DanielFew Posted November 25, 2015 Posted November 25, 2015 (edited) I'm currently looking at re-doing out Active Directory structure as it's becoming messy over the years. I was thinking of the below, but can anyone give input as to any suggestions or changes. I'm laying it out as I have so I can split Internal / External Users for VLE access etc. At the moment it feels like I'm wasting a lot of OU's, eg. you must go to School Name, Accounts, Users, Internal, Staff, Teaching Staff, Department Name, User just to get to a staff account. -- School Name ------ Accounts ------------ Devices ------------------ Wi-Fi ------------------ Tablets ------------ Users ------------------ Internal ------------------------ Staff ------------------------------ Teaching Staff ---------------------------------- English ---------------------------------- Maths ---------------------------------- Science etc. ------------------------------ Support Staff ---------------------------------- IT Support ---------------------------------- SEN ---------------------------------- Admins ---------------------------------- Science Tech ------------------------ Students ------------------------------ [ Year of Entry ] ------------------------------ [ Year of Entry ] ------------------------------ [ Year of Entry ] ------------------------------ [ Year of Entry ] ------------------------------ [ Year of Entry ] ------------------ External ------------------------ Federation Students ------------------------ Governors ------------------------ External Support ------ Devices ------------ Desktops ------------ Laptops Edited November 25, 2015 by DanielFew
JoHimself Posted November 25, 2015 Posted November 25, 2015 You need to think about why you are putting users in a separate OU and where that OU needs to reside to do the job most efficiently. Things to think about based on the structure you propose: Do your teaching staff need to be separate from support staff? Could you use AD groups instead of OUs? Could you get your different systems which query AD to look for something other than OU? If you have things like Department as AD properties, could you leverage that to differentiate using Group Policy Preferences? Do your external users need to be a subset of users? Do these users ever log on to a machine or are they in AD to give them a mailbox? What is the difference between "SchoolName > Accounts > Devices" and "SchoolName > Devices"? Do these distinctions need to be made? Think about GPO flow. If you were to put a GPO at the top of each OU would you need to duplicate settings into multiple OUs? Are "Corporate" machines imaged using SCCM or similar? Does the OSD tool dump machine accounts into specific OUs? (Does the OSD tool differentiate between Desktops and Laptops for example)
TechMonkey Posted November 25, 2015 Posted November 25, 2015 (edited) Mine looks something like: -People ----Contacts ----Guests ------OUS TO ORGANISE GUESTS ----ITAdmins ----Service ------OUS TO ORGANISE SERVICE ACCOUNTS ----Staff ------Support ------Teaching ----Students ------OUS BY START YEAR -Devices ----Kiosk ------OUS TO ORGANISE KIOSKS ----Staff ------Offices ------Teaching ------Workroom ----Student ------OUS TO ORGANISE STUDENT AREAS -Groups ----Devices ----Distribution ----People I also name the OUs to identify them easily, so all OUs under People start "peo", all under Devices start "dev" etc so there is no confusion where something is. I wouldn't bother putting your school name as an OU at the top, unless you mean that is your site code, as you will just have to something extra to type and it can get confusing if your top level also has your school name in. Edited November 25, 2015 by TechMonkey
JoHimself Posted November 25, 2015 Posted November 25, 2015 I wouldn't bother putting your school name as an OU at the top, unless you mean that is your site code, as you will just have to something extra to type and it can get confusing if your top level also has your school name in. Quite the contrary I would always put the organisation name as an OU in the root of the domain to separate it from the default OUs and containers. This can help with delegation and allow you to set a GPO at the root of everything.
mjs_mjs Posted November 25, 2015 Posted November 25, 2015 it the corp world you will often find a structure like ORG OU -- Org workstations -- -- Locations -- Org Users -- -- Staff -- -- Contractors -- Org Admins -- Org Servers (no gpo inheritance) Each top level OU starts with he org name/code as when acquisitions happen and the AD's get merged/integrated it helps segregate things until it all gets sorted. Normally computers and the other default OU's/containers are left alone and not used. Use delegation to drop computers into the correct OU when they're added to the domain(s). It's all about what suits the policy enforcement structure and segregation of groups of objects really. Most policies now use security groups to pick the objects they apply to.
