Groups in Organizational Unit

In my mind this is more of an organizational question than a question of best practices.

My opinion is that it is best to mirror what the operational organizational structure looks like (i.e. is there an overall Cook County Sales organization that handles sales for the organizations labeled A, B, and C? Or do each of the organizations A, B, and C have their own sales organization reporting to them?) I wouldn't create a network organizational structure that is different from what exists operationally unless there is a very good rationale to do so. Do this tends to confuse users (and increases your work load).

I always like to arrange the tree's Organizational Units so that they mimick the actual structure of the company or organization. This is especially true if there are divisions (OU's) that are geographically separated.

I use Groups almost exclusively for granting access rights, and rarely in login scripts. Although I grant most rights based on OU, Groups are useful for spanning OU's.

For example, pretend you have an OU called accounting, and an OU called HR. Only a few people from each of those OU's should be able to see payroll data. So, creating a group called PAYROLL to put the sub-set of users into makes sense.

Generally, I place all groups at the O= level, but that's just personal preference.

HTH

This question was closed by the author