Most of our perms are applied using access packages in Azure, so we simply manually apply an access package to a user for the time that HR says they’re in that department.

It doesn’t happen often enough in our org for us to come up with anything more automated/elaborate.

[-]

altodor@reddit

The only time I've seen something like this personally, a user was like an associate dean or something by day and an usher for the school's theatre by night.

[-]

BigSnackStove@reddit

MyBusiness

[-]

Vicus_92@reddit

Someone worked with Small Businesses.

[-]

clt81delta@reddit

How bout those companies who outgrew SBS, or the hardware wasn't beefy enough to run AD, DNS, CA, Exchange, SQL, Sharepoint.... Worked for an MSP at one point, I think I performed a half a dozen 'upgrades' to Server Standard and broke those services out into multiple Servers/VMs.

Acceptable compromises are hosting an app and it's associated database on the same server since it's all related. Obviously ad+dns maybe dhcp. You might have a few IT tools running on the same server for simplicity since they can pull up their big boy pants and tolerate some downtime.

SBS 2011 was sold to small business as a compromise before virtualization took hold and it was a hot mess once they started to scale up. They basically went against all previous recommendations of keeping ad seperate from exchange seperate from SharePoint seperate from your rds server seperate from your fileserver (since it was unaffordable) and bundled it all together saying go nuts.

For like 1-25 people it was ok but if you were actually utilizing all those services the gradual increase killed the server over time as you grew.

[-]

kidrob0tn1k@reddit

I appreciate the insight. I’m new to learning things related to SysAdmin so this information is helpful. Thanks again!

[-]

1armsteve@reddit

Little bit more for you since you said you're learning, AD server will always have the DNS server role as well so thats one where you will always see two roles. DHCP should be ran on separate servers or dedicated network appliances. File servers should only be file servers, IIS should be IIS, print servers should be print servers etc.

Since SBS encouraged you to install all these services on the same server, a lot of self taught sysadmins from that time will shove all these services onto one server and not think a thing of it until everything stops working because of one misconfiguration of one service they configured years ago. I shudder recalling the calls at the MSP I worked at back in 2010-15 from churches, dentist and lawyer offices who had a SBS server setup by a long gone PC repair tech back in 2003 that just stopped working.

We demerged and I created a brand new AD for all servers then gradually migrated users across after the heavy lifting.

[-]

dirtyredog@reddit

"One" of our domains have singluar and plural versions. They once asked me to switch everyone I just laughed in the most above my pay grade voice I could conjure.

[-]

Maro1947@reddit

Oh indeed, i negotiated a big pay rise, bonus and promotion before I even attempted it.

Even then I told them it was in them and the Good/Fast/Cheap pyramid would be in effect

It took double the predicted time because of that

[-]

hangin_on_by_an_RJ45@reddit

the mountains of tech debt are insurmountable

This sums up everything I hate about working in IT nicely

[-]

Playful_Tie_5323@reddit

A phrase i'm hearing quite a lot at my place is "We've always done it this way" - Yeah but what if that "way" was absolutely shit all along?? Frustrating the life out of me

[-]

klauskervin@reddit

I get this a lot for software that used to have network based licensing now switching to user based licensing. What do you mean we all can't share a single account???? It's fun telling them they were following the terms and conditions of the software to begin with and now their little work around of licensing doesn't work anymore. Time to pay the vendor the money you should have been paying them for single licenses the whole time!

[-]

SFHalfling@reddit

software to begin with and now their little work around of licensing doesn't work anymore. Time to pay the vendor the money you should have been paying them for individual licenses the whole time!

Because AD never took off the way MS intended

Dude, what? Almost every enterprise company in the world uses Active Directory. What does it looking old have anything to do with it, if it ain't broke don't fix it.

[-]

orion3311@reddit

Its one thing to look old and be reliable, and its another thing to add a single digit number of features to a system over the course of 25 years.

To clarify my statement, when I say "took off", I mean the deep integration they intended to do with it with apps.

orion3311@reddit

I agree but most places didnt have a choice as it was the next gen NT domain.

[-]

ProfessionalITShark@reddit

Wait what did they intend?

[-]

orion3311@reddit

I think they wanted all the on-prem apps to dive into AD; storing settings and metadata in AD, etc. I'm sure a bunch of apps did but in my experience nothing I saw other than Exchange onprem ever really integrated into it. It wasn't until much later on where companies started syncing with it for cloud IDP use, but I wouldn't call that integrated.

