Now when we've talked a bit about Adidas domain, let's switch over to overuse.
What are overuse and organizational unit is a container object within a domain that you can use to consolidate
users, computers, groups and other objects.
Now, what is the difference between organizational unit and container?
You have to remember that containers are not organizational units.
Although containers can hold objects, they cannot have group policy objects or GPOs linked to them.
Therefore, if you want to assign a group policy object other than a domain level GPO to an object,
it must be located in an organizational unit.
So as I said, you can link GPOs directly to an overview to manage the objects contained in the view.
You can also assign an O.U.
Manager and associate a comp plus partition within O.U.
Of course, you can create new organizational units in Active Directory by using Active Directory Administrative
Center or Active Directory users and computers.
There are two reasons to create an overview.
The first reason is to group objects together to make it easier to manage them by applying group policies
to the whole group.
When you assign group policy to an organizational unit, the settings apply to all the objects within
the oh you GPOs are policies that administrators create to manage and configure settings for computers
or users.
You deploy the GPOs by linking them to all use domains and sites.
Another reason is to delegate administrative control of objects within the organizational unit.
You can assign management permissions on an O.U.
You thereby delegating control of that over you to a user or group within Active Directory in addition
to the Domain Admins group.
Please know that you can use or use to represent the hierarchical logical structures within your organization.
For example, you can create or use that represent the departments within your organization, the geographic
regions within your organization, or a combination of both departmental and geographic regions.
You can use or use to manage the configuration and use of user group and computer accounts based on
your organizational model.
Now some words about generic containers.
Active Directory contains several built in containers or generic containers such as users and computers.
These containers, store system objects or react as the default parent objects to new objects that you
create.
Do not confuse these generic container objects with organizational units.
As I've said before, the primary difference between organizational units and containers is the management
capabilities.
Containers have limited management capabilities.
For example, you cannot apply a group policy directly to a container.
Install an Active Directory, creates the domain controllers, organizational unit and several generic
container objects by default.
Active Directory uses some of these default objects primarily, and they are hidden by default.
The following objects are visible by default within the Active Directory Administrative Center.
So let me open Active Directory Administrative Center and we'll take a look at generic containers.
We've got domain.
It is a top level of the domain organizational hierarchy.
Next up, we've got built in container.
This is a container that stores several default groups.
We've got containers such as computers container.
It's a default location for new computer accounts that you create in the domain foreign security principles
container.
This is the default location for trusted objects from domain.
Outside the Active Directory forest that you add to a group in the Active Directory domain, there is
managed service accounts container.
It's the default location for managed service accounts and it provides automatic password management
in managed service accounts.
Next up is user's container.
It's the default location for new user accounts and groups that you create in the domain.
The user's container also holds the administrator and guest accounts for the domain and for some default
groups.
Next up is Domain Controllers Organizational Unit.
It's the default location for domain controllers computer accounts.
This is the only view that is present in a new installation of Active Directory.
There are several containers that you can discover only when you click advanced features on the View
menu.
So let me click on Advanced Features and will see the following objects which are hidden by default,
lost and found.
This container holds or event objects program data.
This container holds Active Directory data for Microsoft application, such as Active Directory for
Duration Services or ADF.
Next one is system.
This container holds the built in sys settings and TDs quarters.
This container holds directory service, quarter data and TPM devices.
Container is new with Windows Server 2016.
It stores the Recovery Information for Trusted Platform Module or TPM devices.
I remind you once again, containers in Active Directory domain cannot have GPOs or group policy objects
linked to them to link GPOs to apply configurations and restrictions.
You have to create a hierarchy of all use or organizational units and then link the GPOs to them.
Some words about hierarchy design.
The administrative needs of the organization dictate the design of an overview hierarchy.
It could be geographic, functional resource or user classifications that influence the design, whatever
the order.
The hierarchy should make it possible to administer Active Directory resources as effectively and flexibly
as possible.
For example, if you need to configure all IT administrators computers in a certain way, you can group
all the computers in an overview and then assign a GPO to manage those computers.
You can also create or use within other or use.
For example, your organization might have multiple offices, each with its own IT administrator who
is responsible for managing user and computer accounts.
In addition, each office might have different departments with different computer configuration requirements.
In this situation, you can create an overview for each office and then within each of those use, create
an IOU for the IT administrators and an organizational unit for each of the other departments.
Although there is no limit to the number of levels in your organizational unit structure, limit your
use structure to a depth of no more than ten levels to ensure manageability.
Most organizations use five levels or fewer to simplify administration.
Note that applications that work with AIDS can impose restrictions on the YOU depth within the hierarchy
for the parts of the hierarchy that they use.