We are looking to add some logical structure to our (Win 2003) AD hierarchy. We have a single domain and around 500 users. All users and computers are currently organized into one OU. All security and distribution groups are in a second OU. Group membership is essentially on an individual user basis with no nesting of groups.
My questions:
- For an organization of this size is it worth desgining a hierarchy of OUs based on department, geography and/or object class (ie computers, users, groups) and moving the users, computers and groups into the relevant OUs?
- If so, how would you structure the hierarchy e.g. department->location->object class?
- Should we nest groups, where appropriate, for better mapping to enterprise application roles and Exchange address entries?