• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1695
  • Last Modified:

Active Directory 101 - OU, Branches, Containers

I need some quick help differentiating between a few key concepts within Active Directory.

1) Is a branch essentially the last OU in the hierarchy?  For example, let's say we have an OU called "Office", then a child OU called "North East", then a child OU of North East called "Boston" - WOULD this be considered a branch?

2) What about the difference between an "OU" and a "Container"...is there one, or are they two of the same?

3)  Can a user (or printer or other resource) belong to MORE THAN ONE OU (I'm guessing the answer is "No" - but would like an expert explanation of this)

Concise and succinct answers would be appreciated.

 
0
drewberrylicious
Asked:
drewberrylicious
  • 5
  • 3
4 Solutions
 
drewberryliciousAuthor Commented:
One additional question...if I search and locate a user within Active Directory Users and Computers, how can I quickly find out what OU they belong to?
0
 
drewberryliciousAuthor Commented:
Also (promise this is my last suffix to this question) can you tell me why I can't add a sub-folder to the default 'Users' folder within ADUC?  In our PROD environment, we have multiple folders under USERS (which is the out of the box folder - Not an OU from my understanding) - but when I try to create sub "folders" in another test environment, I can't....any suggestions?
0
 
Malli BoppeCommented:
1.)Its not you can sub OUs depends on your company and what group policies you wan to apply.
2.)OU is something admins create group similar ad objects  to apply group policies.Container are something that are are prebuilt when you install a domain.I don't think  you can create them and you can't apply group policies.Example of container is computers in AD.
3.)No you can't have 2 obects in more then one OU.Its not logical.
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
drewberryliciousAuthor Commented:
Thanks for the quick response.

Regarding answer one, I'm not so interested in permissions or delegation - I'm really trying to find out whether my understanding of the terminology is correct.  Using the example I provided initially, would it be correct to call the Office > North East > Boston a "AD Branch"?

Regarding answer two, please view this additional question (http://www.experts-exchange.com/Software/Server_Software/File_Servers/Active_Directory/Q_23916461.html) I've posted where you can see that sub-containers can be created....now I just need to find out how.

Regarding answer three - that's what i thought, but needed to hear it from someone else.  With thanks mboppe!
0
 
Malli BoppeCommented:
Their isn't any thing like AD branch its just something we use to make things clear and it not somthing technicl as said above their isn't any AD term like branch.You can have as many sub OU as you like, it all depends on your AD design.
regarding containers MS doesn't let you create them from GUI. But I read somewhere that you can do by using ADSIedit I wouldn't recommend doing  and I can't find a need for that.
0
 
robrandonCommented:
1) Is a branch essentially the last OU in the hierarchy?  For example, let's say we have an OU called "Office", then a child OU called "North East", then a child OU of North East called "Boston" - WOULD this be considered a branch?
-- Never heard the "branch" terminology before.  We just refer to them as OU's and sub-OU's.

2.)OU is something admins create group similar ad objects  to apply group policies.Container are something that are are prebuilt when you install a domain.I don't think  you can create them and you can't apply group policies.Example of container is computers in AD.
-- You can't apply GPO's directly to containers, but they do filter down to them. (I think)

3)  Can a user (or printer or other resource) belong to MORE THAN ONE OU (I'm guessing the answer is "No" - but would like an expert explanation of this)
-- Nope.

4)  One additional question...if I search and locate a user within Active Directory Users and Computers, how can I quickly find out what OU they belong to?
-- Go to the Properties of the Object - On the Object tab there is a field called Canonical name of object.


5)  Also (promise this is my last suffix to this question) can you tell me why I can't add a sub-folder to the default 'Users' folder within ADUC?  In our PROD environment, we have multiple folders under USERS (which is the out of the box folder - Not an OU from my understanding) - but when I try to create sub "folders" in another test environment, I can't....any suggestions?
-- I don't think you can do this in ADUC.  Probably need to import with LDIFDE or use ADSIEdit


0
 
drewberryliciousAuthor Commented:
Thanks Rob.  

I think I'm now clear about what a branch is..."any OU container which contains sub-OUs" - or at least the way I look at it anyway.

One thing I've not been able to do from your answer to question 4 - is see the OBJECT tab (see image below).  This is in my test environment WITHOUT MS Exchange Installed.  Can I assume this is the reason I cannot see it?

Regarding your answer to question 5, we have a whole sub-container structure under 'Users' which is apparently a legacy from when we moved from Exchange 2000 to Exchange 2003.

objecttab.png
0
 
Malli BoppeCommented:
question 4.. IN ADUC go to view and tick the option advanced features then you would be able to see object tab in the user properties.
0
 
drewberryliciousAuthor Commented:
Thanks
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell┬« is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

  • 5
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now