Mike,
I think most people would recommend, as would I, designing your OU structure to model your organizational/administrative model. If you administer your users based on Region/Country/City/Office, then it might make sense for you to design your OU structure that way. It sounds that you've already at least made the decision to initially separate things out based on region.
If you don't manage your users based on geography, but on something like function (Market, sales, finance, etc.), it may make sense for you to create your OU structure that way.
If you can provide more info about the organization of your support structure, it would help to provide you with more accurate advice.
-Joel
PS:
When in doubt, hire an expert. I know there are plenty of consulting companies that would be more than happy to take your money to tell you want to do. :)
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Mike Baudino
Sent: Thursday, March 04, 2004 12:19 PM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] OU design quandary
All,
We are in the final stages of a global AD design for our company. The
design will have two user domains -- one for North America and one for
Europe -- and it will have an empty root. Each of the user domains will
have approximately 35,000 users. Software distribution will be via Tivoli.
Two camps have emerged regarding OU structure and there's a rather large
gap between them. I'm asking for your expert and experienced input to help
resolve this issue.
Camp one:
We're going to search instead of browse. So put all users in a single
users OU, put all desktop machines in a single desktops OU, put all laptops
in a single laptops OU, put all IIS servers in a single OU, all SQL servers
in a single, etc, etc, etc. Manage by groups instead of by OU in which the
object resides.
Camp two:
Regardless of whether we're going to search or browse, at some point having
office heirarchy in the OU design will be helpful enough that it's
necessary to build it now. Users, desktops and laptops will be grouped as
child OUs to the office OUs. Servers for applications will be grouped by
function and then by the , by the application suite or ASP that is
responsible for the application. Allows more granular delegation and
application of group policy.
We have too little actual deployement and management experience in Active
Directory, especially this size, to make a definitive decision so I would
appreciate any and all feedback regarding the pros and cons.
Thanks,
Mike
******************* PLEASE NOTE *******************
This E-Mail/telefax message and any documents accompanying this
transmission may contain privileged and/or confidential information and is
intended solely for the addressee(s) named above. If you are not the
intended addressee/recipient, you are hereby notified that any use of,
disclosure, copying, distribution, or reliance on the contents of this
E-Mail/telefax information is strictly prohibited and may result in legal
action against you. Please reply to the sender advising of the error in
transmission and immediately delete/destroy the message and any
accompanying documents. Thank you.
List info : http://www.activedir.org/mail_list.htm
List FAQ : http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
