7.1.3 OU Notes

What is an Organizational Unit (OU)?

A container that subdivides and organizes network resources within a domain, similar to a folder structure

What can an OU contain?

Other OUs, users, computers, printers, and any object type

What is the recommended maximum nesting level for OUs?

10 levels; too many nested OUs can slow resource requests and complicate Group Policy application

Name four ways OUs are typically organized

Physical location, organizational structure, object type, hybrid location and organizational structure

Which default container holds service administrator accounts?

Builtin

Which default container is the root container for the domain?

Domain

Which default container is the default location for new computer accounts?

Computers

Which default container holds Managed Service Accounts?

Managed Service Accounts

Which default container is the default location for new user accounts?

Users

Which default container/OU holds domain controller accounts?

Domain Controllers

Can default containers be renamed, deleted, or have Group Policy applied?

No, default containers cannot be renamed, deleted, or have Group Policy applied

What are Group Policy Objects (GPOs)?

Policy objects that apply to OUs; settings inherit from domain/parent OUs to child OUs

Why would you create separate OUs?

To apply different Group Policy settings to different groups of objects

Define leaf-node deletion

Deletion of a leaf object (an object without child objects), also called a subordinate object

Define OU deletion

Deletion of an OU, which also deletes all objects within it, including any child OUs

What is the default setting when creating an OU in Active Directory Users and Computers?

"Protect container from accidental deletion" is selected by default

How do you enable or disable OU protection from accidental deletion?

Right-click the OU → Properties → Object tab → Advanced Features → Check/uncheck "Protect object from accidental deletion"

What is delegating authority?

The assignment of administrative tasks to appropriate users and groups

Name three common administrative tasks that can be delegated

User account management, password resets, group membership management

What are the two types of delegation design?

Object-based (control specific object types) and task-based (control based on type of administrative task)

What tools can be used to delegate authority?

Delegation of Control Wizard and Authorization Manager console