In this video from IT Free Training I will look at organizational units in Active Directory
and shadow groups. Using these effectively allows you to model Active Directory based
on your business environment. Organizational Units or OU’s allow you to
divide up the objects in your Active Directory environment based on your business needs.
For example, you could divide users and computers based on geographical locations, departments,
computer types or any way that you require. If you start with a basic OU, in this case
called New York, in a large site an OU like this will soon become full of objects. OU
are like folders on a hard disk. On a hard disk you would create new directories to organize
files. Like the directories on a hard disk, OU’s form the containers that allow Active
Directory objects to be organized.
In this case, I will create two new OU’s under New York called users and computers.
This is one way to separate objects in Active Directory. In the real world it is up to the
individual administrator to decide which OU’s they want to create and where they want to
put the objects.
In a lot of cases, administrators will choose to create organizational units that mirror
the business. In this example, two additional OU are created called sales and marketing.
In these OU’s are placed the users for sales and marketing.
Organizing Active Directory objects like this help you sort your users and computers based
on your business needs, but there are other advantages to creating a structure like this
and sorting your users. Later in the course I will cover group policy
in a lot more detail. Group policy allows the administrator to create settings and apply
them to users. Group polices are applied to OU’s. In this example, I would create a
group policy and apply it to the sales users OU like this.
This group policy would allow the administrator to configure settings for the user like setting
their wallpaper or default printer. The next question that arises is, could sorting users
into OU like this also be used to apply permissions? The answer to this is no. Using a structure
like this cannot be used to define permissions say to a file share. This is the fundamental
difference between an OU and a group. An OU is used to sort your users but like files
on your hard disk, the user only exists in one location. Groups on the other hand contain
any number of users from any part of the domain and thus offer more flexibility than organizational
units. In order to use the OU structure that you
have created for permissions, Microsoft introduces the concept called a shadow group. A shadow
group is a regular Active Directory group that simply contains all the users in the
OU.
In this example if I create a shadow group for the sales OU, this group will contain
all the users from the sales OU. Now if you want to give all the sales users access to
a file share you would simply use this group.
To keep the shadow group up to date, you will need to update its membership each time a
user is added or removed from the sales OU. It is possible to create a script to do this
process automatically but this will need to configured.
Later in the course I will look at fine granular password policy. This allows different password
polices to be applied to the domain. For example, a particular set of user could be configured
to require a longer password than others. Fine granular password policy must be configured
using a group. In this case, you would more than likely want to configure it to an OU,
for example if you had a secure department you would more than likely put all the uses
in this department in the same OU. This is a good example of where a shadow group would
come in handy. OU’s can also be used to separate computers.
In this example, I could create a separate OU’s for desktop and laptop computers. This
comes in handy for using group policy. You could now create a group policy for computers
that contains all the common settings for computers. For example, settings like the
desktop wallpaper and screen saver could be configured here. Next you could create separate
laptop and desktop group polices which contain settings that are just for those types of
computers. Both of these OU could also have group policy applied to them that configured
settings that were specific to desktops and laptops. This gives you a lot of flexible
allowing you to configure the OU’s in Active Directory to match your business requirements.
In any Active Directory environment there will be a number of default OU’s created
when Active Directory is first installed. These OU’s cannot be deleted and only one
of these can have group policy applied to it.
The first one is builtin. The OU contains all the user accounts that normally exist
only in the local accounts database. When a server is promoted to a domain controller,
these local accounts are moved into the Active Directory database. For most Active Directory
administration you not need to use this OU. The next default OU is users. This will contain
the default users that are created when Active Directory is first installed. For example
the domain administrators account. Since this OU does allow group policy to be applied,
you are more than likely will move users that you create in this OU to anther OU that you
create like the New York OU used in the previous example.
The next OU is the computers OU. When you add a computer to the domain, the computer account
for the computer is put in this OU. Like the other OU’s, group policy cannot be applied
to this OU so you are more than likely going to move the computer account to anther OU
after when it is created. The last default OU is domain controllers.
The domain controllers OU contains all the computer accounts for all the domain controllers
for that domain. Unlike the other OU’s, group policy can be applied to this OU. Now
that all the theory on organizational units has been covered, I will now change to my
Windows Server 2008 R2 domain controller to look at how to use organizational units.
First of all, open Active Directory Users and Computers from the start menu. From Active
Directory Users and Computers you can see the first default OU that I talked about bultin.
In here, you can see the user accounts that are shared between domain controllers in the
domain. If you were to create a user in this OU, this user account would only be available
to domain controllers. The next OU is computers. When a computer
is added to the domain, the computer account by default will automatically be put into
this OU. The next OU is the Domain Controllers OU.
When a server is promoted to a Domain Controller the computer account for that server will
moved or created in this OU. The next OU is ForeignSecurityPrincipals.
