Active Directory, 5th Edition

Chapter 15. Planning for Group Policy

This chapter takes an in-depth look at group policy objects (GPOs), focusing on how to structure your Active Directory deployment effectively using organizational units and groups so that you can make the best use of the GPOs required in your organization.

15.1. Using GPOs to Help Design the Organizational Unit Structure

In Chapter 13, we described the design of the Active Directory organizational unit (OU) hierarchy. We also explained that other items have a bearing on that design. There are two key design issues that affect the structure of your OUs: permissions delegation and GPO placement. If you decide that your Active Directory infrastructure is to be managed centrally rather than in a distributed fashion and that you will employ only a few GPOs that will be implemented mostly domain-wide (rather than many GPOs on many OUs), your OU structure can be arranged almost any way that you want it to be. It shouldn’t make much difference whether you have 400 branches coming off the root or one container with every item inside it. However, if permissions over specific objects do need to be delegated to specific sets of administrators, it will make more sense to structure your domain OUs in a manner that facilitates that administration. This doesn’t have to be the case, but it makes it much easier to use OUs.

For example, if we have 1,000 users and 10 delegated administrators who each manage 100 users, we could put the 1,000 users in one OU and give ...