• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 713
  • Last Modified:

Windows Server 2003: implications of moving user accounts to a new OU

I have just started at a new company and I am trying to clean up things a but an make things a little more managable.

at the moment all our user accounts are in the OU called 'Users' along with a lot of administration accounts etc.

I would like to move the user accounts to their own OU but I am concerned about the implications of doing so.

If we only have the default group policy in place my understanding is there is very little risk of something going wrong if the OU I move the users to are sill in the same domain.

Can any one confirm please?
0
defecta
Asked:
defecta
  • 5
  • 3
1 Solution
 
AustinComputerLabsCommented:
If you are only using the default domain GPO moving to a new OU in the domain should not effect the GPO being applied.
If it did have an adverse effect you could make a copy of the default GPO and apply it to the new OU.
0
 
defectaAuthor Commented:
Also is it best practice the leave the administration account etc. vin the Users OU or can I safely move them to a different OU? The 'Users' OU is a accurate description of what I want it to contain so if its safe to do so, I would move the other adminstration accounts out of there.

0
 
Glen KnightCommented:
If you move users to a different OU they pickup the settings from group policies linked to that OU.  If there aren't any then they will pickup the default policies.

The only other thing to be aware of is any dynamic Distribution groups or address lists that can be configured by OU in exchange but since they are in the users container at the moment this is unlikely to be an issue.

And then lastly any 3rd party applications that might be using the CN linked to the user container to authenticate users.
0
[Webinar] Kill tickets & tabs using PowerShell

Are you tired of cycling through the same browser tabs everyday to close the same repetitive tickets? In this webinar JumpCloud will show how you can leverage RESTful APIs to build your own PowerShell modules to kill tickets & tabs using the PowerShell command Invoke-RestMethod.

 
Glen KnightCommented:
Yes, the administrator account can also be moved
0
 
defectaAuthor Commented:
these are the admin accounts/groups that I am concerned about moving to a different OU.

 
Small Business Administrator
Domain Controllers
Domain Guests
Domain Users
Domain Computers
Administrator
IUSR_DESIGNWCC
IUSR_SERVERFILE
IUSR_SERVERMAIL
Guest
IWAM_DESIGNWCC
IWAM_SERVERFILE
IWAM_SERVERMAIL
Debugger Users
Domain Admins
Enterprise Admins
Schema Admins
Designers
DnsAdmins
DnsUpdateProxy
Cert Publishers
IIS_WPG
SQLServer2005MSSQLServerADHelperUser$SERVERFILE
SQLServer2005MSSQLServerADHelperUser$SERVERMAIL
SQLServer2005MSSQLUser$SERVERFILE$BKUPEXEC
SQLServer2005MSSQLUser$SERVERFILE$SQLEXPRESS
SQLServer2005MSSQLUser$SERVERMAIL$BLACKBERRY
SQLServer2005MSSQLUser$SERVERMAIL$MSSQLSERVER
SQLServer2005MSSQLUser$SERVERMAIL$WSUS
SQLServer2005SQLBrowserUser$SERVERFILE
SQLServer2005SQLBrowserUser$SERVERMAIL
Group Policy Creator Owners
GFI_ESEC_CdDvd_FullAccess
GFI_ESEC_USB_FullAccess
GFI_ESEC_OtherDevices_FullAccess
GFI_ESEC_PDA_FullAccess
GFI_ESEC_StorageDevices_FullAccess
GFI_ESEC_CdDvd_ReadOnly
GFI_ESEC_StorageDevices_ReadOnly
TelnetClients
DHCP Administrators
DHCP Users
WINS Users
Exchange Domain Servers
Exchange Enterprise Servers
Small Business Power User
RAS and IAS Servers
GFI_LPSC_CDDVD
GFI_LPSC_FLOPPY
GFI_LPSC_REMOVABLE
TsInternetUser
Small Business User
WSUS Administrators
WSUS Reporters

Open in new window


Im concerned moving the GFI groupsto a different OU might break our GFI Languard security. Can anyone confirm?
0
 
Glen KnightCommented:
Is this a small business server? If so the reason the users are all in the Users container is because they have been setup incorrectly.  They should be in the MyBusiness > SBS Users OU.
0
 
defectaAuthor Commented:
@demazter: no its Server 2003 Standard. what effect will that have on moving the users to a different OU in this case? Or is it irrelevant?
0
 
defectaAuthor Commented:
thanks guys. i have now confidently moved the users to a new OU and not broken anything. :)
0
 
defectaAuthor Commented:
@demazter: can you explain what the CN is that you mentioned?
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 5
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now