> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/02-active-directory-basics/create-security-group.md).

# Create a Security Group

## Objective

Create a simple Active Directory security group and add `labuser01` as a member.

This introduces the idea of assigning access through groups instead of configuring permissions separately for every user.

## Create the Group

On `DC01`:

1. Open **Active Directory Users and Computers**.
2. Expand `zyberlab.test`.
3. Right-click **Lab Groups**.
4. Select **New → Group**.
5. Enter:

```
Group name: Lab Users Group
```

6. Keep **Group scope** as **Global**.
7. Keep **Group type** as **Security**.
8. Select **OK**.

## Add the User

1. Double-click **Lab Users Group**.
2. Open the **Members** tab.
3. Select **Add**.
4. Enter:

```
labuser01
```

5. Select **Check Names**.
6. Confirm the account resolves correctly.
7. Select **OK**.
8. Select **Apply** → **OK**.

## Verify from the User Account

Open:

**Lab Users → Lab User → Member Of**

You should see:

```
Lab Users Group
```

## What Happened?

The user is now a member of a security group.

Security groups can be used when assigning access to resources such as:

* shared folders
* applications
* systems
* administrative roles

The user does not receive administrative privileges simply because they belong to this lab group.

## Why Use Groups?

A common access-management pattern is:

```
User
  ↓
Security Group
  ↓
Permission to Resource
```

This is easier to understand and maintain than repeatedly assigning individual users directly to permissions.

## Security Relevance

Group membership is important from both an access-control and monitoring perspective.

Changes to sensitive groups, especially privileged groups such as **Domain Admins**, should be monitored carefully in real environments.

Later labs will examine the Windows security events generated when users are added to or removed from groups.

## Checkpoint

Confirm that:

* **Lab Users Group** exists in **Lab Groups**
* it is a **Global Security** group
* `labuser01` is a member
* the user has not been added to any privileged administrative group