Original posting: 8/25/2014
Revised 5/26/2017
Hey everyone, Ace here, again. This is an accumulation of notes on OU structures. It’s not very well laid out, but I hope it gives you some ideas on how to design an OU structure and to help with applying GPOs.
Default Domain Policy and OU Design
It’s suggested and recommended to not change the Default Domain Policy.
Keep in mind, whatever you set at the domain level will flow downhill to
everything. I would suggest to design your OU structure to reflect your
organization and/or departments, which will also help you create GPOs for
the OU design.
For example, for a company with more than one location/site, I would suggest
the following – and this is just that… a suggestion.
Domain
…..Philly OU
…………..Accounting
…………..Sales
…………..Marketing
…………..Desktop
…………..Users
…………..Groups
…………..Laptops
…..Seattle OU
…………..Accounting
…………..Sales
…………..Marketing
…………..Desktops
…………..Users
…………..Groups
…………..Laptops
In the above example, I separated Laptops and Desktops because I have two different Windows Update GPOs set. The Desktop Windows Update GPO I created runs at 3:00 AM, whereas the Laptop Updates run at 3:30 PM while the users have the laptops in the
office.
I also separated groups just to “group” them together, and for no other reason.
This design also allows me to create GPOs for the different offices,
or I can create one and link them to both offices. The design possibilities
are endless, especially if you control flow with Block Inheritance, Loopback, WMI filtering, disabling the Computer or User portion of a GPO, etc., however in many cases I do not use these features because trying to support them 8 months later when there’s a problem it is difficult to remember what you had blocked, etc.
And yes, you can use RSOP to look at what is being applied, etc., but I find it easier to simply create another OU or a child OU to have a different setting than the parent, such as the following, where I created a GPO to lock the desktop with two different time settings.
The Desktops OU has a 30 minute setting, but I created a 15 Minute Timeout OU directly beneath it. Because the identical setting is different on the child, it overrides the parent’s setting. I can simply “look” at my OUs and know what I have applied.
…..Seattle OU
…………..Accounting
…………..Sales
…………..Marketing
…………..Desktops
………………..15 Minute Timeout OU
…………..Users
…………..Laptops
These are just suggestions, and you may find that it may work for you, or not. Even in a single site, I still do it this way, because it is flexible. You never know when the customer or your company may expand. If they do, simply create another OU for the new location.
GPO Inheritance:
There was one question that came up regarding the above example that I thought
I would share:
So lets say I open AD users and Computers and create a new OU named Philly OU,
then inside this OU I create another six sub-OU such as: Accounting,Sales,Marketing, etc..
My questions is do I need right click on each sub-OU such as Accounting,Sales,Marketing, etc… in the GPO tab to configure the same policy settings or just enough by setting up a GPO policy in the Philly OU parent OU folder to automatically apply to all other sub-OU?
The simple answer is yes, the policy will inherit or flow downhill (traverse), as long as:
• There are no blocks or filtering not allowing it to apply to the target (user or computer).
• No other policy has enforcement override with conflicting settings
• Whether the GPO is targeting user accounts or computer objects, the user and computer objects must have read rights to the following attributes:
– gpLink
– gpOptions
Note: The Read permissions is also important if you were to enable Loopback Processing, as well as List Object Mode on the directory, which is a form of filtering views in the ADUC and GPMC.
