microsoft-365-l1-desktop-support-basic-permissions-via-ad-groups

Microsoft-365-L1-Desktop-Support-guide

This article is designed as a practical, Access-related issues are among the most common tickets handled by L1 Desktop Support. In most enterprise environments, access to shared folders, printers, and network resources is controlled through Active Directory Security Groups rather than individual user permissions.

This guide explains how L1 engineers should verify and manage basic permissions using AD groups before escalating.

I will write article on each topic for single single blog -

I’ll break into real helpdesk categories:

1. Unlock user
2. Reset password
3. Enable / Disable account
4. Create new user
5. Add user to group
6. Remove user from group
7. Check login issues
8. Move user to correct OU
9. Basic permission via groups

Today we will see step by step Account & License Management  

👥 SCENARIO — User Cannot Access Folder / Printer

 


🔎 Symptoms Observed


Users typically report:

• “Access Denied” while opening shared folder
• Unable to see mapped network drive
• Printer not visible or cannot print
• Shared drive missing after department change
• Application access denied

🎯 Root Cause (Common)

• In most cases, the issue is due to:
• User not added to correct Security Group
• User moved to new department but groups not updated
• Recent account creation without proper group membership
• Group membership change not refreshed

1️⃣ Step 1 — Verify User Group Membership

🖥 Using Active Directory Users and Computers (ADUC)

• Open ADUC
• Locate the affected user
• Right-click → Properties
• Go to Member Of tab
• Check if correct Security Group is listed

Example:

• Finance_Share_RW
• IT_Printer_Access
• Sales_NetworkDrive
• If group is missing → proceed to add.

2️⃣ Step 2 — Add User to Correct Security Group

• If access is confirmed via group-based model:
• In Member Of tab → Click Add
• Enter Group Name
• Click Check Names
• Click OK
• Apply → OK
• Always confirm exact group name before adding. Avoid guessing.

3️⃣ Step 3 — Inform User (Policy Refresh)

• After adding user to group:
• User must:
• Log out and log back in
• Or run gpupdate /force (if required)
• Restart system if necessary
• For printer issues:
• Remove and re-add printer
• Refresh print spooler if required
• Group membership changes require session refresh to apply new token permissions.

4️⃣ Important Understanding (Token Refresh Concept)

• When a user logs in, Windows generates a security token containing group memberships.
• If you add a group:
• It will not apply until next login session
• VPN users must reconnect
• RDP sessions may require restart
• This is a key concept in AD-based permission management.

🚨 Escalate If

• Escalate to L2 / Server Team if:
• NTFS permissions missing on folder
• Share permissions incorrectly configured
• Server-level restriction issue
• DFS replication issue
• Printer server permission problem
• Group exists but not granting access
• L1 should only manage group membership, not modify server NTFS permissions unless authorized
• 🧠 Real Helpdesk Insight

Best practice in enterprises:


❌ Do NOT assign permissions directly to users
✔ Always assign permissions to groups
✔ Add users to groups

This follows the AGDLP Model:

Accounts → Global Groups → Domain Local Groups → Permissions

Understanding this model makes you stronger in interviews.

✅ L1 Checklist (SOP Format)

• ✔ Ticket verified
• ✔ Resource name confirmed
• ✔ Correct group identified
• ✔ User group membership checked
• ✔ User added to group
• ✔ User re-logged
• ✔ Access tested
• ✔ Escalated if NTFS issue

🎯 Interview-Ready Answer

If interviewer asks how you handle folder access issues:

“First, I verify whether access is group-based. I check the user’s group membership in ADUC under the Member Of tab. If the required security group is missing, I add the user to the correct group and ask them to log out and log back in for token refresh. If the issue persists and appears to be an NTFS or server-level permission problem, I escalate to the server team.”

Disclaimer