Nesting Organizational Units Too Deeply
Article KB310997 in the Microsoft Knowledge Base recommends that you don’t nest organizational units (OUs) more deeply than 15 levels. This particular article applies to Active Directory environments that use Windows 2000 Server or Windows Server 2003. But what about Windows Server 2008? Does Windows Server 2008’s Active Directory Domain Services (AD DS—the new name for Active Directory) support more than 15 levels of OUs?
I don’t have any info on this, but I do take issue with the KB article referenced above. For while Active Directory may support 15 (or more) levels of OUs in a domain, this doesn’t mean it’s a good idea to create such a structure.
Think about it—let’s say that you create 15 levels of OUs to mirror some (freakish) aspect of the organizational structure of your company. Now imagine what the distinguished name (DN) for one of your users might look like:
CN=Gordon G. Gekko Jr.,OU=Interns,OU=Not Permanent,OU=Asset-Backed Commercial Paper,OU=Subprime Mortgages,OU=Western Trading Desk,OU=Institutional Investing Department,OU=Financial Operations,OU=Investment Banking Division,OU=Room 14,OU=North Wing,OU=Floor 12,OU=Building 14,OU=Western Campus,OU=Seattle Users,OU=Seattle,DC=Contoso,DC=COM
What’s the problem here? First, some Active Directory tools may have difficulty parsing a DN as large as this. Second, you’re more likely to hit the limit for AD attribute length when your DNs are this long. These are both technical issues that can cause real problems for managing your AD environment. And of course there’s the obvious issue of having to manage a deep and complex hierarchy of OUs.
Moral of the story? Go shallow in your OU hierarchy.
Got comments concerning this tip? Want to share a tip of your own with ITWorld readers? Email me
Build your tech library with our book giveaways.
Hacking Exposed, Sixth Edition
By Stuart McClure, Joel Scambray, George Kurtz; Published by McGraw-Hill/Osborne
The original Hacking Exposed authors rejoin forces on this tenth anniversary edition to offer completely up-to-date coverage of today's most devastating hacks and how to prevent them. Using their proven methodology, the authors reveal how to locate and patch system vulnerabilities. The book includes new coverage of ISO images, wireless and RFID attacks, Web 2.0 vulnerabilities, anonymous hacking tools, Ubuntu, Windows Server 2008, mobile devices, and more. Enter now!
