c# .net print barcode Default Containers and OUs in Visual C#

Maker Quick Response Code in Visual C# Default Containers and OUs

A number of default OUs and containers are created during the installation of Active Directory. These default OUs and containers include the following:

Domain container The Domain container serves as the root container for the Active Directory hierarchy. Administrative permissions applied to this container can affect child containers and objects across the domain. Do not delegate control of this container; it must be controlled by the service administrators. Built-in container The Built-in container holds the default service administrator accounts. Users container The Users container is the default location for storing new user accounts and groups created in the domain. Again, you should not change the default permissions on this container. If you need to delegate control over users, create new OUs and move the user objects into them. Also, you cannot link GPOs to the default Users container. To apply Group Policy to users, you must also cre ate OUs and move the users there. Computers container The Computers container is the default location for stor ing new computer accounts created in the domain. As with the Users container, you should create new OUs to assign permissions or GPOs to computers. Domain Controllers OU The Domain Controllers OU is the default location for storing the computer accounts of domain controllers. This OU has a default set of policies applied to it. To ensure that these policies are applied uniformly to all domain controllers, it is recommended that you do not move the computer objects of the domain controllers out of this OU. By default, the service administrators control this OU. Do not delegate control of this OU to individuals other than the service administrators.

The default containers are controlled by service administrators, and it is recommended that you let control stay in the service administrators hands. If you need to delegate control over objects in the directory, you should create new OUs and then move the

4-12

4

objects into these OUs. Delegate control over these OUs to the appropriate administra tors. This makes it possible to delegate control over objects in the directory without changing the default control given to the service administrators.

Each OU inherits the permissions of its parent OU by default. In the same way, objects in an OU inherit permissions from the OU (and from each parent of that OU). Inheritance provides an efficient way to grant or delegate permissions to objects. The advantage of inheritance is that an administrator can manage permissions of all objects in an OU by setting permissions on the OU itself instead of having to configure all of the child objects individually. Actually, administrators can assign permissions to an object itself, to an object and all of its child objects, to only the child objects, or to specific types of child objects (such as computers or users). When you create an OU design, you should take full advantage of inheritance. Orga nize the OUs logically to create a simple structure in which inheritance does most of the work for you. There are also times when inheritance gets in the way of what you need to accomplish with your OU design. You may need the specific permissions on an object to override the permissions the object inherits from a parent. You can block inheritance of the permissions that apply to a parent OU so that they do not apply to the child OU.

Creating an OU structure can be a difficult task. Fortunately, there are a number of standard models on which you can base your design. Each model describes the cate gories of OUs and the relationships the OUs share with one another. You can base an OU design on the following five OU models: