I'm a junior MS System administrator. A senior friend advised me to perform a modification on the Active Directory structure and I want your advice/opinion accordingly.
All PCs are currently installed within one OU in a forest. Hence, we cannot tell which computer or printer belongs to what Department, Unit, section or even employee. This chaotic approach has caused us a problems in the past and as a result, an IT Assets Controller function had been recently created to fill this gap and take inventory of all PCs and their respective department, Unit, Section and staff on a separate database.
Now my senior friend advises the following
Create one domain for such PCs and provide proper OUs, group policies and accounts delegation based on access and policies needs.
He clarified that this will result in easier administration and enable monitoring and tracking for many critical PCs and systems such as Telephony PCs, Security Systems and some Technical PCs.
For some reason I feel that I can solve it in a different way.
What do you think?