7.1.3 OU Notes

Organizational Units (OUs)

An Organizational Unit (OU) is a container that subdivides and organizes network resources within a domain, similar to a folder structure. OUs can contain other OUs, users, computers, printers, and any object type.

Key characteristics:

  • Enable logical organization of network resources

  • Support hierarchical nesting (parent OUs contain child OUs)

  • Recommended max nesting level: 10 (prevents slowdowns and GPO complications)

OU Organization Methods:

  • Physical location (country, city)

  • Organizational structure (HR, Sales, IT departments)

  • Object type (user accounts, computers)

  • Hybrid location + organizational structure

Default Containers and OUs

When Active Directory is installed, these default containers/OUs are created automatically and cannot be renamed, deleted, or have Group Policy applied:

Container

Type

Purpose

Domain

Container

Root container holding all objects in the domain

Builtin

Container

Default service administrator accounts

Computers

Container

Default location for new computer accounts

Managed Service Accounts

Container

Contains all Managed Service Accounts

Users

Container

Predefined users and groups; default location for new user accounts

Domain Controllers

OU

Default location for domain controller computer accounts

OU Management Features

Group Policy

  • Group Policy Objects (GPOs) apply to OUs, not containers

  • Policy settings inherit from domain/parent OUs to child OUs

  • Create separate OUs for objects requiring different policy settings

Preventing Accidental Deletion

  • Objects can be accidentally deleted via Active Directory Users and Computers

  • Two main deletion types:

    • Leaf-node deletion: Deleting a leaf object (no children)

    • OU deletion: Deleting an OU deletes all objects within it (including child OUs)

  • Protection: When creating an OU, "Protect container from accidental deletion" is selected by default

  • Enable/disable via: Right-click OU → Properties → Object tab → Advanced Features → Check/uncheck "Protect object from accidental deletion"

Delegating Authority

  • Assignment of administrative tasks to appropriate users/groups

  • Allows decentralized management while maintaining security

  • Delegation methods:

    • Object-based: Control specific object types (e.g., user accounts)

    • Task-based: Control based on administrative task type

  • Common tasks to delegate: User account management, password resets, group membership management