本頁面將解答有關 Google Cloud的 Managed Service for Microsoft Active Directory 的常見問題。
我可以使用哪個使用者帳戶管理受管理的 Microsoft AD？
建立新網域時，受管理的 Microsoft AD 會自動建立委派管理員帳戶。您可以使用這個使用者帳戶管理網域中的 Active Directory 物件。委派的管理員帳戶沒有「網域管理員」和「企業管理員」權限，因為受管理的 Microsoft AD 是受管理的服務，Google 保留使用這些權限的權利。
委派管理員帳戶有哪些功能？
委派的管理員帳戶具有執行特定管理活動清單的權限，以便管理 Active Directory 物件。委派的管理員帳戶沒有執行任何其他管理活動的權限。舉例來說，委派的管理員無法建立及管理網域層級政策，也無法執行管理作業，例如使用標準 AD 工具備份及還原網域，以及擴充結構定義。詳情請參閱「委派管理員」。
不過，您可以透過 Managed Microsoft AD 使用這些功能。只要使用者具備備份及還原網域和擴充結構定義的必要權限，即可啟動這些工作。
根據預設，受管理的 Microsoft AD 會建立 Cloud Service Default
Computer PolicyGPO 和其他預設 Active Directory 物件，並將其連結至 Cloud OU。如果您需要其他 GPO，可以建立自訂 GPO，並將其新增至 Cloud OU 或您在 Cloud OU 下建立的任何其他自訂 OU。如要進一步瞭解如何管理這些物件，請參閱「管理 Active Directory 物件」。
如何部署網域控制站？
受管理的 Microsoft AD 會在專屬的
虛擬私有雲 (VPC) 網路中，以 VM 形式建立網域控制器。接著，代管的 Microsoft AD 會使用 VPC 網路對等互連，將網域控制器 VPC 網路連線至其他現有的 VPC 網路。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Common questions\n\nThis page provides answers to some common questions about Google Cloud's\nManaged Service for Microsoft Active Directory.\n\nWhich user account can I use to administer the Managed Microsoft AD?\n--------------------------------------------------------------------\n\nWhen you create a new domain, Managed Microsoft AD automatically creates a\n[delegated administrator\naccount](/managed-microsoft-ad/docs/how-to-use-delegated-admin). You can use\nthis user account to manage the Active Directory objects in your domain. The\ndelegated administrator account doesn't have the Domain Administrator and\nEnterprise Administrator permissions, because Managed Microsoft AD is a\nmanaged service and Google reserves the right to use these permissions.\n\nWhat are the capabilities of a delegated administrator account?\n---------------------------------------------------------------\n\nThe delegated administrator account has the permissions to perform a specific\nlist of administrative activities to manage the Active Directory objects. The\ndelegated administrator account doesn't have the permissions to perform any\nother administrative activities. For example, a delegated administrator can't\ncreate and manage the domain-level policies, and it can't perform administrative\ntasks such as backing up and restoring domains and extending the schema using\nthe standard AD tools. For more information, see [Delegated\nadministrator](/managed-microsoft-ad/docs/objects#delegated_administrator).\n\nHowever, you can use these features through Managed Microsoft AD. Any user\nwho has the necessary permissions to [back up and restore a\ndomain](/managed-microsoft-ad/docs/backup-restore#before_you_begin) and [extend\nthe schema](/managed-microsoft-ad/docs/extend-schema#before_you_begin) can\ninitiate these tasks.\n\nHow can I manage organizational units (OU)?\n-------------------------------------------\n\nWhen you create a new domain, Managed Microsoft AD automatically creates\nthe `Cloud` and `Cloud Service Objects` OUs along with other [default Active\nDirectory objects](/managed-microsoft-ad/docs/objects). For more information\nabout managing these objects, see [Manage Active Directory\nobjects](/managed-microsoft-ad/docs/manage-active-directory-objects).\n\nHow can I manage group policy objects (GPO)?\n--------------------------------------------\n\nBy default, Managed Microsoft AD creates the `Cloud Service Default\nComputer Policy` [GPO](/managed-microsoft-ad/docs/objects#group_policy_objects)\nalong with other [default Active Directory\nobjects](/managed-microsoft-ad/docs/objects) and links it to the `Cloud` OU. If\nyou need additional GPOs, you can create custom GPOs and add them to either the\n`Cloud` OU or to any other custom OUs that you have created under the `Cloud`\nOU. For more information about managing these objects, see [Manage Active\nDirectory objects](/managed-microsoft-ad/docs/manage-active-directory-objects).\n\nHow are domain controllers deployed?