DanielFew Posted November 25, 2015 Author Posted November 25, 2015 You need to think about why you are putting users in a separate OU and where that OU needs to reside to do the job most efficiently. Things to think about based on the structure you propose: Do your teaching staff need to be separate from support staff? Could you use AD groups instead of OUs? Could you get your different systems which query AD to look for something other than OU? If you have things like Department as AD properties, could you leverage that to differentiate using Group Policy Preferences? Do your external users need to be a subset of users? Do these users ever log on to a machine or are they in AD to give them a mailbox? What is the difference between "SchoolName > Accounts > Devices" and "SchoolName > Devices"? Do these distinctions need to be made? Think about GPO flow. If you were to put a GPO at the top of each OU would you need to duplicate settings into multiple OUs? Are "Corporate" machines imaged using SCCM or similar? Does the OSD tool dump machine accounts into specific OUs? (Does the OSD tool differentiate between Desktops and Laptops for example) Thanks for your input. SchoolName > Accounts > Devices are for accounts assigned to a device rather then a person. For example, ipad_wifi so the ipads have a login to connect etc. External Users do have logins, and I wanted to make sure they are split from Internal so we can make our VLE use Internal. Apparently there's no other way, plus we have a fair amount of Internal and External users, so is it good to keep them separated? Teaching Staff vs Support Staff, we have about 100 in each, again is it not better to keep them seperated? Otherwise you'd end up with a lot of users in one OU? Also, we would create sub OU's such as English, Maths, Science in Teaching and IT Support, Admin, SEN in Support Staff.
sted Posted November 25, 2015 Posted November 25, 2015 Teaching Staff vs Support Staff, we have about 100 in each, again is it not better to keep them seperated? Otherwise you'd end up with a lot of users in one OU? Also, we would create sub OU's such as English, Maths, Science in Teaching and IT Support, Admin, SEN in Support Staff. if you arnt applying different policies to them then there isn't much reason imo the only one is it looks a bit tidier to have ous that don't have pages of objects. My personal opinion is keep it as simple as possible
sparkeh Posted November 25, 2015 Posted November 25, 2015 I don't think that there is any 'right' answer but personally I prefer to keep AD simple and use Security Groups to filter things like GPOs. I find that the actual structure of AD is rarely important these days.
DanielFew Posted November 25, 2015 Author Posted November 25, 2015 (edited) if you arnt applying different policies to them then there isn't much reason imo the only one is it looks a bit tidier to have ous that don't have pages of objects. My personal opinion is keep it as simple as possible I understand what you're saying. I think Teaching Departments they would want kept as it is split into departments. However definitely for support where we have Exams, Finance, Sec could all definitely be combined into Admin. My aim, as you mentioned though, is to simplify it. At the moment we have users everywhere and anything outside of the main school staff, there's no standard for usernames. Some are This_Username, some are ThatUsername, others are That.Username, some are just ThUsr, so I want to try and standardize it. Edited November 25, 2015 by DanielFew
TechMonkey Posted November 25, 2015 Posted November 25, 2015 Quite the contrary I would always put the organisation name as an OU in the root of the domain to separate it from the default OUs and containers. This can help with delegation and allow you to set a GPO at the root of everything. Interesting point. As ever I guess horses for courses. I put GPOs at the Devices OR the People OU as I try and keep computer and user GPOs seperate. If I was delegating then I would delegate at the lowest level possible. If they need whole level AD access then they would be an admin so have access anyway. I can understand in a large Corp that being the case though. Just seems like an added unnecessary level. But having been stuck with an AD that had long schoolname plus incredibly long TLD for a long period and the schoolname was the first bit of the TLD causing much confusion, I may be biased against it.
sted Posted November 25, 2015 Posted November 25, 2015 I understand what you're saying. I think Teaching Departments they would want kept as it is split into departments. However definitely for support where we have Exams, Finance, Sec could all definitely be combined into Admin. My aim, as you mentioned though, is to simplify it. At the moment we have users everywhere and anything outside of the main school staff, there's no standard for usernames. Some are This_Username, some are ThatUsername, others are That.Username, some are just ThUsr, so I want to try and standardize it. you can split them via groups and will "they" ever see your active directory layout anyway? its no overhead to have teachers split into science/maths etc but if you need to reset freds password (or do something else to his account) you then have to remember what department hes in so its arguably less efficient
DanielFew Posted November 25, 2015 Author Posted November 25, 2015 I've heard of EduGeek before, but never posted or looked much into it. I need to start using it more often... nice to hear other people's views and how they get around problems.
