Users and groups in W2K3 AD

[Milos Puchta]

What are basic rules for placing users and groups in AD?
In my understanding the default placing is not optimal from
the security reason and there is function, that redirects new
created users to OU with given GPO.
Unless loopback is applied is there any objection to the
following scheme? (User object are created directly by dsadd)

Places(OU) Room1 (OU)(with computers PC1, PC2,.....,PC10)
Room2 (OU)(with computers PCa1, PCa2,.... )
Hall1 (OU)(with computers SA1, PCcontroll,.....)

People(OU) Visitors (OU) (with users Guest1, Guest,...
and group GlobalGuest,
LocalGuest,...)
Employees (OU) (with users John, David, Ann,....
and group GlobalEmpl1,
GlobalEmpl2,..)

Your comments are appreciated.
Rgds,
Milos

 

[Johan Arwidmark]

You are right about not having to users in the users container, but
when it comes to ou-planning there is no absolute right or wrong.
Think more of it like how you would like to administer your Active
Directory. The OU structure is a pure logical representation of the
objects.

Most companys I know of uses an OU structure that represent either
their geographic locations or the different departments in the
organization.

Your OU structure looks fine to me

regards
Johan Arwidmark

Windows User Group - Nordic
http://www.wug-nordic.net