# AD question **URL:** \ **Category:** Chatting over the Back Fence\ **Created:** [January 4, 2013, 9:00pm UTC](https://forums.suse.com/t/ad-question/23475 "2013-01-04T21:00:13Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![System1](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@System1](https://forums.suse.com/u/System1)\ **Post date:** [January 4, 2013, 9:00pm UTC](https://forums.suse.com/t/ad-question/23475/1 "2013-01-04T21:00:13Z")
I’ve got a question for you SMB folks that run AD. I’m not sure how best to define SMB, so let’s say for the purposes of what I’m trying to find out that’s maybe 500 or fewer users. When working with users and groups, do you typically just use the default groups like Domain Users and Domain Admins? If you create your own groups, do you just stick them in the default Users container? Or do you go so far as to create your own OUs and create groups there? – Does this washcloth smell like chloroform? ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [January 8, 2013, 12:18am UTC](https://forums.suse.com/t/ad-question/23475/2 "2013-01-08T00:18:46Z")
Depends totally on your needs. If you need more granular file-rights on Windows shares you mostly use own groups like you would do that in eDir. ## To group the groups and users in own containers is more a matter of convenience or easier readability in bigger environments but is not necessary in a single tree setup. W. Prindl Joseph Marton wrote: [color=blue] > I’ve got a question for you SMB folks that run AD. I’m not sure how > best to define SMB, so let’s say for the purposes of what I’m trying > to find out that’s maybe 500 or fewer users. > > When working with users and groups, do you typically just use the > default groups like Domain Users and Domain Admins? If you create > your own groups, do you just stick them in the default Users > container? Or do you go so far as to create your own OUs and create > groups there?[/color] ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [January 8, 2013, 12:24am UTC](https://forums.suse.com/t/ad-question/23475/3 "2013-01-08T00:24:47Z")
W\_ Prindl wrote: [color=blue] > Depends totally on your needs.[/color] I just want to find out what folks are doing today. I guess you could consider this a bit of an informal poll. – Does this washcloth smell like chloroform? ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [January 8, 2013, 2:00am UTC](https://forums.suse.com/t/ad-question/23475/4 "2013-01-08T02:00:12Z")
I have never seen an AD Tree that did not break users into OUs. However, I presume if customers are small enough they would not bother. Also most of the customers I deal with have a history or eDir which could bias things. On 1/7/2013 5:24 PM, Joseph Marton wrote:[color=blue] > W\_ Prindl wrote: > [color=green] > > > Depends totally on your needs.[/color] > > I just want to find out what folks are doing today. I guess you could > consider this a bit of an informal poll. > [/color] – Craig Wilson - MCNE, MCSE, CCNA Novell Knowledge Partner Novell does not officially monitor these forums. Suggestions/Opinions/Statements made by me are solely my own. These thoughts may not be shared by either Novell or any rational human. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [January 8, 2013, 8:59am UTC](https://forums.suse.com/t/ad-question/23475/5 "2013-01-08T08:59:45Z")
Craig wilson,[color=blue] > I have never seen an AD Tree that did not break users into OUs.[/color] I have… But those were small shops. Also, OUs cannot be security principals, right? – Anders Gustafsson (NKP) The Aaland Islands (N60 E20) Have an idea for a product enhancement? Please visit: [http://www.novell.com/rms](http://www.novell.com/rms) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [January 8, 2013, 4:11pm UTC](https://forums.suse.com/t/ad-question/23475/6 "2013-01-08T16:11:47Z")
On 1/7/2013 5:24 PM, Joseph Marton wrote:[color=blue] > W\_ Prindl wrote: > [color=green] > > > Depends totally on your needs.[/color] > > I just want to find out what folks are doing today. I guess you could > consider this a bit of an informal poll. > [/color] Typically most businesses need some sort of granularity of say HR, financial, owner/partner, normal production stuff etc so I think it would not unusual not to find granular security. ---
**Author:** ![nop1983](https://avatars.discourse-cdn.com/v4/letter/n/e19adc/32.png) [@nop1983](https://forums.suse.com/u/nop1983)\ **Post date:** [January 10, 2013, 1:10am UTC](https://forums.suse.com/t/ad-question/23475/7 "2013-01-10T01:10:14Z")
Anders Gustafsson wrote: [color=blue] > Craig wilson,[color=green] > > > I have never seen an AD Tree that did not break users into OUs.[/color] > > I have… But those were small shops. Also, OUs cannot be security > principals, right?[/color] Me too. In system with just 50 users or so, I don’t think the admins see it as that big an “issue” or they just don’t see the reasons why to create additional OU’s. – Niels ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [January 10, 2013, 2:05am UTC](https://forums.suse.com/t/ad-question/23475/8 "2013-01-10T02:05:41Z")
And to Answer Anders Question, AFAIK OUs still cannot be security principals. To get around that, I have used IDM in the past to create groups to mirror OUs with auto-membership for folks in that OU. Again, that is because of the history of eDir. Color me silly, but being able to do stuff based upon somoneone’s OU just seems natural. Most AD folks just don’t know what they don’t have until they see more advanced systems in place. On 1/9/2013 6:10 PM, Niels Poulsen wrote:[color=blue] > Anders Gustafsson wrote: > [color=green] > > > Craig wilson,[color=darkred] > > > > > I have never seen an AD Tree that did not break users into OUs.[/color] > > > > I have… But those were small shops. Also, OUs cannot be security > > principals, right?[/color] > > Me too. In system with just 50 users or so, I don’t think the admins see > it as that big an “issue” or they just don’t see the reasons why to create > additional OU’s. > [/color] – Craig Wilson - MCNE, MCSE, CCNA Novell Knowledge Partner Novell does not officially monitor these forums. Suggestions/Opinions/Statements made by me are solely my own. These thoughts may not be shared by either Novell or any rational human. ---
**Author:** ![nop1983](https://avatars.discourse-cdn.com/v4/letter/n/e19adc/32.png) [@nop1983](https://forums.suse.com/u/nop1983)\ **Post date:** [January 10, 2013, 2:27am UTC](https://forums.suse.com/t/ad-question/23475/9 "2013-01-10T02:27:12Z")
craig wilson wrote: [color=blue] > Most AD folks just don’t know what they don’t have until they see more > advanced systems in place.[/color] True. – Niels