# (Optional) Manage AD users and groups
<a name="tutorials_05_multi-user-ad-step2"></a>

In this step, you manage users and groups from an Amazon EC2 Amazon Linux 2 instance that's joined to the Active Delivery (AD) domain.

If you followed the *automated* path, restart and log in to the AD joined instance that was created as part of the automation.

If you followed the *manual* path, restart and log in to the instance that you created and joined to the AD in preceding steps.

In these steps, you use the [adcli](https://www.mankier.com/package/adcli) and [openldap-clients](https://www.mankier.com/package/openldap-clients) tools that were installed in the instance as part of a preceding step.

**Log in to an Amazon EC2 instance that is joined to the AD domain**

1. From the Amazon EC2 console, select the untitled Amazon EC2 instance that was created in previous steps. The instance state might be **Stopped**.

1. If the instance state is **Stopped**, choose **Instance state** and then **Start instance**.

1. After the status checks pass, select the instance and choose **Connect** and SSH in to the instance.

**Manage users and groups when logged into an Amazon EC2 Amazon Linux 2 instance that's joined the AD**

When you run the `adcli` commands with the ` -U "Admin"` option, you're prompted to enter the AD `Admin` password. You include the AD `Admin` password as part of the `ldapsearch` commands.

1. 

**Create a user.**

   ```
   $ adcli create-user {{"clusteruser"}} --domain {{"corp.example.com"}} -U "Admin"
   ```

1. 

**Set a user password.**

   ```
   $ aws --region {{"region-id"}} ds reset-user-password --directory-id {{"d-abcdef01234567890"}} --user-name {{"clusteruser"}} --new-password {{"new-p@ssw0rd"}}
   ```

1. 

**Create a group.**

   ```
   $ adcli create-group {{"clusterteam"}} --domain {{"corp.example.com"}} -U "Admin"
   ```

1. 

**Add a user to a group.**

   ```
   $ adcli add-member {{"clusterteam"}} {{"clusteruser"}} --domain {{"corp.example.com"}} -U "Admin"
   ```

1. 

**Describe users and groups.**

   Describe all users.

   ```
   $ ldapsearch "(&(objectClass={{user}}))" -x -h {{"192.0.2.254"}} -b "DC={{corp}},DC={{example}},DC={{com}}" -D "CN=Admin,OU=Users,OU={{CORP}},DC={{corp}},DC={{example}},DC={{com}}" -w {{"p@ssw0rd"}}
   ```

   Describe a specific user.

   ```
   $ ldapsearch "(&(objectClass={{user}})(cn={{clusteruser}}))" -x -h {{"192.0.2.254"}} -b "DC={{corp}},DC={{example}},DC={{com}}" -D "CN=Admin,OU=Users,OU={{CORP}},DC={{corp}},DC={{example}},DC={{com}}" -w {{"p@ssw0rd"}}
   ```

   Describe all users with a name pattern.

   ```
   $ ldapsearch "(&(objectClass={{user}})(cn={{user*}}))" -x -h {{"192.0.2.254"}} -b "DC={{corp}},DC={{example}},DC={{com}}" -D "CN=Admin,OU=Users,OU={{CORP}},DC={{corp}},DC={{example}},DC={{com}}" -w {{"p@ssw0rd"}}
   ```

   Describe all users that are part of a specific group.

   ```
   $ ldapsearch "(&(objectClass={{user}})(memberOf=CN={{clusterteam}},OU=Users,OU={{CORP}},DC={{corp}},DC={{example}},DC={{com}}))" -x -h {{"192.0.2.254"}} -b "DC={{corp}},DC={{example}},DC={{com}}" -D "CN=Admin,OU=Users,OU={{CORP}},DC={{corp}},DC={{example}},DC={{com}}" -w {{"p@ssw0rd"}}
   ```

   Describe all groups

   ```
   $ ldapsearch "objectClass={{group}}" -x -h {{"192.0.2.254"}} -b "DC={{corp}},DC={{example}},DC={{com}}" -D "CN=Admin,OU=Users,OU={{CORP}},DC={{corp}},DC={{example}},DC={{com}}" -w {{"p@ssw0rd"}}
   ```

   Describe a specific group

   ```
   $ ldapsearch "(&(objectClass={{group}})(cn={{clusterteam}}))" -x -h {{"192.0.2.254"}} -b "DC={{corp}},DC={{example}},DC={{com}}" -D "CN=Admin,OU=Users,OU={{CORP}},DC={{corp}},DC={{example}},DC={{com}}" -w {{"p@ssw0rd"}}
   ```

1. 

**Remove a user from a group.**

   ```
   $ adcli remove-member {{"clusterteam"}} {{"clusteruser"}} --domain {{"corp.{{example}}.com"}} -U "Admin"
   ```

1. 

**Delete a user.**

   ```
   $ adcli delete-user {{"clusteruser"}} --domain {{"corp.{{example}}.com"}} -U "Admin"
   ```

1. 

**Delete a group.**

   ```
   $ adcli delete-group {{"clusterteam"}} --domain {{"corp.{{example}}.com"}} -U "Admin"
   ```