AD Group Manager Web

AD Group Manager Web is a self-service web portal that lets department managers and team leaders manage their own Active Directory group memberships through a web browser — without needing ADUC, PowerShell, or IT admin privileges.

IT administrators maintain full control through an admin panel with audit logging, email notifications, configurable permissions, and field-level visibility settings. The application runs entirely on-premises on your own Windows Server with IIS.

---

How delegation works

AD Group Manager Web uses native Active Directory attributes to determine who can manage which groups. No schema extensions or custom attributes are required.

The application reads two standard AD attributes on each group object:

• managedBy — the built-in attribute that designates a single manager (user or group) for an AD group.
• msExchCoManagedByLink — a multi-valued attribute (originally from Exchange) that allows additional co-managers for a group.

When a manager logs in, the application queries Active Directory and automatically shows them only the groups they are authorized to manage. The manager never sees or interacts with groups outside their scope.

Three discovery methods

AD Group Manager Web finds managed groups using three methods:

1. Direct manager — UserA is set directly as the managedBy value on GroupA.

2. Group membership — UserA is a member of GroupB, and GroupB is set as the managedBy value on GroupA. All members of GroupB can manage GroupA.

3. Nested group inheritance — UserA is a member of GroupC, which is a member of GroupB (the manager group). UserA inherits management rights through the nested group chain.

This means you can delegate management to individual users, to a team (via a security group), or through nested group hierarchies — all using standard AD structures your organization likely already has in place.

For step-by-step instructions on configuring managers in Active Directory, see How to set up a manager.

---

Architecture overview

AD Group Manager Web is designed for simplicity and data sovereignty. The entire application runs on your infrastructure with no cloud dependencies.

Component	Technology
Web server	IIS on Windows Server
Application framework	ASP.NET Core (.NET 10)
Local database	SQLite (settings, audit logs, license data)
Authentication	AD credentials (Basic) or Windows Authentication (Kerberos)
AD communication	LDAP queries using System.DirectoryServices
Client requirements	Any modern web browser — no plugins or client software

There are no agents to install on domain controllers or member servers, no schema changes to Active Directory, and no data leaves your network. The SQLite database (adgm.db) stores only application settings, audit log entries, and license information — no Active Directory data is cached or replicated.

A typical deployment takes about 15 minutes: enable IIS, install the ASP.NET Core Hosting Bundle, run the installer, and configure a few lines in appsettings.json. See the Quick Start Guide or the full Installation instructions.

---

Key features at a glance

For group managers

• View managed groups — see all groups assigned to you via managedBy or msExchCoManagedByLink, with member counts and group details.
• Add and remove members — search Active Directory for users, groups, contacts, and computers, then add or remove them with a few clicks.
• Bulk operations — add or remove multiple members at once using semicolon-separated input.
• Multi-group add — select multiple groups and add the same members to all of them in a single operation.
• Time-limited memberships — grant temporary group access that expires automatically after a specified duration.
• Edit group and member properties — update fields like description, email, department, and job title (controlled by admin configuration).
• Export data — export group and member data to Excel (XLSX) or PDF format.
• Group discovery — find and request access to groups you don’t currently manage.

For IT administrators

• Admin panel — centralized configuration with sections for Settings, Fields, Audit Logging, License, Notifications, Interface Customization, Group Discovery, and Access Requests.
• Audit logging — every membership change, group edit, and member edit is logged with who made the change, when, and what was changed.
• Email notifications — instant alerts when members are added or removed, groups are edited, or user properties are modified. Configurable SMTP, recipients, and email templates.
• Scheduled reports — automated email reports summarizing group membership on a daily, weekly, or monthly basis.
• Access request workflow — users can discover and request access to groups, with manager approval/denial and full audit trail.
• Field-level control — choose exactly which Active Directory attributes are visible and which are editable for both groups and members.
• Search restrictions — configure minimum search query length, wildcard filtering, contain vs. starts-with matching, and exclude specific OUs from search results.
• OU-based access control — restrict which organizational units’ users can log in to the application.
• Branding and customization — set a custom application title, tagline, logos, background color, and footer text.
• Interface translation — translate all UI text to any language, with built-in French and German presets.
• Authentication options — choose between Basic authentication (AD username/password) or Windows Authentication (Kerberos SSO). See Authentication options.

---

System requirements

Requirement	Details
Operating system	Windows Server 2016 or later
Web server	IIS (Internet Information Services)
Runtime	ASP.NET Core 10 Hosting Bundle
Active Directory	Standard AD domain (no schema extensions needed)
Browser	Any modern browser (Chrome, Edge, Firefox, Safari)
Network	The server must be able to reach a domain controller via LDAP

For detailed installation steps, see the Installation guide.

---

Getting help

• Quick Start Guide — get up and running in 15 minutes.
• Troubleshooting — common issues and how to resolve them.
• Submit a support ticket — contact Albus Bit for help.
• Try the live demo — explore the application without installing anything.
• Start a free trial — download and evaluate with full features for 30 days.

AD Group Manager Web is developed and maintained by Albus Bit.