In addition to
@Todd Wilcox's excellent answer, I'd like to add the idea of a naming convention for the objects in AD.
Certain aspects of the "attributes" you want to create for the users/groups can be inherently applied by having a very strong naming convention for objects and infrastructure, and not deviating from it.
Regular user names should be
<lastName><FirstInitial>, while their Display Names would be
<LastName>, <FirstName> (<Department>). Or whatever works for your company. Either way, they should be reproducible, and formatted in a way such that if you know a certain element for a user, you know how to find out more about them because you know what to look for.
Real Name Department Display name User Name
John Doe IT Doe, John (IT) John.Doe
Jane Doe Finance Doe, Jane (FIN) Jane.Doe
James Doe Human Resources Doe, James (HR) James.Doe
Service accounts should also follow a standard convention, but different than the one for regular users. This also applies to "shared" accounts, but I'd stay away from those anyway. My preferred format is
sa.<vendor>.<product>, so that it's fairly easy to group them and find them for later re-use.
Vendor Product Display Name Username
VMware vSphere (SA) VMware - vSphere sa.vmware.vsphere
Microsoft SQL Server (SA) Microsoft - SQL Server sa.microsoft.sqlserver
Microsoft Exchange (SA) Microsoft - Exchange sa.microsoft.exchange
IBM Tivoli Storage Manager (SA) IBM - Tivoli Storage Manager sa.ibm.tsm
Security groups should be named based on what they're doing and to what they apply, but again following a standard pattern so that similar purposed groups can easily be found.
File shares could be named by the share name, and the permissions they grant, while the server/path for that share is found in the Description (
SHR_<ShareName>_R for read,
SHR_<ShareName>_M for modify).
Generic Mailbox access groups, could contain the mailbox name, and the rights (
GM_<SMTPAddress>_FMR for full access,
GM_<SMTPAddress>_SA for Send As).
AD/server Delagation groups could be the name of the team (
DLG AD DevOps),
DLG SRV BackupAndStorage, etc..)
Distribution lists are the only strange one, in that will likely be named more or less whatever is nedded because people are going to want that. But even then, you can setup standards for them that work for your organization.