Active Directory Management: Keep Logins, Access, and Control in Order

A staff member left eight months ago. Is their account still switched on, and can it still reach the shared drive?

For plenty of Christchurch and Dunedin businesses, nobody can answer that with confidence. Accounts pile up, access gets granted and never removed, and no single record shows who can open what. This is exactly what Active Directory management is meant to prevent, and letting it slide is how a working directory turns into a security problem.

This guide covers what Active Directory management actually involves, how security groups and group policy keep access tidy, and how proper joiner-mover-leaver handling closes the gaps that leave old accounts live. It sits alongside the wider question of identity and access management, which explains the principles this article puts into practice.

What Is Active Directory Management?

Active Directory management keeps the directory that holds every staff login accurate and under control as your business changes. In practice it means creating and disabling user accounts, organising staff into security groups, applying group policy, and keeping each person’s access matched to what their role actually needs.

Active Directory is the Microsoft directory that most New Zealand businesses run, either on a Windows server on site, through its cloud counterpart Entra ID (formerly Azure AD), or a hybrid of both. It decides whether a login works, which files and applications open, and what a person can change. Left unmanaged, it drifts: accounts multiply, groups sprawl, and access no longer reflects who does what. A typical thirty-person business can easily end up with fifty or more accounts once contractors, service accounts, and forgotten ex-staff logins are counted, and only a handful of people know which are which.

A well-run directory describes your business as it is today. A neglected one describes it as it was two years ago, and it widens your attack surface every time someone joins, changes role, or leaves. Because that drift is invisible day to day, businesses often assume their Active Directory management is fine right up until an incident or an audit proves otherwise.

Active Directory or Entra ID?

Active Directory traditionally runs on a server in your building, while Entra ID is the cloud directory behind Microsoft 365 sign-ins. Many South Island businesses now run both, with accounts synchronised between them so one identity works everywhere. The Active Directory management principles are the same across both, and a good provider treats them as one directory instead of two disconnected systems. For a business already invested in Microsoft 365, the cloud side is often where most day-to-day identity work now happens, though the on-site directory still governs local servers and older line-of-business applications.

What Does Active Directory Management Cover?

Active Directory management covers five core areas: user accounts, security groups, group policy, access permissions, and the joiner-mover-leaver changes that keep all of them current. Each one is a routine task on its own, but together they decide how secure your business is and how quickly you can answer the question of who can reach what.

User Accounts

User accounts are the individual logins that identify each staff member to your systems. Managing them means creating an account when someone starts, keeping their details accurate, resetting credentials safely, and disabling the account the day they leave. An account that lingers after someone has gone is one of the most common weak points a directory has.

Naming and structure matter more than they first appear. A directory where accounts follow a clear, consistent format and sit in sensible organisational units is one an administrator can read at a glance. A directory full of one-off account names, shared logins, and test accounts nobody remembers creating is one where a real problem can sit unnoticed for months. Get account management right and the rest of the directory is far easier to keep in order.

Security Groups

Security groups bundle staff together so access is granted to the group, not to one person at a time. A finance group can be given access to the accounting folders once, and every finance staff member inherits it. When someone moves teams, you change their group membership instead of hunting through dozens of individual permissions, which is faster and far less error-prone.

The discipline that makes groups work is granting each one access to the least a role needs, an approach known as least privilege. A well-built directory has a group for each function, such as finance, sales, or reception, and staff belong only to the groups their job requires. When access is handed out ad hoc to individuals instead, the picture becomes impossible to read, and no one can say with certainty what a given login can reach.

Group Policy

Group policy applies consistent rules across every machine and account in the directory, from password requirements to screen-lock timeouts to which settings staff are allowed to change. Instead of configuring each computer by hand, one policy pushes the same standards everywhere. This is how a business enforces its security baseline without relying on staff to remember it.

The practical value shows up when something needs to change quickly. If a security requirement tightens, or an insurer asks for a specific control, a single policy update reaches every device at once. Businesses without this find themselves visiting each machine or emailing staff instructions and hoping they follow them, which is slow and never fully reliable. In cloud-first environments, the equivalent controls live in Entra ID and are applied to devices in much the same way.

How Does Joiner-Mover-Leaver Work in Active Directory?

