multiple managers in active directory

Question

In our environment, an employee can have multiple managers. They can also be in multiple departments.

How can I accomodate this in active directory as the manager attribute appears to be a single value, and a user can only be in one OU?

Answer 1

My thoughts ...

1- We are a "matrix-y" organization as well. Don't get trapped into thinking that AD structure needs to map to organizational structure. The AD structure is about how you organize resources, not about lines of authority. You may need to find your own structure to use. At this organization we start with (1) do they need local admin rights, then (2) execs and remote workers, then (3) primary physical location.

2- You can use security and distribution groups to manage permissions, which will likely be very complex when people have more than one department and management chain. AD has means to reconcile conflicting permissions when a user is in multiple groups. You should do some experiments to understand that mechanism.

3- As for the "department", "manager" and "direct report" fields, you should probably leave them blank unless someone assigns a primary for each user. HR may well have set primary manager and department for the payroll system.

Answer 2

You come up with a standard format for the field and then concatenate the information into one string that satisfies that format and populate the respective fields.

Alternatively you can extend the AD schema with your own fields or use other multiple entry fields that you're not already using. Problem there, though, is getting client apps to read those fields...