Loopback processing explained:
Loopback processing of Group Policy, explained. Sunday, 26 July 2009
http://kudratsapaev.blogspot.co.uk/2009/07/loopback-processing-of-group-policy.html
You can use the Loopback to apply a GPO that depend only on which computer the user logs on to, say for example if the computer object is in a different OU. It’s a feature normally used to lock down a computer that a user is on. It’s normally used with Kiosk mode, such as a self-checkout register at the grocery store, but it can be used for anything you need. More info on this feature:
Circle Back to Loopback – Part 1
By Jonathan Stephens, MSFT
http://blogs.technet.com/b/askds/archive/2013/02/08/circle-back-to-loopback.aspx
Back to the Loopback: Troubleshooting Group Policy loopback processing, Part 2
By Jonathan Stephens, MSFT
http://blogs.technet.com/b/askds/archive/2013/05/21/back-to-the-loopback-troubleshooting-group-policy-loopback-processing-part-2.aspx
Loopback processing of Group Policy
http://support.microsoft.com/kb/231287
*
Videos that should help understand this better:
Video: Active Directory: Introduction to Group Policy
Compiled From MOC 2279b Planning, Implementing & Maintaining a Microsoft Windows 2003 AD Infrastructure, Module 6, by Ace Fekay
https://www.youtube.com/watch?v=E0qjZhMNQUY
*
Video: Introduction to Active Directory’s Logical Design
Compiled From MOC 2279b Planning, Implementing & Maintaining a Microsoft Windows 2003 AD Infrastructure, Module 1, by Ace Fekay
http://www.youtube.com/watch?v=TLZZ1iHMr2Q
References
Dude, where’s my GPO? Using PowerShell to find all of your Group Policy links.
“… you can easily create a report of all your Group Policy Objects (GPOs) …”
Cool article to list out all your GPOs in one spot with PowerShell. Can be helpful with troubleshooting.
http://blogs.technet.com/b/ashleymcglone/archive/2013/05/29/dude-where-s-my-gpo-using-powershell-to-find-all-of-your-group-policy-links.aspx
A good discussion on GPO Design in the following thread with good info by Christoffer Andersson:
Thread: “Building Organization Hierarchy with Active Directory” 6/2013
http://social.technet.microsoft.com/Forums/windowsserver/en-US/798bf766-a351-4fdb-b8f8-927ad60e1270/building-organisation-hierarchy-with-active-directory
Reviewing OU Design Concepts, Updated: April 11, 2008
Applies To: Windows Server 2008, Windows Server 2008 R2 (These concepts also apply to 2003):
Quoted: “While there is no technical limit to the number of levels in your OU structure, for manageability we recommend that you limit your OU structure to a depth of no more than 10 levels. There is no technical limit to the number of OUs on each level. Note that Active Directory Domain Services (AD DS)–enabled applications might have restrictions on the number of characters used in the distinguished name (that is, the full Lightweight Directory Access Protocol (LDAP) path to the object in the directory) or on the OU depth within the hierarchy.”
http://technet.microsoft.com/en-us/library/cc725715(v=ws.10).aspx
Here’s a basic visual of how GPOs work, and how it would flow downhill.
https://onedrive.live.com/?cid=0C7B9FD0852378B8&id=C7B9FD0852378B8%21237&parId=C7B9FD0852378B8%21234&o=OneUp
Design Considerations for Organizational Unit Structure and Use of Group Policy Objects
http://technet.microsoft.com/en-us/library/cc785903.aspx
TechNet Magazine: Group Policy
http://technet.microsoft.com/en-us/magazine/cc135925.aspx
Group Policy and Advanced Group Policy Management
http://technet.microsoft.com/en-us/windowsserver/grouppolicy/default.aspx
Win2k3 AD OU/GPO Design Discussion
http://www.tomshardware.com/forum/190896-46-win2k3-design-discussion
AD Scalability and GPOs
http://technet.microsoft.com/en-us/library/cc756101.aspx
You receive a “Failed to delete Group Policy Object” error message when you try to delete the default domain policy or the default domain controller policy in Windows Server 2003 and in Windows 2000 Server”
“… the default domain Group Policy object (GPO) and the default domain controller Group Policy object cannot be deleted.”
http://support.microsoft.com/kb/910201
Default Group Policy objects become corrupted: disaster recovery
http://technet.microsoft.com/en-us/library/cc739095(WS.10).aspx
Chapter 4: Strengthening Domain and Domain Controller Policy Settings (applies to all operating systems)
http://technet.microsoft.com/en-us/library/cc773205(v=WS.10).aspx
*
============================================================
Summary
Published 5/1262017
I hope this helps!
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP – Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
Or just search within my blogs:
https://blogs.msmvps.com/acefekay/
This posting is provided AS-IS with no warranties or guarantees and confers no rights.