Designing a suitable Active Directory structure

Question

Background:

This company is a software development company. The Managing Director (MD) manages contracts and project resources. Development Team A works on a mobile phone app. Development Team B works on another mobile phone app. Each team has a leader and a team of 50 staff.

The testing department is responsible for testing the applications of both development teams. The department has a leader and a team of 40 staff.

What we've agreed on:

• One Windows 2008 R2 server running Active Directory Service
• One Windows 2008 R2 server that acts as a file server containing:
  • Project contracts
  • Project resources
  • Mobile app source codes and basically all the development files that the development teams are working on
  • Test cases, test results

Simplified Hierarchical structure of organisation (http://i.stack.imgur.com/3OS6t.png) - I need 10 rep to post images.

I'm a little confused as to how to go about doing this because the file server is supposed to contain information that's used by the MD, both teams, as well as the testing department. I would like to know what is a suitable structure that can be used.

For example (I'm not sure if this makes sense):

company.local [Domain]

• MD [OU]
  • User [OU]
  • Files [OU] <- should this be considered an OU?
• TeamA [OU]
  • User [OU]
  • Files [OU]
• TeamB [OU]
  • User [OU]
  • Files [OU]
• TestDept [OU]
  • User [OU]
  • Files [OU]

Is this a good idea? If not, what would be good alternative AD OU structures?

Thanks!

Answer 1

I think you are confusing file structures with Active Directory structures.

You would normally create OUs in AD to reflect the logical organisation of your company (so things like different OUs for different departments are OK). However - the point of OUs is really for managing groups of computers or users separately via Group Policy: there is no control of file access via OUs directly.

So depending on how you want to setup group policy you could just have a single OU for all your users and another for all your computers and then create separate security groups for the different teams.

The way I generally do is then is for each folder/share on the server, create a security group. So for share "Finance" I would create security group "FS_Finance" and give that group permissions on the folder share. I would then add the "Finance Team" security group to the FS_Finance group (as they will need access) as well as individual users (such as an MD).

However... your questions suggest that you are not that sure about how Active Directory works. Because it essentially becomes the core of your network it is important to understand how to set it up in terms of things like DNS, DHCP etc. Also you need to consider have two AD domain controllers - what happens if your only domain controller dies? You won't be able to authenticate or access any domain resources.

Just some of the considerations, and it is worth soliciting external advice to ensure it is done correctly.