# AD DS Users, OUs, & Groups

#### Users and OUs

Organisational Units - a means of separating users and devices/objects based on location, site, role, job, department

- A user account can only be a part of one OU (unlike groups)
- OUs can be used to handle Group Policy objects - will filter down to OUs below the specified OU
- Helps to visually separate objects

Example 1

- Sydney OU 
    - Users
    - Computers
- Brisbane OU 
    - Users
    - Computers

Example 2

- Sales OU 
    - Users
    - Computers
- Finance OU 
    - Users
    - Computers

#### Groups

- Dsitribution Groups (DLs) for Email
- Security Groups (Permissions) and Email

Group Scopes

- Global
- Domain Local
- Universal

Microsoft Strategy

- Accounts 
    - Global 
        - Domain Local 
            - Permissions

[![firefox_xlh5XXZiOF.png](https://note.human-bean.net/uploads/images/gallery/2026-07/scaled-1680-/firefox-xlh5xxziof.png)](https://note.human-bean.net/uploads/images/gallery/2026-07/firefox-xlh5xxziof.png)

#### Universal Groups

\*For larger organisations multiple globval groups can be linked to a single universal group, which is replicated across all domains

[![firefox_3CAA3dFk5H.png](https://note.human-bean.net/uploads/images/gallery/2026-07/scaled-1680-/firefox-3caa3dfk5h.png)](https://note.human-bean.net/uploads/images/gallery/2026-07/firefox-3caa3dfk5h.png)

#### Universal Group Membership Caching Feature

- Global Catalog Servers contain a Universal Group List
- User Authentication occurs on D.C.s via Kerberos
- Kerberos needs to validate with the GCS to identify which groups this user is a member of (via the universal group list)

[![image.png](https://note.human-bean.net/uploads/images/gallery/2026-07/scaled-1680-/Jyximage.png)](https://note.human-bean.net/uploads/images/gallery/2026-07/Jyximage.png)

Scenario: users are finding it take a long time to log in - the global catalog server might be located in a different site to where the user and the domain controller are located

Solutions

- Make the D.C. a Global Catalog server (adds processing overhead)
- Universal Group Membership Caching 
    - Every 8 hours (default) domain controller will cache the Universal Group List locally