Problem solve Get help with specific problems with your technologies, process and projects.

The first rule of Active Directory design? Keep it simple

It's easy to get carried away when designing your Active Directory environment, and things can get complex very quickly. Learn why when it comes to AD, less is often more.

In previous tips, James has expounded on the notion that your Active Directory design can mimic the design, divisions,...

and hierarchy of your organization. While this is still true, you may want to consider a few related issues.

Active Directory is very flexible. So flexible that you can design an Active Directory forest that is complex beyond imagination. Both Windows 2000 Server and Windows Server 2003 support the Active Directory containers of forest, domain, site, and organizational unit (OU). With the only real restriction of one forest per namespace, you can deploy as many domains, sites, and OUs as you deem necessary.

However, before you rush off to design an Active Directory network that includes a domain for every department in your enterprise, take a step back and breath. As a general rule, you want to keep the number of domains to a minimum whenever possible. If you really need department level divisions on your network that reflect the organization of your business, then use OUs instead. OUs are much more flexible and easier overall to manage than domains.

In fact, if you are migrating from a Windows NT 4.0 network to a Windows 2000 Server or Windows Server 2003 Active Directory network, compare the number of domains from your existing legacy system and compare that with the number of domains in your new AD-based design. If your new AD network has more domains than your legacy network, you may need to re-think your design. Yes, it is possible to use as many domains as you wish, but I warn you now, you'll regret that decision down the line.

OUs grant you nearly infinite flexibility as you can move them, delete, and create new OUs as needed. However, domains are much more rigid in their existence. Domains can be deleted and new ones created, but this process is more disruptive of an environment than is the case with OUs, and should be avoided whenever possible.

In other words, keep your domain numbers down and the complexity of domain relationships simple. If you need lots of groupings and divisions, rely upon OUs.

James Michael Stewart is a partner and researcher for Itinfopros, a technology-focused writing and training organization.

This was last published in July 2003

Dig Deeper on Windows systems and network management

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.