Active Directory structure

[jmak]

We have multiple departments which have similar requirements for two machine builds, but obviously different users in each department.

 

In reach department, I essentially need to have machine types

1) Individual user device

2) shared device

 

But only users from that department should be able to login to machines in that department.

 

Would you create a hierarchy of machine type and with department below or the other way around?

 

Or is there a better way?

Or does it make no difference?

 

Many thanks

[mavhc]

You could also use groups. Filter gpo based on group, if gpo is for machine then use machine groups, if gpo is for user, then user groups

 

I have computers sorted by site, then room or staff laptop, or studentlaptops>class

Users I have by type (staff/student), then by site, then class

[psydii]

 

Would you create a hierarchy of machine type and with department below or the other way around?

 

 

 

Yes.

 

This question could have been taken from 70-221 Network Infrastructure Design which was considered to be the hardest of the Windows 2000 exams.

 

A generic answer is that the AD OU structure should either mirror the organisational administrative structure or the technical administrative structure, and then use group based security filtering to overlay which ever one is not represented by the OU structure. Then Employ loopback processing to support scenarios such as engineering dept member using a languages faculity computer (becuase the are also taking/lecturing in a Language)

 

However, the correct answer depends on "how are things set up at the moment" "which would be the most common configuration that needs to apply?" "which is likely to be the most common set of configurations that will be needed to be tweaked in day to day operations?". Finding the balance really is a local/personal decision.

 

Personally I sort of hybrid my own advice. Users / Computers are in separate OUs contained within a parent OU (for the purposes of scaling out beyond a single school) Students / Staff are in their own OUs. Students are further subdivided into year of entry OUs (simply to make it easier to manage administratively - setting are generally not applied the the YoE level). Computers are grouped into Facility/Department OUs, except IT suites which are their own OUs. Staff Laptops and Student 1:1 laptops are also their own OU with their Own settings. Adminstrative/Office PCs actually tend to be their own OU like Laptops/Suits and if faculty settings are appropriate they get them through group membership.

 

Where there are IT suites and staff laptops that need settings at the dept/faculty level, we apply those at the parent Devices OU and filter by group membership (which is where loopback processing comes in to ensure staff of a faculty get the faculty specific settings when on a faculty device).

 

Works for us very well.

 

A good rule of thumb is that the structure allows for the most common settings to be linked and applied once is the best one, and then use as few Sub OUs and Group based filters as possible to apply exceptions.

[jmak]

 

Would you create a hierarchy of machine type and with department below or the other way around?

 

 

 

Yes.

 

 

That's the answer I gave to "either/or" [emoji16]