Change a User's Primary Group

  • Article

Applies To: Windows Server 2008, Windows Server 2008 R2, Windows Server 2012

Membership in Account Operators , Domain Admins , or Enterprise Admins , or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at https://go.microsoft.com/fwlink/?LinkId=83477.

To change a user's primary group

  1. To open Active Directory Users and Computers, click Start , click Control Panel , double-click Administrative Tools , and then double-click Active Directory Users and Computers .

    To open Active Directory Users and Computers in Windows Server® 2012, click Start , type dsa.msc .

  2. In the console tree, click Users .

    Where?

    • Active Directory Users and Computers\ domain node \Users

    Or, click the folder that contains the user account.

  3. In the details pane, right-click the user that you want to change, and then click Properties .

  4. On the Member Of tab, click the group that you want to set as the user's primary group, and then click Set Primary Group .

Additional considerations

  • To perform this procedure, you must be a member of either the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

  • The user's primary group applies only to users who log on to the network through Services for Macintosh or who run Portable Operating System Interface for UNIX (POSIX)–compliant applications. Unless you are using these services, there is no need to change the primary group from Domain Users, which is the default value.

  • Setting the user's primary group membership to a value other than Domain Users may adversely affect performance because all users in the domain are members of Domain Users. If the user's primary group is set to another group, it may cause the group membership to exceed the supported maximum number of members.

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start , click Administrative Tools , and then click Active Directory Module for Windows PowerShell .

    To open the Active Directory module for Windows PowerShell in Windows Server 2012, open Server Manager , click Tools and then click Active Directory Module for Windows PowerShell .

    For more information, see Resolving a Primary Group ID (https://go.microsoft.com/fwlink/?LinkId=180669). For more information about Windows PowerShell, see Windows PowerShell (https://go.microsoft.com/fwlink/?LinkID=102372).

Additional references