Chapter 6. Designing Organizational Unit and Group Structure

In This Chapter

• Defining Organizational Units in Active Directory

• AD Groups

• OU and Group Design

• Starting an OU Design

• Using OUs to Delegate Administration

• Group Policies and OU Design

• Understanding Group Design

• Sample Design Models

The organization of users, computers, and other objects within the Windows Server 2003 Active Directory (AD) structure gives administrators great flexibility and control over their environments. Both organizational unit (OU) and group structure design can be tailored to fit virtually any business need. There is, however, a great bit of confusion among administrators in the design and use of OUs and groups. Often, OUs are indiscriminately used without reason, and group structure is ineffectual and confusing. With the proper preparation and advance knowledge of their use, however, a functional OU and group design can do wonders to simplify a Windows Server 2003 Active Directory environment.

In addition to the lessons learned from OU and group use in Windows 2000, Windows Server 2003 introduces several functional advantages and improvements to OU and group structure and replication that fundamentally change their design method. Universal Group Membership caching, incremental group replication, and other enhancements have increased the flexibility of OU and group design, and have given administrators greater tools to work with.

This chapter defines organizational units and groups within Windows Server 2003's Active Directory and describes methods of integrating them into various Active Directory designs. Specific step-by-step instructions and "best practice" design advice are given as well. In addition, functional OU and group design models are detailed and compared.