1. Ken 7 will create the users in the shop floor group folder in active directory users and computers. This way you know everything that relates to shop floor will be in the shop floor folder. 2. Password changes require very special semantics that are enforced by the server, and developers need to understand these semantics for password management applications to be successful. In order to try to facilitate the password management process, ADSI exposes two methods on the IADsUser interface: SetPassword and ChangePassword. SetPassword is used to perform an administrative reset of a user’s password and is typically performed by an administrator. Knowledge of the previous password is not required. ChangePassword is used simply to change the password from one value to another and is typically performed only by the user represented by the directory object. It does require knowledge of the previous password, and thus it takes the old and new passwords as arguments. 3. You need to create a new Active Directory domain and Create new user accounts for all users. Then you need to manually join these computers to the AD domain. Or you can script it using Netdom command. When you join computers to AD domain, users will get a new profile. If you are using Windows XP, you can use moveuser.exe to preserver these user profile. 4. Change The Account Name Change The Password (or Create A Password if the account does not currently have one) Remove The Password (if one is currently configured) Change The Account Type 5. Administrators can use access control to manage user access to shared resources for security purposes. In Active Directory, access control is administered at the object level by setting different levels of access, or permissions, to objects, such as Full Control, Write, Read, or No Access. Access control in Active Directory defines how different users can use Active Directory objects. By default, permissions on objects in Active Directory are set to the most secure setting. The elements that define access control permissions on Active Directory objects include security descriptors, object inheritance, and user authentication. Access control permissions are assigned to shared objects and Active Directory objects to control how different users can use each object. A shared object, or shared resource, is an object that is intended to be used over a network by one or more users and includes files, printers, folders, and services. Both shared objects and Active Directory objects store access control permissions in security descriptors.