0

OU=1.2.1 POS Checkout Line,OU=1.2 POS,OU=Testing,DC=contoso,DC=net

My boss wants to have enumerated container names in active directory. I am opposed to it. While I suppose in theory this should work, it very much rubs me the wrong way. For one thing, I have not seen an example of anyone doing this. So I don't have evidence that it won't work, and cannot think of a reason not to do it other that its really annoying..

Could I have some feedback.. preferably thoughts on what may not work as a result.For some reason, just proper naming is not good enough for him...

Please advise..

Bad sysop

1
  • 1
    It might make scripting interesting if the display name and object are the same.
    – Jim B
    Jul 9, 2015 at 18:44

2 Answers 2

1

Generally speaking this isn't a technical problem. Microsoft allows any characters to be used in OUs and it's LDAP client communicates fine with them. You would need to verify you don't have any third party LDAP clients that would choke on special characters.

Here is the MS KB on what is allowed for AD:

https://support.microsoft.com/en-us/kb/909264

5
  • I realize that technically it doesn't break any rules, But it is really annoying to enumerate each container name at each level.... The struggle is real. I sincerely hope that some system chokes on it.
    – Bad Sysop
    Jul 9, 2015 at 19:25
  • Actually no, it is easier - you just enumerate by the NUMBER and ignore the rest. The Number is often following the coding of an organizational diagram, so it is something that for example is hanging in a wall somewhere showing which departments exist.
    – TomTom
    Jul 9, 2015 at 19:43
  • But its not layed out that way. Under testing is: 1.1 Servers (with nothing in it) 1.2 POS inside it is: 1.2.1 POS Checkout lin 1.2.2 POS Window 1.2.3 POS order taking 2.1 Accounting under it is : 2.1.1 accounting managers 2.1.2 accounting associate 2.2 Front End Under it is : 2.2.1 Frontend Manager 2.2.2 Window Cashier Just don't see the logic in it..
    – Bad Sysop
    Jul 9, 2015 at 20:04
  • I would recommend against that example as it would make managing your group policy tedious. If you grouped similar OUs you could benefit from inheritance and have less gpo links, but it's kind of minor. Being in a PCI environment every change you make will have to be documented and tested anyways.
    – Bad Dos
    Jul 9, 2015 at 21:06
  • We are moving to needing PCI compliance...
    – Bad Sysop
    Jul 10, 2015 at 14:04
1

1) It doesn't do any harm technically; 2) My boss wants it; 3) My boss decides how much I get paid

what more I can argue against it?

2
  • my boss doesn't get to support it, I do. When I have to propose an expected outcome, there are no examples of other people who do the same thing. Because no one does it. How many cute situations would you like to have in an environment that you have to support before the reason that something doesn't work has to be one of those cute and clever things that no one else does.. that technically doesn't break the rules.. but no one does it..
    – Bad Sysop
    Jul 9, 2015 at 20:15
  • I don't see how this naming scheme causes any support issue. What your boss proposed may seem a bit out of ordinary, but I am not sure if anyone can find a legit cause to oppose it, meaning it's something benign, something isn't worth fighting against.
    – strongline
    Jul 11, 2015 at 1:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .