Link to home
Start Free TrialLog in
Avatar of havplenty
havplenty

asked on

Active Directory Rookie

I have a fairly small domain, with only about 75 users. I want to place users in OU's modeled after our department structure. I'll need groups as well for applying permissions to various resources. If I have an OU named Warehouse, should I also have a group called warehouse as well? And if so, will the group be located in the warehouse OU?? Please advise?? Thank you.
Avatar of Pete Long
Pete Long
Flag of United Kingdom of Great Britain and Northern Ireland image

you can put anything in an OU their purpose is to keep things tidy, and to make administration easier, cause you can apply a policy to an OU:)
you can have an ou called myou with whatever group names in there you want

Novell have been doing it for years with OU's (microsoft have only just caught on)
The most important feature of X.500-based directories is the organizational unit (OU). The OU is referred to as a container object in the directory because the OU can contain other objects—either leaf objects or other container objects. Because X.500-based directories let you create objects that contain other objects, these directories can support hierarchical relationships. Thus, you can create trees of OUs, with each tree subordinate to the previous one. This powerful AD feature lets you delegate administrative duties to subsets of users in a Win2K domain. The OU provides granular delegation control of domain resources. In Win2K, the OU is the unit of delegation
http://www.win2000mag.com/Articles/Index.cfm?ArticleID=7429

Pete
ASKER CERTIFIED SOLUTION
Avatar of bos
bos

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of havplenty
havplenty

ASKER

Thank you Pete for your response, I realize that I can put the group inside my OU, but I guess what I'm trying to understand is, is there a recommended procedure or strategy when creating OU's and groups. It seems kinda redundant to put users in an OU, while creatng a group with the same users that are in the OU - see, I've already confused myself.
:) No problem OU's are there to make life easy, AD has been benchmarked at 14 million objects, imagin lookin through that for the printer in the accounting department :D

there are no hard and fast rules

generally there are two approaches

geographic

ie

london office OU >accounting OU>sales OU
new york office OU >accounting OU>salesOU

or business

ie

Accounting OU >london OU >new York OU
SAles OU >londonOU >new york OU

You need to select a design that fits your business needs :) there are books written on this subject, in fact designing an AD infrastructure is a core module of the MSCE.

Pete
Mmmm