The first rule of Active Directory design? Keep it simple

In previous tips, James has expounded on the notion that your Active Directory design can mimic the design, divisions, and hierarchy of your organization. While this is still true, you may want to consider a few related issues.

Active Directory is very flexible. So flexible that you can design an Active Directory forest that is complex beyond imagination. Both Windows 2000 Server and Windows Server 2003 support the Active Directory containers of forest, domain, site, and organizational unit (OU). With the only real restriction of one forest per namespace, you can deploy as many domains, sites, and OUs as you deem necessary.

However, before you rush off to design an Active Directory network that includes a domain for every department in your enterprise, take a step back and breath. As a general rule, you want to keep the number of domains to a minimum whenever possible. If you really need department level divisions on your network that reflect the organization of your business, then use OUs instead. OUs are much more flexible and easier overall to manage than domains.

In fact, if you are migrating from a Windows NT 4.0 network to a Windows 2000 Server or Windows Server 2003 Active Directory network, compare the number of domains from your existing legacy system and compare that with the number of domains in your new AD-based design. If your new AD network has more domains than your legacy network, you may need to re-think your design. Yes, it is

Requires Free Membership to View

possible to use as many domains as you wish, but I warn you now, you'll regret that decision down the line.

OUs grant you nearly infinite flexibility as you can move them, delete, and create new OUs as needed. However, domains are much more rigid in their existence. Domains can be deleted and new ones created, but this process is more disruptive of an environment than is the case with OUs, and should be avoided whenever possible.

In other words, keep your domain numbers down and the complexity of domain relationships simple. If you need lots of groupings and divisions, rely upon OUs.

James Michael Stewart is a partner and researcher for Itinfopros, a technology-focused writing and training organization.

This was first published in July 2003

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.