OU=1.2.1 POS Checkout Line,OU=1.2 POS,OU=Testing,DC=contoso,DC=net

My boss wants to have enumerated container names in active directory. I am opposed to it. While I suppose in theory this should work, it very much rubs me the wrong way. For one thing, I have not seen an example of anyone doing this. So I don't have evidence that it won't work, and cannot think of a reason not to do it other that its really annoying..

Could I have some feedback.. preferably thoughts on what may not work as a result.For some reason, just proper naming is not good enough for him...

Please advise..

Bad sysop

  • 1
    It might make scripting interesting if the display name and object are the same. – Jim B Jul 9 '15 at 18:44

Generally speaking this isn't a technical problem. Microsoft allows any characters to be used in OUs and it's LDAP client communicates fine with them. You would need to verify you don't have any third party LDAP clients that would choke on special characters.

Here is the MS KB on what is allowed for AD:


  • I realize that technically it doesn't break any rules, But it is really annoying to enumerate each container name at each level.... The struggle is real. I sincerely hope that some system chokes on it. – Bad Sysop Jul 9 '15 at 19:25
  • Actually no, it is easier - you just enumerate by the NUMBER and ignore the rest. The Number is often following the coding of an organizational diagram, so it is something that for example is hanging in a wall somewhere showing which departments exist. – TomTom Jul 9 '15 at 19:43
  • But its not layed out that way. Under testing is: 1.1 Servers (with nothing in it) 1.2 POS inside it is: 1.2.1 POS Checkout lin 1.2.2 POS Window 1.2.3 POS order taking 2.1 Accounting under it is : 2.1.1 accounting managers 2.1.2 accounting associate 2.2 Front End Under it is : 2.2.1 Frontend Manager 2.2.2 Window Cashier Just don't see the logic in it.. – Bad Sysop Jul 9 '15 at 20:04
  • I would recommend against that example as it would make managing your group policy tedious. If you grouped similar OUs you could benefit from inheritance and have less gpo links, but it's kind of minor. Being in a PCI environment every change you make will have to be documented and tested anyways. – Bad Dos Jul 9 '15 at 21:06
  • We are moving to needing PCI compliance... – Bad Sysop Jul 10 '15 at 14:04

1) It doesn't do any harm technically; 2) My boss wants it; 3) My boss decides how much I get paid

what more I can argue against it?

  • my boss doesn't get to support it, I do. When I have to propose an expected outcome, there are no examples of other people who do the same thing. Because no one does it. How many cute situations would you like to have in an environment that you have to support before the reason that something doesn't work has to be one of those cute and clever things that no one else does.. that technically doesn't break the rules.. but no one does it.. – Bad Sysop Jul 9 '15 at 20:15
  • I don't see how this naming scheme causes any support issue. What your boss proposed may seem a bit out of ordinary, but I am not sure if anyone can find a legit cause to oppose it, meaning it's something benign, something isn't worth fighting against. – strongline Jul 11 '15 at 1:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.