I'm currently trying to design the OU and Group design for a new AD deployment. Firstly, taxonomy is hard. As a first guess attempt, we're trying to keep all User objects together in OU=Users
, and some sub-OU beneath that.
We've got a bunch of Team and Subteam OUs, and some Toolset OUs, which group by what functional teams people are in, and also by what tools they need access to.
We'd like to keep users in the Users OU, and each Team OU contains a Security Group object, which we can add Users to when they join teams, or need toolset access.
Here's how the AD is laid out:
Domain Root
|
|
\--OU=Users
| |
| \--OU=Staff
| | \-Username=Tom.OConnor, MemberOf=RedTeam
| |
| \--OU=Contractors
| |
| \--OU=Visitors
|
|
\--OU=Teams
| |
| \--OU=RedTeam
| | \-GroupName=RedTeam
| |
| \--OU=BlueTeam
| | \-GroupName=BlueTeam
| |
| |
| \--OU=GreenTeam
| | \-GroupName=GreenTeam
|
|
|
\--OU=Toolsets
| |
| \--OU=DevTools
| | \-GroupName=DevTool_CITool
| |
| |
| \--OU=InternetAccess
| | \-GroupName=InternetAccess
User Tom.OConnor
is in Group RedTeam.
A GPO is applied to OU=RedTeam,OU=Teams
.
The GPO Results wizard shows that this GPO has not been applied to the Tom.OConnor
user.
Conversely, a GPO applied to OU=Staff,OU=Users
is applied to the Tom.OConnor
user.
So is it possible to apply a GPO to an OU, containing a Group, and have the GPO subsequently trickle down, and be applied to all members of the Group?