Designing the Active Directory Structure
Designing the Active Directory Structure |
|
Creating new OUs, moving OU subtrees within a domain, moving objects between OUs in the same domain, and deleting OUs are simple tasks.
Moving an object or subtree of objects will change the parent container of those objects. ACEs that were inherited from the old parent will no longer apply, and there might be new inherited ACEs from the new parent. To avoid unexpected changes in access, evaluate in advance what the changes will be and determine whether those changes will have any impact on the users that currently access and manage those objects.
Moving a user object, computer object, or a subtree containing user or computer objects can change the Group Policy that is applied to those objects. To avoid unexpected changes in client configurations, evaluate the changes in Group Policy and ensure that they are acceptable for end users.