havplenty
asked on
Active Directory Rookie
I have a fairly small domain, with only about 75 users. I want to place users in OU's modeled after our department structure. I'll need groups as well for applying permissions to various resources. If I have an OU named Warehouse, should I also have a group called warehouse as well? And if so, will the group be located in the warehouse OU?? Please advise?? Thank you.
The most important feature of X.500-based directories is the organizational unit (OU). The OU is referred to as a container object in the directory because the OU can contain other objects—either leaf objects or other container objects. Because X.500-based directories let you create objects that contain other objects, these directories can support hierarchical relationships. Thus, you can create trees of OUs, with each tree subordinate to the previous one. This powerful AD feature lets you delegate administrative duties to subsets of users in a Win2K domain. The OU provides granular delegation control of domain resources. In Win2K, the OU is the unit of delegation
http://www.win2000mag.com/Articles/Index.cfm?ArticleID=7429
Pete
http://www.win2000mag.com/Articles/Index.cfm?ArticleID=7429
Pete
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thank you Pete for your response, I realize that I can put the group inside my OU, but I guess what I'm trying to understand is, is there a recommended procedure or strategy when creating OU's and groups. It seems kinda redundant to put users in an OU, while creatng a group with the same users that are in the OU - see, I've already confused myself.
:) No problem OU's are there to make life easy, AD has been benchmarked at 14 million objects, imagin lookin through that for the printer in the accounting department :D
there are no hard and fast rules
generally there are two approaches
geographic
ie
london office OU >accounting OU>sales OU
new york office OU >accounting OU>salesOU
or business
ie
Accounting OU >london OU >new York OU
SAles OU >londonOU >new york OU
You need to select a design that fits your business needs :) there are books written on this subject, in fact designing an AD infrastructure is a core module of the MSCE.
Pete
there are no hard and fast rules
generally there are two approaches
geographic
ie
london office OU >accounting OU>sales OU
new york office OU >accounting OU>salesOU
or business
ie
Accounting OU >london OU >new York OU
SAles OU >londonOU >new york OU
You need to select a design that fits your business needs :) there are books written on this subject, in fact designing an AD infrastructure is a core module of the MSCE.
Pete
Mmmm
you can have an ou called myou with whatever group names in there you want
Novell have been doing it for years with OU's (microsoft have only just caught on)