JoHimself

Although 100% virtual is a Microsoft supported configuration.

I don't think I'd notice either, even though I play DayZ (the ArmA engine is very CPU intensive). Sandybridge chips were really good.

I have an i7 2600K, the CPU is definitely not the bottleneck, really good CPUs. If I were you I'd get a nice 500/600W 80+ PSU and a GTX 960/970

Again, conversely it is no more reliable than virtual.

Conversely your mission critical systems are best protected by the HA systems available in virtualised environments. And technology such as DRS can help to improve the performance of key systems. And virtualisation means, even in the event of hardware failure, key systems can be brought back up quickly.

Regarding brands I tend to use the same brands as I would trust for motherboards. I currently have a Gigabyte GTX 970 G1 Gaming. I avoid Palit and wouldn't touch anything which is designed for small cases (single slot, half height) because these tend to perform worse than full sized GPUs. I'd say the rest of your machine is fine.

Regarding departments, I would populate the department field on the user account rather than have a separate OU for each. While you are doing this it is definitely worth a rethink on your GPOs. Do you need all of the settings you deploy? Are the same settings delivered using different policy objects? Do you use enforcement or blocked inheritance? As many have said, Keep It Simple; if enforcement/blocked inheritance is required then there needs to be a VERY good reason to do it. Likewise as AD grows there are tendencies to put in "quick fixes" etc which may no longer be required. It may be more appropriate to deliver settings via GPPs, there may be XP only policies which are still deployed but no longer required. If you redesign the whole strategy it can sometimes be easier than just restructuring your OUs.

Sorry, was suggesting the Raspberry Pi as the client device.

A GTX 960 or above will easily play current games at 1080p with settings set to high. Is the rest of your machine up to snuff?

+1 for Kodi Have a backend device recording/streaming the TV channels and a client device to watch on. If the TV has CEC then I'd suggest a Raspberry Pi with Kodi installed; you can use the dpad and media buttons on the TV remote.

What's the native resolution of your monitor?

Look out for deals on a GTX 960. I have a 970 (upgraded from Crossfire 6950s) and absolutely love it. What resolution do you play at?

Quite the contrary I would always put the organisation name as an OU in the root of the domain to separate it from the default OUs and containers. This can help with delegation and allow you to set a GPO at the root of everything.

Bit "Quick n Dirty" but could you prevent access to wpad from DirectAccess clients using a firewall rule?

You need to think about why you are putting users in a separate OU and where that OU needs to reside to do the job most efficiently. Things to think about based on the structure you propose: Do your teaching staff need to be separate from support staff? Could you use AD groups instead of OUs? Could you get your different systems which query AD to look for something other than OU? If you have things like Department as AD properties, could you leverage that to differentiate using Group Policy Preferences? Do your external users need to be a subset of users? Do these users ever log on to a machine or are they in AD to give them a mailbox? What is the difference between "SchoolName > Accounts > Devices" and "SchoolName > Devices"? Do these distinctions need to be made? Think about GPO flow. If you were to put a GPO at the top of each OU would you need to duplicate settings into multiple OUs? Are "Corporate" machines imaged using SCCM or similar? Does the OSD tool dump machine accounts into specific OUs? (Does the OSD tool differentiate between Desktops and Laptops for example)