Creating a Basic OU Structure
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2
You need to create OUs for the users and computers you want to manage within your domain. This chapter uses a simple OU structure for a simple environment. If your environment requires a more complex OU structure, refer to the following documentation for planning information:
"Designing a Group Policy Infrastructure" in this book.
"Designing the Active Directory Logical Structure" in Designing and Deploying Directory and Security Services of this kit.
To create the OU structure
Using GPMC, expand the forest node, the domains node, and the domain adatum.com.
Right-click adatum.com,and click Active Directory Users and Computers.
In the Active Directory Users and Computers MMC, expand adatum.com.
Right-click adatum.com, point to New, and click Organizational Unit.
For the new OU name, type IT.
Repeat steps 4 and 5 to create OUs named Bookkeeping and Sales.
Right-click the OU named IT, point to New, and click User.
Type the user information for Florian Voss, as shown in Table 9.1. Set the User logon name as Florian, and click Next.
When prompted for a User Password, type in a strong password. Make sure that User must change password at next logon is not checked.
Repeat steps 7 through 9 to create the user accounts within the appropriate OUs, as shown in Table 9.1.
With adatum.com highlighted, click Builtin in the left pane, and double-click Administrators.
Click Members, and click Add. In the object names text box, type Florian,and click Check Names to resolve the entry to Florian Voss. Click OK.
In the right pane, double-click Domain Admins.
Click Members and repeat step 12 to add Florian to the Domain Admins security group. Click OK twice, and click adatum.com in the left pane.
Right-click adatum.com, point to New, and click Group.
Type the group name RUPUsers. Make sure that the group type is Security, and that the group scope is Global.
Double-click the security group RUPUsers.
Click the Members tab, and click Add.
Click Advanced, and click Locations.
Expand adatum, click Sales, and click OK.
To select all users in the Sales OU, click Find Now. To add the users to the RUPUsers security group, click OK.
Repeat steps 17 through 19 to add all of the IT OU members to the RUPUsers security group.
Close the Active Directory Users and Computers snap-in, and minimize GPMC.
Although not addressed in this chapter’s procedures, it is useful to understand that new user and computer accounts are created in the CN=Users and CN=Computers containers by default. It is not possible to apply Group Policy directly to these containers, although they inherit GPOs linked to the domain. Redirusr.exe (for user accounts) and Redircomp.exe (for computer accounts) are two new tools included with Windows Server 2003 that enable you to change the default location where new user and computer accounts are created so you can more easily scope GPOs directly to newly created user and computer objects. These tools are located in %windir%\system32.
By running Redirusr.exe and Redircomp.exe once for each domain, the domain administrator can specify the OUs into which all new user and computer accounts are placed at the time of creation. This allows administrators to manage these unassigned accounts by using Group Policy before the administrators assign them to the OU in which they are finally placed. You might want to consider restricting the OUs used for new user and computer accounts using Group Policy to increase security around new accounts.
For more information about redirecting users and computers, see article 324949, "Redirecting the Users and Computers Containers in Windows Server 2003 Domains," in the Microsoft Knowledge Base. To find this article, see the Microsoft Knowledge Base link on the Web Resources page at https://www.microsoft.com/windows/reskits/webresources.
For information about Redirusr.exe and Redircomp.exe, see the Redirecting Users and Computers link on the Web Resources page at https://www.microsoft.com/windows/reskits/webresources.
For additional information about these tools, see "Designing a Group Policy Infrastructure" in this book.