2

I came across an AD today where the previous admin had set it up in where every AD object is in a child OU of Domain Controllers..........

DOMAINNAME.LOCAL
     Builtin
     Computers
     Domain Controllers
           Active Users
           Computers
                      Servers
                      Workstations
           DistroGroups
.....

Tabs show that the OU is a child of the previous.

  1. What should I keep in mind when moving the computers back to the proper OU?

  2. What should I keep in mind when moving the other objects such as users and distrobution and security groups outside of the Domain Controller OU's child OU?

I will ensure GPO are properly applied to the correct OU but I am more concerned with effects this could have with our exchange 2003 server.....

Any one who has experience restructuring a improper AD structure please let me know your experience and issues in resolving matters such as these....

I understand in theory this may be OK but this is definitely not supported from microsoft and i have never seen ANYTHING like this....

For reference I came across this article. ITWORLD AD ARTICLE

Thanks,

This environment has one 2008 DC and two 2003 R2 DCs. They also have an Exchange 2003 Server. There are about 30 user workstations as well as a DFS system, RD Gateway, VPN, to name a few core services that may be effected by this.

2
  • Not sure why the guy made a big deal of that in that article. I've seen what he's describing as a supposed big problem in a number of large customer environments. The support boundary I'm familiar with is moving DCs out of the Domain Controllers OU all together. Feb 25, 2011 at 18:39
  • After adjusting things ALOT of phantom issues have been miraculously resolved.
    – Campo
    Feb 25, 2011 at 18:44

1 Answer 1

5

Wow, that's kinda crappy. Here's what I would do...

  1. Get intimately familiar with the current GPO structure. If anything is going to break, it will be that.
  2. Create a new structure in AD as you would like it organized. Create the OUs and all that, and link the correct GPOs to that OU.
  3. Move individual objects one at a time and test functionality as you go. If something breaks, move it back and figure out what happened. For critical servers/functions, schedule it after hours to reduce user impact.
  4. Rinse and repeat.

I don't know if there's a magic bullet, but this is how I would approach it.

4
  • Also the 2008 DC when I click properties on a OU I cannot see the Group Policy tab. Only on the 2003 DCs... Any ideas?
    – Campo
    Feb 24, 2011 at 19:49
  • 1
    To that last comment, Server 2008 has a separate MMC (Group Policy Management). Find it in Start -> Administrative Tools -> Group Policy Management. Feb 24, 2011 at 21:15
  • AH! Thanks! Thought so but it was eluding me. +1
    – Campo
    Feb 24, 2011 at 21:19
  • Thank you very much for this info. A fast and straight forward response.
    – Campo
    Feb 24, 2011 at 21:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .