AD Structure

[detjo]

Hi all

 

I've been out of IT for a few years and just looking to get back into it. I was recently looking at AD structure in a handful of Primary schools and on first glance it seems a bit of a mess - as does GP.

I'm interested to see how others have set up their AD structure, or based on things you have learned from the existing one .. what you would change.

 

I guess I'm kinda looking for a 'best way to set it up'

 

I realise I can't just go change it all, but I would like to put some projects in place to make some changes over the coming months.

 

Feel free to include some screenshots with obvious personal info hidden.

 

Thanks

[TechMonkey]

I create Devices, Servers, and People OUs and have all entries in there, I do not use the Users or Computers OUs.

 

Under Devices I have OUs based on what I might want to apply GPOs to. So currently I have Locations and then Laptops and Desktops. Under Desktops I have an OU for locations that have multiple PCs in, so Art cluster, DT cluster, IT rooms, etc.

Under Servers I have OUs for Domain Controllers and Virtual Servers and then RDS Hosts under Virtual Servers.

Under People I have:

- Exam Users

- External

- Pupils

-- 2022

-- 2021

-- etc

- Service

- Staff

[mavhc]

School:
 Computers:
   Site 1:
     Desktop Location 1
     Teacher Laptops
     Laptops:
       Class 1:
       Class 2:
 Groups:
 Users:
    Students:
       Site 1:
          Class 1:
          Class 2:
          Exam:
             Class 1:
             Class 2:
    Governors:
    Assistants:
    Office:
    SMT:
    Teachers:
        Site 1:
        Site 2:
        Supply:

 

Really all depends how you want to assign GPOs. Computers are GPO'd per site more, Users are GPO'd per type more, so the site level is inverted

[Davit2005]

Set an OU that suits the organisation and makes GPO easy to manage. i.e. you could have a top level computer level and set general policies then as you drill down you can get more specific. For example at a previous place I deployed followme printers via GPO to different floors in buildings then IT rooms had their own room printers. I made the room printer default in some cases whilst giving the option of the MFD on the same floor for followme printeing as a backup.