TechMonkey Posted November 25, 2015 Posted November 25, 2015 Thanks for your input. SchoolName > Accounts > Devices are for accounts assigned to a device rather then a person. For example, ipad_wifi so the ipads have a login to connect etc. I would count these as Service accounts. They go with LDAP interrogation, kiosk and DB accounts. As sparkeh says though, do it how it works for the school, but think hard about the future and make sure it makes sense for why things are split. If you want a real test get someone else in, non-IT, and ask if the way it is split makes sense. If you can justify it to them then it will probably be OK.
DanielFew Posted November 25, 2015 Author Posted November 25, 2015 you can split them via groups and will "they" ever see your active directory layout anyway? its no overhead to have teachers split into science/maths etc but if you need to reset freds password (or do something else to his account) you then have to remember what department hes in so its arguably less efficient Sorry, 'they' being the other IT Support Tech and IT Manager. Whenever I need to change settings on a user, I always search for them anyway. I'll talk to them and see why they think splitting them in necessary, as it would definitely make AD a lot more organised.
DanielFew Posted November 25, 2015 Author Posted November 25, 2015 I would count these as Service accounts. They go with LDAP interrogation, kiosk and DB accounts. As sparkeh says though, do it how it works for the school, but think hard about the future and make sure it makes sense for why things are split. If you want a real test get someone else in, non-IT, and ask if the way it is split makes sense. If you can justify it to them then it will probably be OK. Much better way to describe them, service accounts. I knew device accounts didn't sound right. So I suppose really considering we only have a few for each, there's no need again to split into Sub OU's and just have all Service Accounts in one.
Joanne Posted November 25, 2015 Posted November 25, 2015 (edited) I have: School Name -Users --Staff --Pupils ---IntakeYears -Computers --Class Laptops --Trolley 1 --Trolley 2 --Teacher Laptops --Office Machines --Windows 8.1 --Windows 10 --ETC Le edit: I'm a primary, so will be a bit simpler. Even in a secondary I would start with users and computers... Edited November 25, 2015 by Joanne
sidewinder Posted November 25, 2015 Posted November 25, 2015 I separate staff a lot with OUs, mainly for my own sanity so I can quickly see who someone is and where they work. I also liberally use the description field for this. But for GPOs, there is one staff one per department (Senior, Junior, Nursery) and then any differences in folder redirection etc are done with security groups
TechMonkey Posted November 25, 2015 Posted November 25, 2015 Much better way to describe them, service accounts. I knew device accounts didn't sound right. So I suppose really considering we only have a few for each, there's no need again to split into Sub OU's and just have all Service Accounts in one. You could have all the device service accounts in a sub OU. You would then be able to set properties on them (no logon to a physical machine, special background so easily noticeable if someone does log on as it, etc) without affecting any others, plus it makes it a bit tidier. I currently only have one sub OU which is to siphon off mail accounts that have no user allocated, so help desk mailboxes and the like. All the others are just sensibly named and a description added so anyone coming along after my demise knows exactly what it is and does. I have also instigated a no reusing policy, so there should be no overlap of service accounts saving on confusion if one has to be changed.
Chuckster Posted November 25, 2015 Posted November 25, 2015 I have it simple here. This is how it looks in AD... Accounts --Admin --SMT --Students ----2012 ----2013 ----2014 ----2015 --Teachers --Non-Teachers --Site Management --System Administrators Workstations --Admin ----Headteacher's Office ----Deputy Headteacher's Office ----Admin Office ----Etc --Curriculum ----Room 01 ----Room 02 ----Room 03 ----ICT Suite 1 ----Etc
JoHimself Posted November 25, 2015 Posted November 25, 2015 Regarding departments, I would populate the department field on the user account rather than have a separate OU for each. While you are doing this it is definitely worth a rethink on your GPOs. Do you need all of the settings you deploy? Are the same settings delivered using different policy objects? Do you use enforcement or blocked inheritance? As many have said, Keep It Simple; if enforcement/blocked inheritance is required then there needs to be a VERY good reason to do it. Likewise as AD grows there are tendencies to put in "quick fixes" etc which may no longer be required. It may be more appropriate to deliver settings via GPPs, there may be XP only policies which are still deployed but no longer required. If you redesign the whole strategy it can sometimes be easier than just restructuring your OUs. 1
Ripleys Posted November 26, 2015 Posted November 26, 2015 Domain - Domain OU >- Users --- Staff ---- Admin ----- Role ---- Teaching ----- Department --- Students ---- Year of Entry >- Workstations --- Department/Office ---- Classroom Name/Number >- Groups >- Resources
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now