Windows 2003 Active Diretory (vii)--organizational unit and delegated control

Organizational unit is a smaller than the field of management units, can play a "hierarchical autonomy, authorized autonomy" advantages.

Organizational units have the following characteristics:

1. Organizational unit is a container: it can contain 9 kinds of objects: users, computers, groups, printers, shared folders, contacts, organizational units, INETORGPERSON, MSMQ routing aliases. Note, however, that an organizational unit can only contain objects within the same domain and not other domain objects.

2, organizational units can be composed of hierarchical structure.

3, the use of organizational units of the timing: usually in order to authorize the management of the establishment of organizational units. For example, the business unit has more frequent personnel changes and therefore often requires system administrators to delete, change, and establish accounts for them. The system administrator then establishes the "Business" unit, which has all the users and computers of the Business Department attached to the organizational unit, and gives the business manager the power to create, delete, and modify user and computer accounts. After that the department's account changes will not bother the system administrator, so the "establishment of organizational units" and "authorization" is very close to the relationship.

4, organizational unit and group differences: 1, a user can be subordinate to more than one group, but can only be subordinate to an organizational unit. 2, organizational units can contain groups, but the group can not contain organizational units. 3, when you set permissions on network resources, you can set to the group, but can not be set to the organizational unit.

Here's how to plan your organizational unit

1 According to geographical area division.

2, according to the Management Area Division