Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a junior MS System administrator. A senior friend advised me to perform a modification on the Active Directory structure and I want your advice/opinion accordingly.

Current scenario

All PCs are currently installed within one OU in a forest. Hence, we cannot tell which computer or printer belongs to what Department, Unit, section or even employee. This chaotic approach has caused us a problems in the past and as a result, an IT Assets Controller function had been recently created to fill this gap and take inventory of all PCs and their respective department, Unit, Section and staff on a separate database.

Now my senior friend advises the following

Create one domain for such PCs and provide proper OUs, group policies and accounts delegation based on access and policies needs.

He clarified that this will result in easier administration and enable monitoring and tracking for many critical PCs and systems such as Telephony PCs, Security Systems and some Technical PCs.

For some reason I feel that I can solve it in a different way.

What do you think?

share|improve this question

migrated from Oct 26 '11 at 18:32

This question came from our site for computer enthusiasts and power users.

how many users, departments, workstations, printers etc? How many sites? What do the more senior administrators at your site think about this? – RobW Oct 26 '11 at 21:57
Your senior friend knows what needs doing ("Create one domain for such PCs and ... access and policies needs."). It's a must in any AD environment and base for anything you can do in AD. I'm a bit confused how you can possibly feel that you can solve it in a different way. Besides, not a real question, vague, would vote to close. (The question here is "What do you think?" No?) – LukeP Oct 26 '11 at 22:02

A good OU structure can make a huge difference in how easy it is to apply policies and settings to systems.

But do remember one key point about group policies. The can be applied to Groups. By default a policy will apply to authenticated users, but you can modify the permissions of the policy so that it only applies to a certain group. You can add computers and users into appropriate groups.

This is important to remeber because in creating your OU structure, you really shouldn't go over-board creating lots of OUs for every obscure configuration. You want to structure your OUs to handle the majority of the cases, but if you have an for a single system, it is probably better to modify the policy to not apply to the exceptional system, instead of creating a separate OU.

If you really want to stick with the defaults you could skip the OUs, and put all your policies at the root and create groups, and apply policies via group membership.

If you don't plan on using group policies at all, then you could use a package manage like WPKG, to deploy settings to your systems, but doing this would take more effort.

share|improve this answer
can you please clarify how WPKG might help in my situation ? I want a way to manage assets as to know where is workstation located and which user is using the station to avoid creating a functions such as assets controller – beng toms Oct 26 '11 at 18:18
You could use it to run a script to collect information from the local machine. It couldn't really grab the physical location, but it could get details about the system, what is installed, and so on. If you are really concerned about the physical assets, then nothing in software really can magically do that for you. – Zoredache Oct 26 '11 at 18:22
BTW, if you are really most interested in asset management, then you may want to make that more obvious in your question. Right now it seems like you are just asking if OUs and group policies are helpful. – Zoredache Oct 26 '11 at 18:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.