Tip

Putting Active Directory OUs in their place

James Michael Stewart, Contributor

Organizational units, or OUs, are the most flexible and forgiving Active Directory containers available. OUs can be abused far beyond what a domain or even a site can endure and still provide you with useful functionality. OUs are typically deployed in a multi-branched tree-like hierarchy within a domain. OUs can contain systems and/or user accounts. You can use one OU to contain just client systems, another to contain member servers, another to contain domain controllers and still yet other OUs to host user accounts. Or you can include both computers and users in the same OUs. You can apply one or more GPOs to OUs in order to fully customize the security and operations settings for the objects retained within.

In addition to these features OUs exude another unique quality: You can change them as needed with little or no impact on overall network traffic. Try that with a domain or a site, and you will be in a network-communications nightmare. So what changes can an OU endure so modestly? Why, just about anything from being created, moved, added to being deleted and even renamed. Objects within an OU can be created, moved, added, deleted, etc. just as easily as the OUs themselves.

Another interesting use of OUs is the ability to delegate administrative level activities over objects within an OU to non-administrator users. This in and of itself is a benefit no security manager could live without.

The flexibility and robustness of OUs along with the rigidness

    Requires Free Membership to View

of domains has lead Microsoft to recommend creating domains for those groupings within your organization that are relatively static (such as location or primary departments) and use OUs to reflect the evolving detailed groupings within your organization.

James Michael Stewart is a partner and researcher for ITinfopros, a technology-focused writing and training organization.


This was first published in May 2003

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.