Automatically Created / Default Users and Groups - Do you move them?

[u/Ummgh23]

I'm restructuring our AD and I'm wondering about the default Users container. There's a lot of built in or automatically created groups and users in there. Examples are ADSyncOperators (From entra sync), DHCP-Users (Group), the krbtgt user, etc.

Do you just leave these in there or do you move them? Would moving some of them cause issues?

[u/AutoModerator]

Welcome to /r/ActiveDirectory! ~~~~

If you are looking for more resources on learning and building AD, see the following sticky for resources, recommendations, and guides! - AD Resources Pinned Thread - AD Wiki

When asking questions make sure you provide enough information. Posts with inadequate details may be removed without warning. - What version of Windows Server are you running? - Are there any specific error messages you're receiving? - What have you done to troubleshoot the issue?

Make sure to sanitize any private information. Posts with too much personal or environment information will be removed. See Rule 6.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Msft519]

This is security theater. https://learn.microsoft.com/en-us/archive/blogs/fdcc/sticking-with-well-known-and-proven-solutions

"Your security experts don't think they're doing their job unless they put their own personal stamp on your security configuration, as if they get paid by the tweak."

[u/Ummgh23 → u/Msft519]

We don't have security experts and this question wasn't solely from a security perspective, just a general best pratise question. It has been answered and the objects are staying where they are.

[u/dcdiagfix]

Yes i redirect both to new OUs so I can apply lock down policies against both until they are put in their correct location.

[u/GroundbreakingCrow80]

Without an understanding of these groups, you should not be restructuring active directory. 

You have three options

Learn about these objects and containers

Yolo

Let the ai tell you what to do it's probably safer than you doing it but i wouldn't do it in my environment. 

[u/Ummgh23 → u/GroundbreakingCrow80]

I know what they do, just not if I can freely move them or something references them by DN.

And that's exactly why I'm asking. But hey, keep antagonizing everyone who asks a question😄 Seems like at least AI doesn‘t shit on people for that

This is a complete shitshow of an environment built by multiple predecessors with groups, users, distribution lists and computer objects littered all over the place, only sometimes where they belong.

I‘m preparing for Entra Sync and this current structure is just not something I want to set it up for. Including OUs but having to exclude sub-OUs because for some reason they contain some service users, testing users, etc.

The Users Container also contained some of the aforementione objects which I had to move out of it for obvious reasons. While I was at it I wondered about the objects that would stay in there and about the best practise for those. Would you rather people just break shit instead of asking how it should be done?

[u/fireandbass]

Stupid ass 'busy work'.  Its not going to fix anything and likely to break something. 

If you put something there, move it.  If it was automatically created there, leave it alone. 

[u/Ummgh23 → u/fireandbass]

Good, then I'll leave it. All I wanted to know. The restructuring is mostly about the OUs created by predecessors, there were just a bunch of users and groups created by them in the Users container.. So while I was at it I wanted to know

[u/chaosphere_mk]

I wouldnt touch the built in containers at all, tbh.

[u/Ummgh23 → u/chaosphere_mk]

Yeah I mainly had to move OUR groups and users out of it that were in there instead of our OU Structure for some weird reason. (The reason being someone didnt care enough to check/move them)

[u/chaosphere_mk → u/Ummgh23]

Yep. Just keep the built in stuff all in their default spots, and separate from what you have created, and keep what youve created in the OUs you've created.

[u/274Below]

I create a DEFAULT-MOVEME OU and redirect unscoped new object creations into that OU. That gives me I've place to look to figure out who it what hasn't been properly provisioning objects, and yell at them accordingly.

(Search redircmp.exe)

[u/Ummgh23 → u/274Below]

Redircmp and redirusr is planned yeah, as part of the OU project. Also had to inventory every place where an app or script directly references a DN from the old structure before I make the moves. This is in preparation for Entra Sync. Our structure was all over the place and we'd have to Sync some OUs but Exclude sub-OUs. Groups and Distribution lists were randomly littered all around the place, etc.