[-]

WWGHIAFTC@reddit

It's a blank slate system. It's up to you to built it out, not stay inside some pre-drawn lines that restrict what you can do.

cbass377@reddit

I will offer an opinion that is contrary.

OUs are not folders to organize your AD. They are for setting up group policy, delegation, and administrative boundaries.

If you only have 1 admin group for all users, why "folder" them?

You can apply GPOs at the container and apply it by security group.

A user can be in multiple security groups but can only be in 1 OU.

Just give everyone access to everything yall!!!! You're over complicating this 😭😭😭

[-]

soggybiscuit93@reddit

It's not overcomplicated. SG's are better ways of delegating GPOs than an overly complex OU structure.

Say you manage OUs by branch office and link branch office drive mapping to the OU...okay, now what if an employee floats between offices and needs both mapped drives?

What if you organize OUs by department and map GPOs that way: okay, now what if a role requires access to 2 different departments?

SG's are significantly more flexible. Hierarchical policy management is a legacy way of thinking.

[-]

patmorgan235@reddit

Say you manage OUs by branch office and link branch office drive mapping to the OU...okay, now what if an employee floats between offices and needs both mapped drives?

Don't use mapped drives use DFS-N with access based enumeration.

Agree SG are more powerful and allow you to compose GPs.

[-]

altodor@reddit

When I primarily did AD stuff I could get away with a blend of hierarchy, item-level targeting, and security groups based on what made the most sense for the policy. As primarily an Intune/Entra admin these days, I have lots of preference for linking shit to dynamic groups so no one has to manually maintain the memberships and the access control to anything that's not the high security stuff.

[-]

soggybiscuit93@reddit

We wanted to go full Intune management, but with a limited time frame given and a lot of legacy applications, just not enough time to make such a drastic change in addition to the merger.

We do have a few affiliate companies we own that need to stay separate, so we get to roll Entra/Intune only deployments there and experiment with all types of interesting styles.

Policy management via dynamic groups based on attributes is definitely the way to go. So long as desktop support fills out the user attributes well during on-boarding, that combined with Autopilot makes onboarding and user management such a breeze.

[-]

Seems like a flawed implementation either in the app or from admin that set it up ideally it would point to a group though i understand that your situation likely is not unlikely

[-]

IMplodeMeGrr@reddit

With companies keeping low staff and an itch to get things implemented cheaply, even from vaporware github projects... and the devs that built it moved on 3 years ago... its not a never issue.

But hey, even though ive experienced it myself, I can get on the ship and tell OP it's a never issue and never validate or worry about it.

[-]

StunningChef3117@reddit

Really sorry if it cane out arrogant or negative i now understand its more common than I thought

[-]

IMplodeMeGrr@reddit

It's more of... you came across as an exec that "knows better".

[-]

StunningChef3117@reddit

Oh thx didn’t realise

[-]

IMplodeMeGrr@reddit

LoL ...

[-]

Ssakaa@reddit

Seems like a flawed implementation

Whew. Sure glad we never have to deal with poorly designed enterprise software that does things like that... or open source (zabbix for example, and I've used others).

Using a fixed "bind dn" for the ldap sync/lookup account is common.

[-]

StunningChef3117@reddit

Sry if it seemed arrogant in any way im a student and most apps I’ve connected with ldap was able to use groups. but TIL

[-]

kona420@reddit

Glad I never spent 6 figures on a flawed piece of software from Oracle.

[-]

Isord@reddit

I work in one of the largest companies and people move all the time.

[-]

I think I'd rather come into essentially a blank slate than try to undo decades of bad decisions, unnecessary silo'ing and segmenting in wildly inconsistent ways.

Also fun if the company has purchased/merged multiple others and combined them into a monstrosity of vastly different ways of managing and existing and each site/company/etc. is personally invested and takes any attempts at standardizing like you shot their gifted toddler.

[-]

RBeck@reddit

Grouped by astrological sign. Sub-divided by Mac or PC.

[-]

CracklingRush@reddit

But it's not that huge of a pain.. heh.

[-]

Dadarian@reddit

Flat data —> Metadata is way better than endless nested directories.

[-]

YouGottaBeKittenM3@reddit

make policy management easier.

I'll go with this one

[-]

Icy_Mud2569@reddit

I’ve seen this done so many different ways, the last place I worked where I was involved in a reorganization, we put all of the users into different OUs, by department, but there were automated scripts that looked at extended attributes to determine where an account should be, based on changes initiated by the HR team.

