ADUC - where to put computer accounts

[LCPSWolf]

Hey all,

 

I'm new to server 2008 and GP and we're having bizarre issues with slow logins that appear to be due to GP. Love GP Extensions, but this is nuts.

 

Which leads me to my question - in a best practices scenario, should our computer accounts in AD be placed in the child OU's, and not left in the Computers OU?

 

Right now, we have all the computer accounts where they are automatically created. GP seems to work, but is (of course) hard to troubleshoot. Could this be causing our slow login issue?

 

Just trying to get some ideas - I know most of these questions can be answered by testing, which I'm definitely going to do as well.

 

Thanks so much!

[kmount]

I always build a hierarchical organisation and move machines from the Computers OU to the relevant place so that the correct Group Policies apply.

[DrPerceptron]

Isn't the Computers "OU" actually a Container - thus can't apply any policies apart from the Default Domain Policy?

 

If you're having slow logons - you could look into Environment Debugging - we've done some here in the last week and sorted out a lot of 30+ minute boot times. ( *shakes fist at WMI* )

[featured_spectre]

We created our own OU's in regards to computers. It looks like this

 

School Computers

--ICT 1

--ICT 2

--LAPTOPS

 

Each one has runs a default GPO within the school computers frame, then each room and laptops have there own individual GPO set up so that each room has specific settings.

[sted]

we usually set up ad looking roughly like this

containers=red ou=blue object=black

 

school.local

|

builtin

computers

foreign security principles

users

|

curriculum computers

|------

-------|suite

--------------|suitepc01

-------|upstairs

-------|downstairs

-------|staff room

curriculum users

-------|2003

-------|2004

-------|staff

-------|other

staff domain laptops

-------|Win Vista

-------|win XP

 

roughly i may have odd ones off there for say ms office (so suite would have an ms office 03 ou staff room would have an office 07 ou etc)(but i tend to do that using filters now) and i block inheritnce on staff domain laptops

Edited October 14, 2009 by sted

[bio]

I always build a hierarchical organisation and move machines from the Computers OU to the relevant place so that the correct Group Policies apply.

 

same here

 

bio..