OU design and delegation of control

Skills you'll practise

• Design an OU structure from administration and Group Policy needs rather than the org chart
• Explain why objects in the default Users and Computers containers can't receive OU-linked GPOs, and redirect new objects with redircmp and redirusr
• Delegate a specific task on an OU to a group with the Delegation of Control Wizard, granting the least rights that do the job
• Identify why built-in groups such as Account Operators are a poor substitute for delegation
• Review and document an OU's delegated permissions so they can be audited and removed

Course outline

1. 1.Designing OUs for administration and policyLesson · 20 min
2. 2.Delegation of control: least privilege, to groupsLesson · 22 min
3. 3.Reviewing, documenting and cleaning up delegationsLesson · 18 min
4. 4.OU design and delegation of control: knowledge checkKnowledge check · 14 questions
5. 5."Just put the help desk in Domain Admins"Scenario
6. 6.Final exam7 questions · passing it completes the course, so people who already know the material can test out

Sources it draws on

The lessons and questions are written from these references, so learners can go back to the original.

• Microsoft Learn: Reviewing OU Design Concepts
• Microsoft Learn: Creating an Organizational Unit Design
• Microsoft Learn: Delegating Administration by Using OU Objects
• Microsoft Learn: Delegation of Control in AD DS on Windows Server
• Microsoft Learn: Redirect users and computers containers
• Microsoft Learn: Active Directory Privileged Accounts and Groups Guide (Appendix B)
• Microsoft Learn: Appendix C: Protected Accounts and Groups in Active Directory
• Microsoft Learn: Active Directory Security Groups