I wanted to create a new domain with a bit flat approach. Rather than having multiple OU's with sub-ou's and sub ou's depending on project, user location I wanted to create groups and put users in groups.
For example all users would be put in some OU=Users in DC=DOM,CN=LOC, and then multiple groups would be created:
However I end up thinking how to delegate permissions to those groups so that I can have manager reset passwords (or do other actions in Warsaw).
As it seems delegation is done per OU basis only I am still stuck to OU's if I want to have granular control (per project, location, sub location etc)? Or someone has done it and I'm simply missing something?