LOGBOOK

HELP

Quiz Entry - updated: 2026.09.29

A new user is created in the OU Users/Privileged. Does the account have admin rights? Why or why not?

No. An OU is not a security principal and grants no rights; a new user is only a member of Domain Users until you add it to other groups.

Rights in Windows come from the account itself and from its group memberships, which end up in the logon token. Where the object sits in the OU tree does not appear in the token at all. The OU only decides which GPOs apply to the object and who may administer it.

So a user in an OU named Privileged is exactly as powerful as any other new user, namely an ordinary domain user. They become privileged only when added to a group that has rights (for example Domain Admins or a group placed in local Administrators via GPO).

Go deeper:

From Quiz: ISLAB / Access Management with Active Directory | Updated: Sep 29, 2026