I came across an AD today where the previous admin had set it up in where every AD object is in a child OU of Domain Controllers..........

     Domain Controllers
           Active Users

Tabs show that the OU is a child of the previous.

  1. What should I keep in mind when moving the computers back to the proper OU?

  2. What should I keep in mind when moving the other objects such as users and distrobution and security groups outside of the Domain Controller OU's child OU?

I will ensure GPO are properly applied to the correct OU but I am more concerned with effects this could have with our exchange 2003 server.....

Any one who has experience restructuring a improper AD structure please let me know your experience and issues in resolving matters such as these....

I understand in theory this may be OK but this is definitely not supported from microsoft and i have never seen ANYTHING like this....

For reference I came across this article. ITWORLD AD ARTICLE


This environment has one 2008 DC and two 2003 R2 DCs. They also have an Exchange 2003 Server. There are about 30 user workstations as well as a DFS system, RD Gateway, VPN, to name a few core services that may be effected by this.

  • Not sure why the guy made a big deal of that in that article. I've seen what he's describing as a supposed big problem in a number of large customer environments. The support boundary I'm familiar with is moving DCs out of the Domain Controllers OU all together. – Brian Desmond Feb 25 '11 at 18:39
  • After adjusting things ALOT of phantom issues have been miraculously resolved. – Campo Feb 25 '11 at 18:44

Wow, that's kinda crappy. Here's what I would do...

  1. Get intimately familiar with the current GPO structure. If anything is going to break, it will be that.
  2. Create a new structure in AD as you would like it organized. Create the OUs and all that, and link the correct GPOs to that OU.
  3. Move individual objects one at a time and test functionality as you go. If something breaks, move it back and figure out what happened. For critical servers/functions, schedule it after hours to reduce user impact.
  4. Rinse and repeat.

I don't know if there's a magic bullet, but this is how I would approach it.

| improve this answer | |
  • Also the 2008 DC when I click properties on a OU I cannot see the Group Policy tab. Only on the 2003 DCs... Any ideas? – Campo Feb 24 '11 at 19:49
  • 1
    To that last comment, Server 2008 has a separate MMC (Group Policy Management). Find it in Start -> Administrative Tools -> Group Policy Management. – Jeff McJunkin Feb 24 '11 at 21:15
  • AH! Thanks! Thought so but it was eluding me. +1 – Campo Feb 24 '11 at 21:19
  • Thank you very much for this info. A fast and straight forward response. – Campo Feb 24 '11 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.