I did not mention this OU before because it is not an OU that you would normally use in
day to day administration. When you have multiple domains connected by trusts, you may see accounts
appear in here. These are created automatically by Active Directory and are used to help bridge
the two domains. In normal day to day administration you would not need to go into to this OU
The next OU is managed service accounts. This is a feature of Windows Server 2008 R2 and
Windows 7. If you schema is not up to date, this OU may not be available. This OU will
only be used with managed service accounts in Windows Server 2008 R2 and Windows 7. Like
the ForeignSecurityPrincipals OU, this is not an OU you would generally use for day
to day administration. The last default OU is the users OU. This
contains all the default users and groups created when the Active Directory domain was
first installed. Additional user accounts and groups may also be created in here. For
example, if the read only domain controllers groups did not exist, these groups will be
created when you start using read only domain controllers. Normally when you create a new
user you will decide than where to put the user, otherwise this is the default location
users will be put when software creates the user for you.
I have already created an OU for New York and under this OU is anther OU called users.
Under users is anther OU called Marketing. To create a new OU under users, right click
users and select new organizational unit. Once I enter in the name of the organization
unit, I also get the option under this to protect container from accidental deletion.
It is not that often that you will make changes to your OU’s once they are created so it
is a good idea to keep this option on. Once the OU is created, since protect container
from accidental deletion was selected notice what happens when I attempt to move the OU
to another location. Windows will give me a prompt telling me that moving an OU will
have an effect on your environment particular if you are using group policy. Once I press
yes to this dialog and proceed notice that Windows will give me an error message saying
that access was denied. Until protect container from accidental deletion is deselected I will
not be able to delete or move the OU. By default, some OU’s are hidden and some
tabs will be hidden when looking at the properties for OU’s. To see all these, select the view
menu and then select the option advanced features. If I now go back to the Sales OU and open
the properties, since advanced features is now switched on I will see all the tabs, some
of these tabs would previously not have appeared. Like a lot of objects in Active Directory,
you have the option on the general tab to enter some information about the OU. In the
case of the New York OU, I could enter information about the physically location of the office
that it is being used for. On the managed tab, you can configure a user
that is associated with this OU. Once I press change and select a user, that user will be
associated with this OU. This is only provided for informational purposes, configuring a
user here does not give the user any additional permissions.
On the object tab, you can see the canonical name of the object. This is sometimes useful
to copy and paste into scripts or documentation. At the bottom is the tick box protect object
from accidental deletion. If you want to move or delete the OU, you will need to clear this
tick box first. Once your OU’s are created you will want
to move some objects into them. If I go to the users OU, it is a simply matter of selecting
the users that I want and dragging and dropping them to the OU required, in this case the
sales OU. Once again I will get message saying moving
the object can have an effect on your environment. It is important to remember this fact when
making changes. The user may need to reboot there computer when making changing like these
in order for the changes to take effect. If I open the computer OU, when a computer
is added to the domain, the computer account for that computer will be created in here.
Since group policy cannot be applied to this OU, you will more than likely want to move
the computer account after it is created. The process is the same as for users, drag
and drop it where you want it. When a computer is joined to a domain, the
computer will ask for a restart. One trick I like to do is before the restart is to move
the computer account to the correct location. By doing this, when the computer is restarted
the computer account will be in the correct location. If you move the computer account
later on, you will need perform a second restart after the computer account has been moved.
In some cases you may want to perform some testing before deploying software or settings
on your network. A lot of administrators will create a new OU for example a testing OU.
It is a simple matter of moving the computer accounts that you want to use for testing
into this OU. The same principal apply if you migration users to a new system or perhaps
you want to create a pilot group to test some new settings or software before deploying
to the rest of the users. Create a separate OU and move the objects required into this
OU. With the advanced features enabled, notice
that also additional OU’s are present like LostAndFound. The LostAndFound OU is the home
of orphaned objects in Active Directory. Under certain conditions in Active Directory an
object may become orphaned and moved in here. For example, this could happen if an object
is created and deleted while still in the process of being replicated around the domain.
If you see any objects in here, it is up to you to review these and see if you still require
any of these objects. At the bottom there are some additional OU’s
that are for more advanced Active directory administration. For this reason, I will not
go into these in this video. This covers all the basics for Organizational units in Active
Directory. To review what we have learnt, what is an
Organizational unit? An organizational unit is a way of organizing Active Directory objects
into containers. This is the same way you would organize files on your hard disk into
directories.
Next, what is the different between an OU and a group? OU's are essentially used for group
policy and delegation of administration. Covered later in the course, group policy is directly
apply to an organizational unit. Delegation of administration allows you to
pick an administrator or administrators to look after all the objects in a particular
OU. For example, using delegation you could grant a single user administrative rights
to all the objects under the New York OU used in the previous example.
The important thing to remember with OU’s is that objects like files on a hard disk
exist only in the one location. In contrast to groups, groups are primary
used to provide access to resources. Groups are generally used with objects, files and
directories. Group differ from OU in that objects like users and computers can exist
in multiple groups. Understanding how both work and how to use them effectively will
greatly improve your ability to support your domain.
I hope you have enjoyed this video from IT Free Training. For more videos for this course
and others please visit are web site or You Tube Channel. Thanks for watching.