\n------------------------------------\n\nManaged Microsoft AD creates domain controllers as VMs in dedicated [Virtual Private Cloud (VPC)](/vpc/docs/overview) networks. Managed Microsoft AD then\nconnects the domain controller VPC networks to your other\nexisting VPC networks using [VPC Network Peering](/vpc/docs/vpc-peering).\n\nFor more information, see [Deploy an Active Directory resource forest](/managed-microsoft-ad/docs/part-1-deploy-active-directory).\n\nWhat are the supported Windows and Linux versions that I can join to a domain?\n------------------------------------------------------------------------------\n\nFor information about the supported Windows and Linux versions that you can join\nto a domain, see [Compatible OS\nversions](/managed-microsoft-ad/docs/os-versions).\n\nWhen I create a new Managed Microsoft AD domain, how can I select the suitable IP address range?\n------------------------------------------------------------------------------------------------\n\nManaged Microsoft AD requires a minimum of a /24 private [RFC\n1918](https://tools.ietf.org/html/rfc1918) CIDR range, such\nas `10.1.0.0/24`, that isn't already a subnet on your authorized\nVPC network.\n\nFor more information, see [Select IP address\nranges](/managed-microsoft-ad/docs/selecting-ip-address-ranges).\n\nWhere can I view the event logs for domain controllers?\n-------------------------------------------------------\n\nYou can view the event logs for domain controllers by [setting up audit logging\nfor the domain](/managed-microsoft-ad/docs/using-ad-audit-logs).\n\nWhat should I expect during the maintenance of a domain controller? Is there any downtime during the maintenance?\n-----------------------------------------------------------------------------------------------------------------\n\nManaged Microsoft AD ensures that there are at least two domain controllers\nrunning on each region for a domain in different availability zones. So, the\ndomain remains available during patching. For more information, see\n[Patching](/managed-microsoft-ad/docs/hardening#patching).\n\nWhat is the timeline for applying security patches on domain controllers?\n-------------------------------------------------------------------------\n\nManaged Microsoft AD targets different timelines to apply different types\nof patches on domain controllers. For more information, see [Patching\nschedule](/managed-microsoft-ad/docs/hardening#patching-schedule).\n\nCan I restore my Active Directory data after a failure?\n-------------------------------------------------------\n\nManaged Microsoft AD supports on-demand and automatic backups for your\ndomain. You can use any of these backup types to [perform an authoritative\nrestore](/managed-microsoft-ad/docs/backup-restore#restore-backup), which\nreturns the domain to a previous point in time. For more information, see [Back\nup and restore your domain](/managed-microsoft-ad/docs/backup-restore).\n\nCan I extend the Active Directory schema?\n-----------------------------------------\n\nYes, you can [extend the Active Directory\nschema](/managed-microsoft-ad/docs/extend-schema) of your\nManaged Microsoft AD domain. For more information, see [About schema\nextension](/managed-microsoft-ad/docs/schema-extension).\n\nWhich time server do the domain controllers in Managed Microsoft AD use?\n------------------------------------------------------------------------\n\nThe domain controllers in Managed Microsoft AD sync their time with the\n`metadata.google.internal` time server. For more information, see [Configure NTP\non a VM](/compute/docs/instances/configure-ntp).\n\nDo I need to create a separate project for each Managed Microsoft AD domain?\n----------------------------------------------------------------------------\n\nNo, you don't need separate Google Cloud projects. By default, you can\ncreate two independent domains in the same project. [Contact\nsupport](/managed-microsoft-ad/docs/get-support) to increase the number of\nindependent domains that you can create in the same project."]]
