I need some quick help differentiating between a few key concepts within Active Directory.
1) Is a branch essentially the last OU in the hierarchy? For example, let's say we have an OU called "Office", then a child OU called "North East", then a child OU of North East called "Boston" - WOULD this be considered a branch?
2) What about the difference between an "OU" and a "Container"...is there one, or are they two of the same?
3) Can a user (or printer or other resource) belong to MORE THAN ONE OU (I'm guessing the answer is "No" - but would like an expert explanation of this)
Concise and succinct answers would be appreciated.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Also (promise this is my last suffix to this question) can you tell me why I can't add a sub-folder to the default 'Users' folder within ADUC? In our PROD environment, we have multiple folders under USERS (which is the out of the box folder - Not an OU from my understanding) - but when I try to create sub "folders" in another test environment, I can't....any suggestions?
1.)Its not you can sub OUs depends on your company and what group policies you wan to apply.
2.)OU is something admins create group similar ad objects to apply group policies.Container are something that are are prebuilt when you install a domain.I don't think you can create them and you can't apply group policies.Example of container is computers in AD.
3.)No you can't have 2 obects in more then one OU.Its not logical.
Thanks for the quick response.
Regarding answer one, I'm not so interested in permissions or delegation - I'm really trying to find out whether my understanding of the terminology is correct. Using the example I provided initially, would it be correct to call the Office > North East > Boston a "AD Branch"?
Regarding answer two, please view this additional question (http://www.experts-exchan
Regarding answer three - that's what i thought, but needed to hear it from someone else. With thanks mboppe!
Their isn't any thing like AD branch its just something we use to make things clear and it not somthing technicl as said above their isn't any AD term like branch.You can have as many sub OU as you like, it all depends on your AD design.
regarding containers MS doesn't let you create them from GUI. But I read somewhere that you can do by using ADSIedit I wouldn't recommend doing and I can't find a need for that.
1) Is a branch essentially the last OU in the hierarchy? For example, let's say we have an OU called "Office", then a child OU called "North East", then a child OU of North East called "Boston" - WOULD this be considered a branch?
-- Never heard the "branch" terminology before. We just refer to them as OU's and sub-OU's.
2.)OU is something admins create group similar ad objects to apply group policies.Container are something that are are prebuilt when you install a domain.I don't think you can create them and you can't apply group policies.Example of container is computers in AD.
-- You can't apply GPO's directly to containers, but they do filter down to them. (I think)
3) Can a user (or printer or other resource) belong to MORE THAN ONE OU (I'm guessing the answer is "No" - but would like an expert explanation of this)
-- Nope.
4) One additional question...if I search and locate a user within Active Directory Users and Computers, how can I quickly find out what OU they belong to?
-- Go to the Properties of the Object - On the Object tab there is a field called Canonical name of object.
5) Also (promise this is my last suffix to this question) can you tell me why I can't add a sub-folder to the default 'Users' folder within ADUC? In our PROD environment, we have multiple folders under USERS (which is the out of the box folder - Not an OU from my understanding) - but when I try to create sub "folders" in another test environment, I can't....any suggestions?
-- I don't think you can do this in ADUC. Probably need to import with LDIFDE or use ADSIEdit
Thanks Rob.
I think I'm now clear about what a branch is..."any OU container which contains sub-OUs" - or at least the way I look at it anyway.
One thing I've not been able to do from your answer to question 4 - is see the OBJECT tab (see image below). This is in my test environment WITHOUT MS Exchange Installed. Can I assume this is the reason I cannot see it?
Regarding your answer to question 5, we have a whole sub-container structure under 'Users' which is apparently a legacy from when we moved from Exchange 2000 to Exchange 2003.
No Object Tab
Business Accounts
Answer for Membership
by: drewberryliciousPosted on 2008-11-18 at 16:45:10ID: 22990564
One additional question...if I search and locate a user within Active Directory Users and Computers, how can I quickly find out what OU they belong to?