--- title: New Active Directory Integration features in Ubuntu 22.04 (part 3) – Privilege Management description: Learn how you can disable local administrator and assign privileges to Active Dreictory users and groups with ADsys and Ubuntu 22.04 url: https://canonical.com/blog/new-active-directory-integration-features-in-ubuntu-22-04-part-3-privilege-management?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Massimiliano Gori](https://canonical.com/blog/author/massigori "More about Massimiliano Gori") 17 June 2022 # New Active Directory Integration features in Ubuntu 22.04 (part 3) – Privilege Management [Identity Management](https://canonical.com/blog/tag/identity-management) [Ubuntu Desktop](https://canonical.com/blog/tag/ubuntu-desktop) --- Share the article Linux Active Directory (AD) integration is historically one of the most requested functionalities by our corporate users, and with Ubuntu Desktop 22.04, we introduced ADsys, our new Active Directory client. This blog post is part 3 of a series where we will explore the new functionalities in more detail. The latest [Verizon Data Breach report](https://www.verizon.com/business/resources/reports/dbir/) highlighted that leaked credential and phishing combined account for over 70% of the causes of cyberattacks. User management therefore plays a critical role in reducing your organisation attack surface. In this article we will focus on how Active Directory can be used to control and limit the privileges your users have on on their Ubuntu machines. While there are significant differences between how Windows and Linux systems perform user management, with ADsys we tried to keep the IT administrators’ user experience as similar as possible to the one currently available for Windows machines. You can find links to the other articles in the series below: * [Part 1: ADsys announcement](https://ubuntu.com/blog/new-active-directory-integration-features-in-ubuntu-22-04-part-1) * [Part 2: Group Policy Object support](https://ubuntu.com/blog/new-active-directory-integration-features-in-ubuntu-22-04-part-2-group-policy-objects) * [Part 4: Remote script execution](https://ubuntu.com/blog/new-active-directory-integration-features-in-ubuntu-22-04-part-4-scripts-execution) * [ADsys FAQ](https://ubuntu.com/blog/new-active-directory-integration-features-in-ubuntu-22-04-faq) ## User management on Linux Before discussing the new ADsys features it is important to understand the types of users available in Ubuntu and how privileges are managed in the operating system. There are three types of users in Ubuntu: * **SuperUser or Root User**: the administrator of the Linux system who has elevated rights. The root user doesn’t need permission to run any command. In Ubuntu the root user is available but disabled by default. * **System User:** the users created by installed software or applications. For example when we install Apache Kafka in the system, it will create the user account named “Apache” to perform application specific tasks. * **Normal User:** the accounts which are used by the users and have a limited set of permissions. Normal users can use **sudo** to run programs with the administrative privileges which are normally reserved to the root user. In order to guarantee the right balance between developer productivity and security it is important for IT administrators to have a centrally defined set of users who are able to execute privileges commands on a machine. A crucial step for this, and the primary driver behind the new feature, was the ability to remove local administrators and enable administrative rights based on Active Directory group membership. ## Managing Ubuntu users with Active Directory Active Directory Admin Center As discussed in [part 2](https://ubuntu.com/blog/new-active-directory-integration-features-in-ubuntu-22-04-part-2-group-policy-objects) of this blog series you need to import in Active Directory the administrative templates generated by the ADsys command line or available on the project [GitHub repository.](https://github.com/ubuntu/adsys/tree/main/policies) Once done, the privilege management settings are globally enforced machine policies that are available at Computer Configuration > Policies > Administrative Templates > Ubuntu > Client management > Privilege Authorization in your Active Directory Admin Center. By default members of the local sudo group are administrators on the machine. If the ocal User setting is set to  **Disabled** the sudo group members are not considered administrators on the client. This means that only valid Active Directory users are able to log in to the machine. Similarly it is possible to grant administrator privileges to specific Active Directory users and groups, or a combination of both. Using groups is an essential feature to allow you to securely manage administrators across machines, as privileged access reviews will be reduced to reviewing membership to a single or a few Active Directory groups. ## Additional resources and how to get the new features The features described in this blog post are available for free for all Ubuntu users, however you need an **[Ubuntu Pro](https://ubuntu.com/pro)** subscription to take advantage of the privilege management and remote scripts execution features. You can get a personal license free of charge using your Ubuntu SSO account. ADSys is supported on Ubuntu starting from 20.04.2 LTS, and tested with Windows Server 2019. We have recently updated the [Active Directory integration whitepaper](https://ubuntu.com/engage/microsoft-active-directory) to include a practical step by step guide to help you take you full advantage of the new features. If you want to know more about the inner workings of ADsys you can head to its [Github page](https://github.com/ubuntu/adsys) or read the [product documentation](https://github.com/ubuntu/adsys/wiki). If you want to learn more about Ubuntu Desktop, Ubuntu Advantage or our advanced Active Directory integration features please do not hesitate to [contact us](https://ubuntu.com/desktop/contact-us) to discuss your needs with one of our advisors. ## Find out more * [Ubuntu Desktop for organisations](https://ubuntu.com/desktop/organisations) * [Ubuntu compliance monitoring with Microsoft Intune](https://ubuntu.com/blog/ubuntu-compliance-monitoring-with-microsoft-intune) * [Improve your endpoint security with Ubuntu Pro](https://ubuntu.com/pro) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### How to manage Ubuntu fleets using on-premises Active Directory and ADSys](https://canonical.com/blog/manage-ubuntu-fleets-active-directory) The “hybrid fleet” is today’s reality: organizations diversify operating systems while Microsoft Active Directory (AD) remains the dominant identity “source of truth.” IT... [Massimiliano Gori](https://canonical.com/blog/author/massigori) 31 March 2026 [### Modern Linux identity management: from local auth to the cloud with Ubuntu](https://canonical.com/blog/modern-linux-identity-management-ubuntu) The modern enterprise operates in a hybrid world where on-premises infrastructure coexists with cloud services, and security threats evolve daily. IT administrators are tasked... [Massimiliano Gori](https://canonical.com/blog/author/massigori) 27 March 2026 [### Supporting more identity providers on Ubuntu with the new Authd OIDC broker](https://canonical.com/blog/more-identity-providers-ubuntu-generic-broker) Today we are announcing the general availability of the new generic OpenID Connect (OIDC) broker for Authd. With enterprises needing to centralise access management controls,... [Massimiliano Gori](https://canonical.com/blog/author/massigori) 2 March 2026 [### Arduino® VENTUNO™ Q is available for pre-order with Ubuntu pre-installed](https://canonical.com/blog/arduino-ventuno-q-is-available-for-pre-order-with-ubuntu-pre-installed) London, UK – August 25, 2026 – Following our initial collaboration announcement in March 2026, Canonical and Arduino (a subsidiary of Qualcomm Technologies, Inc.) are excited... [Canonical](https://canonical.com/blog/author/canonical) 25 August 2026