Skip to content

Enterprise OU Design

This page defines the approved Active Directory OU structure now used by the validated lab and the deployment scripts in this repository.

This page must stay aligned with:

  • data/ou-baseline.csv
  • scripts/Configure-HQ-DC01-PostPromotion.ps1
  • scripts/Validate-HQ-DC01.ps1

Objective

Use a predictable OU model for the first production-style deployment in corp.gntech.me that:

  • preserves the validated tier and object branches already used in the lab
  • gives GPO, delegation, and lifecycle boundaries without requiring a redesign later
  • keeps day-zero deployment scriptable from a data file rather than a hardcoded document only
  • allows customer variation through an editable OU template CSV

Approved Initial OU Structure

Use data/ou-baseline.csv as the authoritative deployment template.

Top-level OUs created under OU=GNTECH in the validated baseline:

  • Tier0
  • Tier1
  • Tier2
  • Users
  • Workstations
  • Servers
  • Groups
  • ServiceAccounts
  • Admins
  • Sites
  • Staging
  • Quarantine

Design Principles

  • Keep the domain root clean.
  • Use one customer root OU below the domain root.
  • Keep the documented structure aligned with the deployable CSV and scripts.
  • Separate baseline branches by actual control boundary: identity, devices, groups, sites, and privilege.
  • Preserve the validated tier structure because the current service-account and admin-account model already depends on it.

Logical Model

Approved Project Mapping

The approved validated mapping for this project is:

DC=corp,DC=gntech,DC=me
  OU=GNTECH
    OU=Tier0
      OU=AdminGroups
      OU=Delegation
      OU=PrivilegedRoles
    OU=Tier1
      OU=AdminGroups
      OU=Delegation
      OU=PrivilegedRoles
    OU=Tier2
      OU=AdminGroups
      OU=Delegation
      OU=PrivilegedRoles
    OU=Users
      OU=Corporate
      OU=Regional
      OU=Contractors
      OU=PrivilegedExcluded
      OU=Disabled
    OU=Workstations
      OU=AMER
      OU=EMEA
      OU=APAC
      OU=Kiosks
      OU=VDI
      OU=Quarantine
    OU=Servers
      OU=Infrastructure
      OU=Applications
      OU=Regional
      OU=JumpHosts
    OU=Groups
      OU=RoleBased
      OU=ResourceBased
      OU=MailEnabled
      OU=Delegation
    OU=ServiceAccounts
      OU=Tier0
      OU=Tier1
      OU=Tier2
      OU=Applications
    OU=Admins
      OU=Tier0
      OU=Tier1
      OU=Tier2
      OU=EmergencyAccess
    OU=Sites
      OU=AMER
      OU=EMEA
      OU=APAC
    OU=Staging
    OU=Quarantine

GPO Guidance

This structure supports a clean initial GPO model:

  • link server baseline policies to OU=Servers
  • link workstation baseline policies to OU=Workstations
  • keep domain controller policies on OU=Domain Controllers
  • link user baseline policies to OU=Users
  • place named admin users under OU=Admins
  • place service accounts under OU=ServiceAccounts

Future Expansion

If the organization wants a simpler or customer-specific variant, do not edit this page first.

Instead:

  1. copy data/ou-baseline.csv
  2. adjust the rows for the target customer
  3. pass the CSV path to the OU-creation and OU-validation scripts
  4. update the client overlay and only then update the design page if the change becomes a published standard

Final Recommendation

For this repository, the approved OU baseline is the one currently validated in the lab and represented in data/ou-baseline.csv.

Do not treat older Accounts/Computers/Groups examples as active project standard. The deployable standard is the current tier-and-object model used by the scripts and runbooks.