3

i would like to adopt the best structure for my active directory domain, in order to be able to apply GPO efficiently. Here is my schema : CompanyName\ServiceName{Users, Groups, Workstations, Laptops}

My first question is about geographical sites : we have two geographical sites, is it better to create this sort of hierarchy : CompanyName\GeographicalSiteName\ServiceName{Users, Groups, Workstations, Laptops} or handling geographical sites GPO using Sites policy ? Indeed, this organization can lead to have to duplicate some services, if they are split on 2 sites.

My second question is about the {Users, Groups, Workstations, Laptops}, do you think there is better organization ?

Thanks very much

1
  • Unfortunately there is no One True Way to organize Active Directory. The best advice I can give you is to build your domain on paper a couple of different ways, then play with it ("John Doe moves from geographical location 1 to geographical location 2 -- how much trouble does this cause?" ; "Sarah Smith used to work in accounting, but now she's managing part of the production line -- how many changes do I need to make?", etc...) - Pick the least painful design to work with...
    – voretaq7
    Aug 29, 2013 at 16:00

1 Answer 1

3

This is a very open ended question and a lot of it is determined by your organizations operational methods. Do you work across geographical boundaries a lot or are most things constrained to specific sites?

My personal preference is to create several low level OUs

/people
/groups
/services
/hosts

People are organized based on Org structure (logically).

Groups are also based on Org structure (contains users, eg "IT-Operations")

Services contain service accounts and 2+ groups for each service (eg "File Server Admins" which would be a member of "File Server Users") which ONLY contain the Org groups. In this case you'd add IT-Operations to File Server Admins and File Server Admins to the Administrators local group on your file servers.

Hosts should contain anything with a IP address that's on the domain (or needs to be represented in AD like printers etc). I break them up geographically since they are physical resources & the Computer GPOs frequently need to respect location.

DNS is aligned with hosts because for instance my file server DFS is "files.site.compay.local" and print server "print.site.compay.local. Since DHCP generally gives folks the right search suffix even if a user goes to another site they still can print to \print and get to their home directory at \files with out changing anything (assuming DFS-R or something similar to synch homedirs).

1
  • 3
    Only, don't actually use .local :) Aug 29, 2013 at 15:10

Not the answer you're looking for? Browse other questions tagged .