user`.

Ensure that every Active Directory group used for Role mapping has a corresponding Role in GermainUX.

To review GermainUX Roles, go to:

**Germain Workspace > Left Menu > System > Auth Settings > User Roles**

## Create Active Directory Users

If the required users do not already exist:

1. In **Active Directory Users and Computers**, select the organizational unit in which users are managed.
2. Right-click the organizational unit and select **New > User**.
3. Enter the user’s:

   ![Windows Active Directory User Management: Create Active Directory Users](https://mintcdn.com/germain-ux/aRWpCtnP62NYAs5c/images/main/windows-active-directory-user-management/image-20230321-084348.png?fit=max\&auto=format\&n=aRWpCtnP62NYAs5c\&q=85\&s=8202ecf5388a8075b004b032535c2c94)
4. Click **Next**.
5. Enter and confirm the initial password.
6. Configure the password options according to your organization’s security policy.
7. Click **Next**.
8. Review the user information.
9. Click **Finish**.
10. Repeat the procedure for each additional user.

* First name
* Last name
* User logon name

> [!NOTE]
>
> **Security recommendation:** Apply your organization’s standard password-expiration, complexity, and account-protection policies. Do not enable **Password never expires** unless your security policy explicitly requires it.

## Add Users to Active Directory Groups

After creating or identifying the required users and groups:

1. In **Active Directory Users and Computers**, locate the user.
2. Right-click the user and select **Properties**.
3. Open the **Member Of** tab.
4. Click **Add**.
5. Enter the Active Directory group name—for example, `germain_apm_admin`.
6. Click **Check Names** to verify the group.
7. Click **OK**.
8. Click **Apply**, and then click **OK** again.

   ![Windows Active Directory User Management: Add Users to Active Directory Groups](https://mintcdn.com/germain-ux/aRWpCtnP62NYAs5c/images/main/windows-active-directory-user-management/image2019-4-23_11-21-45.png?fit=max\&auto=format\&n=aRWpCtnP62NYAs5c\&q=85\&s=44164ee2286664ad8e1da78b605dc5c2)
9. Repeat the procedure for each user and required group.

For example:

| User Responsibility | Active Directory Group |
| - | - |
| GermainUX administrator | `germain_apm_admin` |
| Standard GermainUX user | `germain_apm_user` |

Assign users only to the groups required for their responsibilities.

## Configure Group-to-Role Mapping

GermainUX maps the user’s Active Directory group memberships to corresponding GermainUX Roles.

Confirm that:

* Each required Active Directory group has a matching GermainUX Role
* Group and Role names use identical spelling and capitalization
* Each GermainUX Role contains the appropriate permissions
* Users belong only to the groups required for their responsibilities
* The configured LDAP provider can retrieve the required users and groups

For instructions on configuring the authentication provider and group mapping, see [LDAP User Management](/main/ldap-user-management.md).

## Validate User Access

Test the integration with a non-administrator Active Directory account.

Confirm that:

* The user can log in with their Active Directory credentials
* Active Directory groups map to the expected GermainUX Roles
* The user can access only authorized GermainUX features
* The user can view only the permitted dashboards, data, and Session Replays
* Removing the user from an Active Directory group removes the corresponding GermainUX permissions
* Disabling the Active Directory account prevents access

## Revoke Access

To revoke a user’s GermainUX access:

1. Remove the user from the Active Directory groups mapped to GermainUX Roles, or disable the Active Directory account.
2. Confirm that the user can no longer access GermainUX.
3. Review any remaining Team assignments or active sessions when applicable.

Manage the user in Active Directory rather than creating or maintaining a separate GermainUX password.

## Get Help

> **[Contact GermainUX Support](/main/support.md)**
>
> The Germain Team can help you set this up.

> **Can't find what you need?**
>
> Search all GermainUX docs with **Ctrl + K**, or use the feedback buttons at the bottom of this page to tell us what is missing.

The content of this document is proprietary to GERMAIN SOFTWARE.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.