We have all our computers currently in the root OU for computers. I'd like to start cleaning this up so I can track changes going forward. (Currently too many people have the admin password but that's another issue)

If I create a sub OU for say servers, and then move all the server into it, another for users that I know exist, another for very old system machines etc will there be anything noticeable from the user side of things?

We currently have no working GPO's assigned to the groups and the remaining ones are being checked and removed so I don't think that'll cause any issues.

3 Answers 3


If you have no GPO setup at all, then nothing should change. This will just be a sorting within the AD for you. Once this is done it's a great way to then start to use GPO's to lock down things.


When we did something similar we had our LDAP users start getting failures as the DNs had moved on them. It was an in house ap though, so you may not have that problem.

  • What was the failure relating to? I'm had similar when we organised our users setup last year.
    – Ryaner
    Commented Aug 23, 2009 at 7:50
  • Echo the problem with LDAP - if an app is not fully integrated into the AD or if it makes policy decisions based on the Distinguished Name of an object then moving objects within the AD might have some effects.
    – Helvick
    Commented Aug 23, 2009 at 11:16
  • Echo again for us ... we have LDAP apps that are cemented to the DN's of where users and groups are; dumb apps refuse to search for things to get DN's before using them. Luckily for us we can move computer objects.
    – JamesR
    Commented Aug 25, 2009 at 17:15

You should be fine with moving them; we've been doing it as a matter of standard policy for 8 or 9 years now without a problem. Just don't move your DCs, that's all.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .