AD DS Users, OUs, & Groups

Users and OUs

Organisational Units - a means of separating users and devices/objects based on location, site, role, job, department

• A user account can only be a part of one OU (unlike groups)
• OUs can be used to handle Group Policy objects - will filter down to OUs below the specified OU
• Helps to visually separate objects

Example 1

• Sydney OU
  • Users
  • Computers
• Brisbane OU
  • Users
  • Computers

Example 2

• Sales OU
  • Users
  • Computers
• Finance OU
  • Users
  • Computers

Groups

• Dsitribution Groups (DLs) for Email
• Security Groups (Permissions) and Email

Group Scopes

• Global
• Domain Local
• Universal

Microsoft Strategy

• Accounts
  • Global
    • Domain Local
      • Permissions

Universal Groups

*For larger organisations multiple globval groups can be linked to a single universal group, which is replicated across all domains

Universal Group Membership Caching Feature

• Global Catalog Servers contain a Universal Group List
• User Authentication occurs on D.C.s via Kerberos
• Kerberos needs to validate with the GCS to identify which groups this user is a member of (via the universal group list)

Scenario: users are finding it take a long time to log in - the global catalog server might be located in a different site to where the user and the domain controller are located

Solutions

• Make the D.C. a Global Catalog server (adds processing overhead)
• Universal Group Membership Caching
  • Every 8 hours (default) domain controller will cache the Universal Group List locally