Joiner-mover-leaver is the process of changing directory access at the three moments it matters: when someone starts, when they change role, and when they leave. Done properly, it means new staff have exactly the access they need on day one, role changes update access instead of stacking it, and departing staff lose access the moment they walk out. Each moment is a decision point, and skipping any one of them is how a directory slowly loses touch with the business it is supposed to describe.

The joiner step is where directory work meets the wider employee IT onboarding process. At the Active Directory management level it means creating the account, adding the person to the right security groups for their role, and confirming their sign-in works across the systems they need before their first morning.

The mover step is the one most businesses skip. When someone shifts from sales to operations, the tidy approach is to remove the sales groups and add the operations ones. What usually happens instead is the new access gets added and the old access stays, so over a few years long-serving staff accumulate permissions far beyond their current job. That build-up is exactly what an attacker hopes to find on a compromised account, because a single stolen login then opens far more doors than it should.

This matters most for the people who have been around longest, who tend to have moved roles several times and often hold the widest access as a result. A long-serving office manager who has covered for finance, reception, and HR over the years can end up able to reach almost everything, purely because no one ever took the old access away. Reviewing those accounts is usually where an Active Directory management clean-up delivers the biggest security gain.

The leaver step is the part of Active Directory management that causes the sharpest security gaps. The day a person leaves, their account should be disabled and their access revoked, not left active in case someone needs their files later. A directory full of enabled ex-staff accounts is an easy target, and it is the single issue we most often find when we first review a new client environment.

Why Stale Accounts Are a Real Risk

Stale accounts are dormant logins for people who have left or changed roles, and they are dangerous because nobody is watching them. Since no current staff member uses the account, unusual activity goes unnoticed, and the credentials are often reused, weak, or exposed in an old breach. Disabling accounts promptly removes that risk entirely, which is why prompt leaver handling counts as a genuine security control and not mere admin housekeeping. A quick count of enabled accounts against your current headcount is often the fastest way to see whether your directory has a problem.

What Does an Unmanaged Directory Cost a Business?

An unmanaged directory costs a business in security exposure, wasted time, and failed audits. When accounts and permissions are not maintained, ex-staff logins stay live, access no longer matches roles, and no one can produce a clear picture of who can reach what. Those gaps stay invisible until an incident or an audit forces them into the open.

An unmanaged directory carries dormant accounts, over-shared access, and no clear structure, so a single compromised login can reach far more than it should. A managed directory keeps accounts current, applies least-privilege security groups, and holds a tidy structure, so access reflects the business as it is today and any review can be answered quickly.

The Audit and Compliance Angle

Many South Island businesses now face client or insurer questions about who can access sensitive data. Good Active Directory management answers those questions in minutes, because group membership and permissions are the record. Directory administration also underpins device control through Microsoft Intune, so identity and the machines staff sign in on are governed together instead of in separate silos.

Should You Manage Active Directory In-House or Outsource It?

Most businesses should outsource Active Directory management unless they have both the in-house expertise and the time to keep it current every single week. Active Directory rewards steady, consistent attention and suffers when it is neglected, so the real question is whether it will keep getting done week after week when everyone is busy, even after the initial tidy-up is complete.

Smaller businesses rarely have a dedicated person for this, so directory tasks land on whoever is most technical and get squeezed out by day-to-day work. That is how things fall behind: leaver accounts go undisabled and group membership drifts. A larger organisation with its own IT team may handle Active Directory management internally, but even then an outside review is worth it to catch the access sprawl that internal teams stop noticing. The people who built the directory are often the least able to spot where it has drifted out of shape, simply because they are too close to it.

For most Christchurch and Dunedin businesses, folding directory administration into managed IT services is the practical answer. It means account changes, group hygiene, and leaver disabling happen as routine scheduled work, not a task someone remembers to do eventually, and it keeps the directory tied into the rest of your Microsoft 365 environment.

What Good Management Looks Like Day to Day

Well-run Active Directory management is easy to miss because it just works. Accounts are created before new staff start and disabled the day they leave, group membership is reviewed on a schedule instead of being left to accrete, and access is granted to the least a role needs, not the most it might use. When those habits are in place, the directory stops being a source of risk and becomes something you can point an auditor at with confidence.

