Lesson 1: Creating Organizational Units

Organizational units (OUs) are objects (containers) that can contain other objects, such as user accounts, groups, computer accounts, and other OUs. OUs cannot contain objects from other domains. OUs can be employed to organize the objects in Active Directory directory services that represent your network resources. Employing OUs to contain and organize the objects in Active Directory directory services is similar to using folders to contain and organize other folders and files.

OUs can contain other OUs, so you can create a logical hierarchy that represents your company's organizational structure or administrative needs. If you create a hierarchical structure to represent your company's organizational structure, you can base it on your company's departmental or geographical boundaries. For example, if your company has divisions in Brussels, Hong Kong, and New York, you could create a separate OU for each location.

Setting up an OU hierarchy allows you to delegate administrative control over a number of user accounts, groups, or other resources. You delegate administrative control by assigning specific permissions for OUs, and the objects that they contain, to other individuals and groups. By setting up an OU for each division in your company, you could then easily manage and delegate control of each division.

You can also base your OU hierarchy on your company's network administrative model. For example, at your company there might be one administrator who is responsible for all user accounts and a different administrator who is responsible for all printers. In this case, you would create an OU for users and a different OU for printers.

You must have Read, List Contents, and Create Organizational Unit Objects permissions on the parent container (domain or OU) to create OUs within that container. List Contents is not specifically required to create an OU, but you cannot view the newly created OU without it. By default, members of the Administrators group have the permissions to create OUs anywhere. To create an OU, you would dothe following:

1. Open Active Directory Users And Computers from the Administrative Tools menu.

The Active Directory Users And Computers window displays several default containers directly beneath the domain. Users, Computers, and Builtin are containers that are not OUs. Because you cannot create OUs within these containers, or apply Group Policy to them, you should create different OUs to contain your users and computers.

2. Right-click the container (domain or OU) in which you want to create a new OU.
3. Point to New, and click Organizational Unit.
4. Type in the name of the OU, and click OK.

In this practice, you will create four OUs: Sales, Administration, Production, and Servers. Later in this chapter you will create four user accounts in the Sales OU, and then you will move two of these user accounts into the Administration OU.

In this exercise, you will create four organizational units.

1. Log on as Administrator.
2. Click Start, point to Programs, point to Administrative Tools, and click Active Directory Users And Computers.
3. In the console tree, right-click domain.com, point to New on the shortcut menu, and then click Organizational Unit.

The New Object - Organizational Unit dialog box appears.

4. In the Name box, type Sales, and then click OK.
5. Repeat steps 3 and 4 to create an Administration OU, a Production OU, and a Servers OU.
6. Leave the Active Directory Users And Computers window open.

Organizational units (OUs) can be used to organize the objects in Active Directory directory services that represent your network resources. OUs contain objects, including other OUs, so you can create a logical hierarchy of OUs to represent your company's organizational structure or administrative needs. Setting up an OU hierarchy allows you to delegate administrative control over user accounts, groups, or other resources, by assigning specific permissions for OUs, and the objects that they contain, to other individuals and groups.

You must have Read, List Contents, and Create Organizational Unit Objects permissions on the parent container (domain or OU) to create OUs within that container. List Contents is not specifically required to create an OU, but you cannot view the newly created OU without it. By default, members of the Administrators group have the permissions to create OUs anywhere.