Active Directory 101 - OU, Branches, Containers

I need some quick help differentiating between a few key concepts within Active Directory.

1) Is a branch essentially the last OU in the hierarchy?  For example, let's say we have an OU called "Office", then a child OU called "North East", then a child OU of North East called "Boston" - WOULD this be considered a branch?

2) What about the difference between an "OU" and a "Container"...is there one, or are they two of the same?

3)  Can a user (or printer or other resource) belong to MORE THAN ONE OU (I'm guessing the answer is "No" - but would like an expert explanation of this)

Concise and succinct answers would be appreciated.

 
drewberryliciousAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

drewberryliciousAuthor Commented:
One additional question...if I search and locate a user within Active Directory Users and Computers, how can I quickly find out what OU they belong to?
0
drewberryliciousAuthor Commented:
Also (promise this is my last suffix to this question) can you tell me why I can't add a sub-folder to the default 'Users' folder within ADUC?  In our PROD environment, we have multiple folders under USERS (which is the out of the box folder - Not an OU from my understanding) - but when I try to create sub "folders" in another test environment, I can't....any suggestions?
0
Malli BoppeCommented:
1.)Its not you can sub OUs depends on your company and what group policies you wan to apply.
2.)OU is something admins create group similar ad objects  to apply group policies.Container are something that are are prebuilt when you install a domain.I don't think  you can create them and you can't apply group policies.Example of container is computers in AD.
3.)No you can't have 2 obects in more then one OU.Its not logical.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

drewberryliciousAuthor Commented:
Thanks for the quick response.

Regarding answer one, I'm not so interested in permissions or delegation - I'm really trying to find out whether my understanding of the terminology is correct.  Using the example I provided initially, would it be correct to call the Office > North East > Boston a "AD Branch"?

Regarding answer two, please view this additional question (http://www.experts-exchange.com/Software/Server_Software/File_Servers/Active_Directory/Q_23916461.html) I've posted where you can see that sub-containers can be created....now I just need to find out how.

Regarding answer three - that's what i thought, but needed to hear it from someone else.  With thanks mboppe!
0
Malli BoppeCommented:
Their isn't any thing like AD branch its just something we use to make things clear and it not somthing technicl as said above their isn't any AD term like branch.You can have as many sub OU as you like, it all depends on your AD design.
regarding containers MS doesn't let you create them from GUI. But I read somewhere that you can do by using ADSIedit I wouldn't recommend doing  and I can't find a need for that.
0
robrandonCommented:
1) Is a branch essentially the last OU in the hierarchy?  For example, let's say we have an OU called "Office", then a child OU called "North East", then a child OU of North East called "Boston" - WOULD this be considered a branch?
-- Never heard the "branch" terminology before.  We just refer to them as OU's and sub-OU's.

2.)OU is something admins create group similar ad objects  to apply group policies.Container are something that are are prebuilt when you install a domain.I don't think  you can create them and you can't apply group policies.Example of container is computers in AD.
-- You can't apply GPO's directly to containers, but they do filter down to them. (I think)

3)  Can a user (or printer or other resource) belong to MORE THAN ONE OU (I'm guessing the answer is "No" - but would like an expert explanation of this)
-- Nope.

4)  One additional question...if I search and locate a user within Active Directory Users and Computers, how can I quickly find out what OU they belong to?
-- Go to the Properties of the Object - On the Object tab there is a field called Canonical name of object.


5)  Also (promise this is my last suffix to this question) can you tell me why I can't add a sub-folder to the default 'Users' folder within ADUC?  In our PROD environment, we have multiple folders under USERS (which is the out of the box folder - Not an OU from my understanding) - but when I try to create sub "folders" in another test environment, I can't....any suggestions?
-- I don't think you can do this in ADUC.  Probably need to import with LDIFDE or use ADSIEdit


0
drewberryliciousAuthor Commented:
Thanks Rob.  

I think I'm now clear about what a branch is..."any OU container which contains sub-OUs" - or at least the way I look at it anyway.

One thing I've not been able to do from your answer to question 4 - is see the OBJECT tab (see image below).  This is in my test environment WITHOUT MS Exchange Installed.  Can I assume this is the reason I cannot see it?

Regarding your answer to question 5, we have a whole sub-container structure under 'Users' which is apparently a legacy from when we moved from Exchange 2000 to Exchange 2003.

objecttab.png
0
Malli BoppeCommented:
question 4.. IN ADUC go to view and tick the option advanced features then you would be able to see object tab in the user properties.
0
drewberryliciousAuthor Commented:
Thanks
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.