Any suggestions for Security Group OU structure in AD (Role based access)

I'm trying to think of an easy way without being over-complicated, to organize OU in AD to manage security groups.
Here's what I'm looking at now:
partial OU screenshot
Does anyone else organize similar to that?

The idea of Groups > Access > File > Servers, would be that I create a security group called something like "ACL_Server1_inetpub_write", and then add that group to have write access to C:\inetpub on "Server1".
Versus giving a user local Admin rights entirely to Server1.

Then I could have a Role Group called "Server1 Web Editors", which would be a member of ACL_Server1_inetpub_write.
Am I over-complicating Role Based Access, given this idea, OU structure and naming convention?
garryshapeAsked:
Who is Participating?
 
Jeffrey Kane - TechSoEasyConnect With a Mentor Principal ConsultantCommented:
You really don't want to be organizing your AD OU's by security group.  That would be difficult to manage in the long term.

In order to give you advice though, it would be helpful to know more about your environment.  How many users, what industry, how many physical locations?
0
 
Jeffrey Kane - TechSoEasyConnect With a Mentor Principal ConsultantCommented:
By the way -- you never have to give a user local administrator rights on a server for them to manage IIS.

Instead, they just need to install the IIS Management Console on their own computer.

http://www.iis.net/downloads/microsoft/iis-manager

And if it's IIS 8, see this how-to:  http://www.sherweb.com/blog/configure-iis-8-remote-administration/
0
 
garryshapeAuthor Commented:
I got the idea from this video, at this timestamp you can see a similar OU structure; https://youtu.be/vvhwN5bOyV8?t=1370   

The environment is school. Couple hundred staff, couple thousand student, ultimately. no security groups for the student body yet. I'm not sure if I need one for them. Im' thinking maybe just a "Student" security group, and Deny it logon access to staff computers.
0
Managing Security Policy in a Changing Environment

The enterprise network environment is evolving rapidly as companies extend their physical data centers to embrace cloud computing and software-defined networking. This new reality means that the challenge of managing the security policy is much more dynamic and complex.

 
garryshapeAuthor Commented:
Hey that's interesting. So it allows like editing the webpages?
The user was going to get RDP into the server, but this solution is a workaround to that?
0
 
garryshapeAuthor Commented:
Also I'm not organizing OU by security group, I'm organizing Security Group by OU.  
I will have other OU's for users and computers
0
 
Jeffrey Kane - TechSoEasyConnect With a Mentor Principal ConsultantCommented:
Hey that's interesting. So it allows like editing the webpages?
The user was going to get RDP into the server, but this solution is a workaround to that?

Yes.  There is no reason for someone who just needs to administer IIS and web sites to have full access to the entire server.  They can install the IIS Admin Tools on their own computer, connect to the web server and do whatever they need to do within the confines of IIS.

So, I fully understand where you got the idea -- but I think -- as you had also thought -- Role Based Access may actually over-complicate things for you.  I don't think that your scenario will benefit that much from RBAC.  Especially now that you know about things like IIS Remote Management.  

Basic security groups coupled with a well managed Group Policy should provide you with everything you need to keep things under control.  

One thing to remember is that the more complex something is to manage, the less likely it will be managed at all.
1
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.