[-]

Reedy_Whisper_45@reddit

Okay - I have a simple question.

Why? What does it do for me that I can't do with security and distribution groups?

I'm serious here. I have yet to inherit a system that uses the default Users OU, but my current system is still flat - everyone but administrators in one OU.

Last place had complex hierarchy that I adhered to, but I reaped no benefit from it. I DID have to figure out where people were and move them though when they moved from one department or division to another. Group membership would have been easier to manage.

So why?

[-]

JohnL101669@reddit

Ha! Working at a client (A MAJOR University) and they have 187k users and 40k groups....ALL IN THE DEFAULT USERS CONTAINER.

It's disgusting. I truly want to vomit every time I even look at it. Right now we're doing a specific project with them but if we get more contracts you bet your ass I will add that to the docket of things to change!

[-]

Ok_Conclusion5966@reddit

flat is better

[-]

HealthySurgeon@reddit

It’s actually a lot easier to maintain a flatter OU structure when you have 1000s of users. You’ll never be able to fit the business needs in that large of an architecture by just using OU’s.

To be frank, it sounds like you’re wanting to do exactly what Microsoft warns against when creating an OU structure.

Ugh, yes. This is one of those things that feels like a minor inconvenience until it silently morphs into full-blown tech debt. Honestly, once you cross even 25 users, lack of OU structure (or any kind of org modeling) starts to hurt—automation becomes janky, policy enforcement stays manual forever, and forget about doing any kind of meaningful monitoring.

Worse, when the org suddenly decides it’s time to “get serious about security” or kick off a compliance initiative, IT basically has to drop everything and re-architect user management from scratch.

This is one of the first things we push our customers to get right. We’ve found a good moment to do it is when there’s already a major system rollout / change happening - say in your IdP, HRIS, MDM, ERP - there’s a lot of system rearch thinking and work anyway.

Just recently worked with a 1,000-person org that had zero distinction between W2s, 1099s, and true contractors. Their Okta setup used “Department,” and the absence of one was how they flagged contractors. HR unilaterally renamed “Engineering” to “R&D” and suddenly a bunch of folks lost access to critical tools. We helped them switch to using the Cost Center field to explicitly track employment type—now it’s way more resilient.

Still, unilateral HR decisions remain an eternal scourge. We can only automate around so much chaos.

[-]

rekcomeht@reddit

i inherited it.

[-]

USMCLee@reddit

It could be worse.

Multi-company domain.

We have the users separated by country then by company.

You need to stop giving those people ad access until they understand what you want it to be lol

[-]

Mandelvolt@reddit

Burn it all down and start over with a plan 😆

[-]

TalTallon@reddit

Side note, after 20 years, I still regularly forget to move a new PC from the default OU and then wonder why GP hasn't applied

[-]

HerfDog58@reddit

I inherited an AD structure that left all the users (4000+) in the default user CONTAINER, never did OUs or organization via job duties, locations, etc.

The hoops we have to jump thru now for pushing information between our HR system, our IDM system, M365, AD, and keep all the disparate authentication processes running is NUTS. But we can't change it now, because any of our in-house production apps using AD for authentication will die kicking and screaming.

[-]

Upper-Affect5971@reddit

it’s the same person that edited the default domain policy with desktop folder redirection

[-]

h00ty@reddit

This isn’t the 1990s. There’s no point in using different OUs for everything. We base everything off Active Directory properties now.

I move terminated employees to a separate OU, but that’s just for housekeeping. It doesn’t matter where a user sits in the OU structure; their permissions and attributes won’t change because of it.

Once you move into the world of Entra, you won’t have that kind of structure to lean on.

[-]

Fallingdamage@reddit

One giant unit. Control permissions with delegation!!!!

Fair, it is the constant moving of devices and users into and out of OUs where I see some admins waste a ton of time. It also becomes completely useless the second it is not maintained so everything I built these days is just one OU. Except service accounts of course.

The worse I ever saw was a place that had OUs for specific models and they had all sorts of custom scripts running for things like dell command. It was nightmare fuel for sure.

[-]

Defconx19@reddit (OP)

Yeah i don't go deep with it, and typically employ it to a level where it matches broad policies.

I'm also in the MSP world so not the same views as internal. Groups are the primary delegation and targeting, But when you have low level techs in and out of environments at varying levels of maturity, something as simple as 365 Users OU and non-365 Users for example even go away long way to quickly identify synced accounts. Sure you could find the groups too but the OU's are right in front of your face and typically easier and faster to flush out when needed.

