In our environment, an employee can have multiple managers. They can also be in multiple departments.

How can I accomodate this in active directory as the manager attribute appears to be a single value, and a user can only be in one OU?


My thoughts ...

  1. We are a "matrix-y" organization as well. Don't get trapped into thinking that AD structure needs to map to organizational structure. The AD structure is about how you organize resources, not about lines of authority. You may need to find your own structure to use. At this organization we start with (1) do they need local admin rights, then (2) execs and remote workers, then (3) primary physical location.

  2. You can use security and distribution groups to manage permissions, which will likely be very complex when people have more than one department and management chain. AD has means to reconcile conflicting permissions when a user is in multiple groups. You should do some experiments to understand that mechanism.

  3. As for the "department", "manager" and "direct report" fields, you should probably leave them blank unless someone assigns a primary for each user. HR may well have set primary manager and department for the payroll system.

  • 2
    Leaving AD fields empty is not an ideal solution as several linked features depends on them: automated shared calendar and team concept in Outlook, Organisation chart in SharePoint MySites... I do not recommend doing it. – Veynom Mar 12 '14 at 9:10

You come up with a standard format for the field and then concatenate the information into one string that satisfies that format and populate the respective fields.

Alternatively you can extend the AD schema with your own fields or use other multiple entry fields that you're not already using. Problem there, though, is getting client apps to read those fields...


If you want a user to be in multiple OUS you can use a 3rd party product which abstracts AD like ActiveRoles server. ARS has an object type called Managed Unit which allows for additional delegation of rights and application of ARS policies but AD does not see these objects so you cannot use GPOs.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.