Skip to main content

AD DS Users, OUs, & Groups

Users and OUs

Organisational Units - a means of separating users and devices/objects based on location, site, role, job, department

  • A user account can only be a part of one OU (unlike groups)
  • OUs can be used to handle Group Policy objects - will filter down to OUs below the specified OU
  • Helps to visually separate objects

Example 1

  • Sydney OU
    • Users
    • Computers
  • Brisbane OU
    • Users
    • Computers

Example 2

  • Sales OU
    • Users
    • Computers
  • Finance OU
    • Users
    • Computers

Groups

  • Dsitribution Groups (DLs) for Email
  • Security Groups (Permissions) and Email

Group Scopes

  • Global
  • Domain Local
  • Universal

Microsoft Strategy

  • Accounts
    • Global
      • Domain Local
        • Permissions

firefox_xlh5XXZiOF.png

Universal Groups

*For larger organisations multiple globval groups can be linked to a single universal group, which is replicated across all domains

firefox_3CAA3dFk5H.png

Universal Group Membership Caching Feature

  • Global Catalog Servers contain a Universal Group List
  • User Authentication occurs on D.C.s via Kerberos
  • Kerberos needs to validate with the GCS to identify which groups this user is a member of (via the universal group list)

image.png

Scenario: users are finding it take a long time to log in - the global catalog server might be located in a different site to where the user and the domain controller are located

Solutions

  • Make the D.C. a Global Catalog server (adds processing overhead)
  • Universal Group Membership Caching
    • Every 8 hours (default) domain controller will cache the Universal Group List locally
Back to top