Deepest I go is typically s I meshing like, Company name User, below that Executive Leadership, HR, Finance, Legal, Operations and maybe a few more, but I don't break them up any further, at minimum with a quick look at AD I want anyone with half a brain to see Users with access to sensitive or privileged information without relying on a separate system or knowledge base whenever posssible.

But I have other environments where we don't do that. So its definitely case by case.

[-]

entropic@reddit

The first place I worked a million years ago was like this. Small non-profit org, not a tech company but used tech in their products.

I was very very very entry level, my first IT job, and my colleagues said something along the lines of "don't do anything new/different in the Active Directory, we barely understand how it works ourselves and we worry about breaking everything again."

Easy enough in that sort of environment and my level to not rock the boat. Everything got created in the default containers.

Years later, someone who works there's brother is a Microsoft MVP and we con him into helping us with some stuff with I think baked goods and some lunch. We blow his mind with our incompetence and fear, and he blows our minds with basic administrative concepts like OUs and GPOs. Everyone still living in fear after he left though. He told me some books to read to educate myself on these and other topics, which I got to do at my next job.

The funny irony is that setting up OUs/groups, blocking inheritance, linking/re-linking policies as needed, have more rather than fewer policies, etc, all makes it much easier to test a change before you break your whole environment.

[-]

CatsAreMajorAssholes@reddit

I AM CHAOS AND MAYHEM AND I DO WHAT I WANT

[-]

RoxoRoxo@reddit

we have 9 people dont judge me

[-]

soggybiscuit93@reddit

We're going through a big merger now and moving both companies (5 figure user count total) into a brand new AD.

Were looking at a mostly flat OU structure. Service accounts, admin accounts, SG's, etc. Will all be in different (top level OUs) - but there's really no point for breaking apart end users into different OUs.

Defconx19@reddit (OP)

Dont get it confused, while I use this as an example I've found every domain so far that dumps users in the default OU typically have no other methods to their madness on permission delegation

Typically followed with inheritance on file shares broken 50 ways til Sunday with direct permissions to folders everywhere where.

Different strokes for different folks, but some people just be chaotic for no reason.

[-]

QuiteFatty@reddit

You assume my shitshow company has a plan.

[-]

hihcadore@reddit

Hope they updated the description block at least hahahaha

[-]

signalcc@reddit

lol I have mine so broken out it’s almost annoying. I have it by department then by office then by user/computer/laptop. Those 3 OUs below the office. It’s not insane but it’s also only about 650 people so it works pretty well for us.

[-]

Some orgs use external management tools against AD.

[-]

cjcox4@reddit

Historically, we built the OU structure under Users. Why? Integration wise things will want to enumerate all users from a base without necessarily having to go "full tree". And, at least in our case, early on, when the company was tiny, all was, as you said, under Users.

I guess the worst case is having trees only joined at the very top, but arguably, that's just Users, but worse (more objects to sift through). For full enumeration, you're giving a lot of rights way to all those different trees.... or you open up the top (which probably don't want). Many ways to skin a cat. Some are more painful than others.

So... yes, we have structure and nobody sits simply at OU=Users, they are under OUs inside of that, but for enumeration, old school searches off OU=Users continue to work for find "all users". Again, this is mainly for things that support LDAPS and often times will use LDAPS bind for auth. Things outside of Microsoft (only) land.

Spore-Gasm@reddit

At least the domain isn’t office.local

[-]

crashorbit@reddit

Arbitrary hierarchies are of the devil. Use groups to manage groups. Exploit hierarchy when you must. Keep the entry hierarchy shallow.

[-]

rustytrailer@reddit

My first job in the field for some bag biter break/fix shop was like this.

It was a crash course in IT figuring shit out for 2 years before I bounced. When I left I learned about GPO’s and realized my last team actually had no idea of group policies. One of them was a sysadmin for 15 years? Not a single group policy for any client.

[-]

ibringstharuckus@reddit

With just one group policy that gives every printer and desktop shortcut

[-]

orion3311@reddit

Mine was literally that way until I wanted to set up ldap address books on our copiers, and I didn't want "extra" accounts showing up. Suddenly, a lightbulb flickered on and I realized I could have an "active users" OU that just included the warm bodies, and my 10 minute ldap project was a multi-day re-org of AD.

[-]