How do you OU?

[ajbritton]

In the 'quick question about redirecting folders' topic, Mark mentioned that he needed to have individual start menus for individual machines. The way I deal with this is to use a combination of organisational units and computer group membership. Generally, I map OUs to physical locations (e.g. ICT Suite, Library, Class 5 etc.) and if there is a logical sub-group of machines within and OU (say 5 machine in the ICT suite with Photoshop), then I put those machines in an AD group and use the group to control both the installation of the software (a filtered policy) and the content of the Start Menu (my logon script can check group membership before building start menus).

 

I was wondering what everyone else uses their OUs for....

[MkII]

I need pictures ajb!

 

I've only had single PC OU's since technology joined and wanted it - seems a bit inneficient but there ya go. I don't bother with group menus - just shared drives are mapped according to group membership.

 

The IT rooms are just seperated for easy internet removal

 

Domain -+
       |          +-Library          +-IT1
       |          |                  |
       |          |                  + No Internet
       |          +-IT Suites & SEN -+
       |          |                  +-IT2
       |          |                  |
       +-PCs------+-Art              +-IT3
       |          |
       |          |
       |          +-Citrix           +-TeacherT6
       |          |                  |
       |          |                  +-Food
       |          +-Technology-------+
       |                             +-T6
       |                             |
       |                             +-Textiles
       |
       |          +Green
       |          |
       |          +Red
       |          |
       |          +Blue
       |          |
       |          +Black
       +-Students-+
                  +Brown
                  |
                  +White
                  |
                  +Cyan
                  |
                  +No Internet

[DMcCoy]

I need pictures ajb!

 

I've only had single PC OU's since technology joined and wanted it - seems a bit inneficient but there ya go. I don't bother with group menus - just shared drives are mapped according to group membership.

 

The IT rooms are just seperated for easy internet removal

 

Domain -+
       |          +-Library          +-IT1
       |          |                  |
       |          |                  + No Internet
       |          +-IT Suites & SEN -+
       |          |                  +-IT2
       |          |                  |
       +-PCs------+-Art              +-IT3
       |          |
       |          |
       |          +-Citrix           +-TeacherT6
       |          |                  |
       |          |                  +-Food
       |          +-Technology-------+
       |                             +-T6
       |                             |
       |                             +-Textiles
       |
       |          +Green
       |          |
       |          +Red
       |          |
       |          +Blue
       |          |
       |          +Black
       +-Students-+
                  +Brown
                  |
                  +White
                  |
                  +Cyan
                  |
                  +No Internet

 

Don't you find that a bit restrictive? I hold all my users and computers in sub OU from the main domain, it means I can have a common policy at the top with computer and user options (for example, time server settings). Then I seperate users and computers a few levels down. This also means I can keep special OUs, my domain controllers and member servers away from any dangerous policy changes.

[MkII]

Seems a good idea. This has been like this since before my time - the sch paid lots of money for consultation.

[Ric_]

@mark: You must have really been bored to draw that! Also, do you paint your students different colours?

[tarquel]

Also, do you paint your students different colours?

 

lmfao

 

I've taken the p*** outta him with this one many times lol

 

Anyhow...

 

I have structure set out categoried - as we all do [i would have thought]

 

computer and user OU's - with sub-sections based on type - group - department - etc

 

I have specific GPO's for single tasks - i.e. disabling IE, allowing computer shutdown, accessing c drive. accessing optical drive, etc - and general GPO's i.e. default user policy, default staff policy, default desktop policy, IT suite default policy, etc.

 

Complex you may think but it does help tweaking things when needed and give greater control on sections of the GP [even if i do forget which setting has been enabled in which policy lol]

 

Nath.

[MkII]

Again ...pictures??

 

Didn't notice that line Ric! Very funny yeah!

 

Seems neat - I never have to re-create shares as we just rotate the colours.

[tarquel]

I gott too many posts to catch up on to waste time showing y'all with a picture at the moment.

 

I'll screen dump it instead - but you've seen it anyhow lol

 

N.