Picture a Canterbury business that hires a new accounts administrator on a Monday. With a managed directory, the account exists on Friday, sits in the finance and general-staff groups, and signs in cleanly to the accounting system and email on the first morning. When a colleague moves from reception to operations a month later, the reception access comes off as the operations access goes on. When someone resigns, their login is closed before they have left the building. It is all routine, and that is what keeps the directory in step with the business instead of leaving someone to firefight later.

Get Your Directory Under Control

Exodesk manages Active Directory and Entra ID for businesses across Christchurch, Dunedin, and the wider South Island, keeping accounts current, access tidy, and ex-staff logins closed. We start with a review of your existing directory and show you exactly where the gaps are.

Contact us today to discuss how we can help your business or connect with us on LinkedIn to stay updated with more insights.

Frequently Asked Questions

What is Active Directory management?

Active Directory management means keeping the Microsoft directory that governs staff sign-ins and permissions properly maintained over time. The work involves opening and closing user accounts, sorting people into security groups, applying group policy, and updating who can reach what as roles change. Handled consistently, it keeps a business secure and auditable instead of letting access drift out of date.

What is the difference between Active Directory and Entra ID?

Active Directory is the traditional Microsoft directory that runs on a server on site, while Entra ID (formerly Azure AD) is the cloud directory behind Microsoft 365 sign-ins. Many businesses now run both, synchronised so one identity works across on-premises systems and cloud apps. The Active Directory management approach is the same for each, and they are best handled as a single directory.

Why are ex-staff accounts a security risk?

Ex-staff accounts are a security risk because they stay live and unwatched after someone leaves. Nobody uses the account day to day, so unusual activity goes unnoticed, and the credentials are often weak or already exposed in a breach. Disabling accounts the day a person leaves removes that risk entirely.

What are security groups used for?

Security groups bundle staff together so access is granted to the group, not to each person individually. A finance group can be given access to accounting folders once, and every member inherits it automatically. Managing membership at the group level is faster than editing individual permissions and far less prone to error.

What is group policy in Active Directory?

Group policy applies consistent settings and rules across every account and machine in the directory at once. It can enforce password requirements, screen-lock timeouts, and which settings staff are allowed to change, all from one place. This lets a business enforce a security baseline without configuring each computer by hand.

What does joiner-mover-leaver mean?

Joiner-mover-leaver describes changing directory access at the three key moments in a staff member’s time with a business: starting, changing role, and leaving. Joiners get the right access on day one, movers have old access removed as new access is added, and leavers lose access immediately. Handling all three properly keeps permissions accurate and closes security gaps.

How does Active Directory management improve security?

Active Directory management improves security by keeping accounts current, access matched to roles, and ex-staff logins closed. It applies least-privilege group membership so a compromised account can reach only what that role needs, and it removes the dormant accounts attackers look for. The result is a smaller attack surface and a directory that can be audited quickly.

Should a small business outsource Active Directory management?

Small businesses usually benefit from outsourcing Active Directory management because they rarely have a dedicated person to keep the directory current every week. When directory tasks land on whoever is most technical, they get squeezed out by day-to-day work, and leaver accounts and group hygiene fall behind. A managed provider makes those tasks routine rather than something someone remembers to do.

How much does Active Directory management cost?

Active Directory management is usually delivered as part of a managed IT services plan rather than a standalone line item, so the cost sits within a fixed monthly fee based on user or device numbers. This covers routine account changes, security group hygiene, group policy, and leaver disabling as ongoing work. A provider can give a clear monthly figure after reviewing the size and state of your existing directory.

How often should directory access be reviewed?

Directory access should be reviewed regularly, with a full check of accounts and group membership at least every few months and immediate updates whenever someone joins, moves, or leaves. Regular reviews catch the access sprawl that builds up as staff change roles over time. Many businesses combine this with an annual audit to satisfy client or insurer requirements.

Does Exodesk manage Active Directory for Christchurch and Dunedin businesses?

Exodesk manages Active Directory and Entra ID for businesses across Christchurch, Dunedin, and the wider South Island. Directory administration is included as part of managed IT services, covering account changes, security group hygiene, group policy, and prompt leaver disabling. Engagements typically begin with a review of the existing directory to identify stale accounts and access gaps.