Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We recently upgraded from Exchange 2003 to Exchange 2010 and I just noticed that the object created in AD when the server was joined to the domain is in the Computers OU. I want to move the object to a different OU so that it can be managed via Group Policy but I'm concerned that doing so will break something as Exchange relies heavily on Active Directory. Has anyone done this before?

share|improve this question

3 Answers 3

up vote 3 down vote accepted

There is absolutely no problem with moving the Exchange server into a different OU. It's not relying on that computers OU for anything and not getting anything from it. The only GPOs it is getting are the ones applying to then entire domain and its site, which it would receive anyways. Just make sure you don't drop it in an OU that has funky policies you wouldn't want applied to your Exchange server.

My recommendation, actually, would be to move it out of the Computers OU. You want your AD organized, sane, and manageable. You're not going to get that by leaving computers in the default Computers OU.

share|improve this answer
    
+1, Absolutely - I've had mine in a "Servers" OU forever. Very limited set of policies - WSUS, small IE customisations and that's about it. –  Ben Pilbrow Feb 24 '11 at 17:28
    
Thanks. I just made the change and everything appears to be working properly. My eventual goal is to have a separate policy for the servers only. –  Justin Feb 24 '11 at 18:16

I've had mine in a separate OU for ages, and it hasn't caused me any harm.

enter image description here

share|improve this answer

The Computers container is the default location for the Exchange server object, just as it is for any non-DC workstation or server. I don't generally recommend moving the Exchange server object and my suggestion would be to leave it where it is, create a new GPO for the settings you want to apply to the Exchange server, link the GPO to the domain, and use Security Filtering to make sure the GPO is applied only to the Exchange server.

On a side note: The server is being managed by Group Policy. The Default Domain GPO as well as any site level GPO's or other GPO's linked to the domain are being applied to the server in it's current location in the Computers container.

share|improve this answer
    
Why don't you recommend moving it? I don't how the overly complex solution being described is better than the defacto standard which is organizing by OU. Security filtering on policies is functional but error prone - it's easy to accidentally add or remove something andhave that policy become much broader. Also now you've got every machine in the domain evaluating the ACL on that policy at each policy application... –  Brian Desmond Feb 25 '11 at 18:41
    
@Brian: Because that's the way I do it. If you choose to move it, that's your prerogative. There's nothing wrong with leaving it where it is and as such, my answer doesn't deserve a downvote because it's not a wrong answer. In addition, if someone encounters errors applying security filtering to GPO's then they're doing it wrong. Is it your position that anyone who links a security filtered GPO to the domain is wrong for doing so? –  joeqwerty Feb 25 '11 at 19:44
    
I personally move Exchange into it's own OU with no ill effects. Both methods yield the same result, I guess it comes down to preference... –  Ethos Feb 25 '11 at 22:25
    
Exactly. My preference is to leave it, which is certainly not a wrong answer. –  joeqwerty Feb 26 '11 at 1:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.