# Active Directory Service Account FAQ
Under what scenarios modify, create or delete actual user objects? \
**It can create users only.**
Under what scenarios does WSM modify, create or delete actual user groups? \
**It only modifies user groups to remove a user when a workspace is terminated after being created via an AutoProvision profile.**
Under what scenarios does WSM modify, create or delete computer objects? \
**It modifies the description of a computer object to add the friendly name when the option is toggled on in settings. Objects are created by Amazon during workspace creation. We only remove the computer object when the option is toggled on in settings, otherwise it is orphaned. At this point we only list orphaned objects but do not manipulate them.**
{% hint style="info" %}
The answers above are based on a delegated service account, and are therefore subject to the permissions and OU restrictions placed on the service account in your AD environment.
{% endhint %}
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://docs.nuvens.cloud/admin/appendices/active-directory-service-account-faq.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.