Windows 2003 AD Organizational Units - Why or Why Not?

Posted on 2005-04-27
Last Modified: 2010-04-18

I'm a bit new to Active Directory.  I know it's a database, I know it treats everything in a domain (users, computers, printers, etc) as an object in its Database.  That's about all I know.

My question is this...

I'm starting a new Domain and I'm looking for advise as far as OUs go.  My company only has about 30 employees and roughly 40 PCs (Win2k/XP)

- Should I create user accounts in the pre-existing USERS OU, or create a new one and logically divide stuff like:
      |____ Users (OU)
                  |___Finance (OU)
                  |           |___Bob
                  |___Engineering (OU)
                  |           |___Joe
                  |___Sales (OU)

- Does it really matter?  What are the benefits of dividing accounts and computers into OUs?

Thanks you so much!
Question by:techleet
    LVL 18

    Accepted Solution

    Active Directory OU Design is very important and should be considered in detail when setting up your AD structure (even though AD has the freedom to allow you to freely move objects between OUs).

    OUs are critical when you are using group policy and you should think about how you may want to apply group policy in your organization and this will help with your OU design. Also, OUs are nice because they give you a logical layout of your active directory (this is helpful even in a small network).  Think of them as file folders.....a nicely organized filing cabinet is much easier to navigate through then one when all the files are stuck in the same file folder.

    The built in users container is not an OU (same for built in computer container) is simply a container. The big difference is that you can't apply group policy directly to this container (although any users in it would receieve the default domain policy).

    So definately does matter and you should move your users and computers out of those default locations and into a logical design that fits your organization.

    A very general OU design would create OUs for each department as you have. But under each department OU, a general design would create seperate OUs for computers and users.

    So it would look like this:

    Finance OU
        - Computer OU
        - User OU
    Engineering OU
        - Computer OU
        - User O
    LVL 51

    Expert Comment

    To add to the above - it's simply a matter of preference whether you separate your computers and users into different OUs.  Technically, there is no benefit.

    GPOs apply to users and/or computers.  The client-side extensions know what to apply to each object based on the elements that are defined in it - either in Computer Configuration or User Configuration.


    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Join & Write a Comment

    Numerous times I have been asked this questions that what is it that makes my machine log on so slow, there have been cases where computers took 23 minute exactly after taking password and getting to the desktop. Interesting thing was the fact th…
    Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

    729 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now