Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In our environment, an employee can have multiple managers. They can also be in multiple departments.

How can I accomodate this in active directory as the manager attribute appears to be a single value, and a user can only be in one OU?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

My thoughts ...

  1. We are a "matrix-y" organization as well. Don't get trapped into thinking that AD structure needs to map to organizational structure. The AD structure is about how you organize resources, not about lines of authority. You may need to find your own structure to use. At this organization we start with (1) do they need local admin rights, then (2) execs and remote workers, then (3) primary physical location.

  2. You can use security and distribution groups to manage permissions, which will likely be very complex when people have more than one department and management chain. AD has means to reconcile conflicting permissions when a user is in multiple groups. You should do some experiments to understand that mechanism.

  3. As for the "department", "manager" and "direct report" fields, you should probably leave them blank unless someone assigns a primary for each user. HR may well have set primary manager and department for the payroll system.

share|improve this answer
1  
Leaving AD fields empty is not an ideal solution as several linked features depends on them: automated shared calendar and team concept in Outlook, Organisation chart in SharePoint MySites... I do not recommend doing it. –  Veynom Mar 12 at 9:10

You come up with a standard format for the field and then concatenate the information into one string that satisfies that format and populate the respective fields.

Alternatively you can extend the AD schema with your own fields or use other multiple entry fields that you're not already using. Problem there, though, is getting client apps to read those fields...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.