RE: Groups That Must Remain In AD Users OU?
- From: BrianG <BrianG@xxxxxxxxxxxxxxxx>
- Date: Fri, 28 Mar 2008 15:16:01 -0700
I was able to find the following information and since this has to do with an
AD OU, I will post it here:
The Users container is the default container for all newly-created users and
groups. Certainly we can move them to any other organizational units later as
needed. There is only one exception for a domain environment with Exchange
deployed.
If we are using Microsoft Exchange Server, we must not move the "Exchange
Domain Servers" group or the "Exchange Enterprise Servers" group out of this
default Users container. These two groups must remain in the default Users
container for Exchange to function properly. For any other users/groups we
can move as we like without any problems.
For more information please refer to the following Microsoft articles:
260914 Domainprep utility does not work if Exchange Enterprise Servers group
and Exchange Domain Servers group moved to a new container
(http://support.microsoft.com/default.aspx?scid=kb;EN-US;260914)
324949 Redirecting the users and computers containers in Windows Server 2003
domains (http://support.microsoft.com/default.aspx?scid=kb;EN-US;324949)
Thanks,
Brian
"Morgan che(MSFT)" wrote:
Hi,.
As far as I know, there is no such system requirement that some users must
be under Users OU. Most applications mostly care about SID. However, if we
move user accounts between different OUs under the same domain, the user's
SID will not be changed. So it won't affect these applications. If some
applications require that some users/groups remain in Users OU, it would
highly depend on the implementation of the specific applications.
If you doubt some users must remain in Users OU under an Exchange
environment, you may post in the following newsgroups whose engineers are
specialized in Exchange and have more knowledge on the special requirement
of Exchange.
microsoft.public.exchange.admin
More information about SID, please refer to the following articles:
=======
Well-known security identifiers in Windows operating systems
http://support.microsoft.com/kb/243330/en-us
How Security Identifiers Work
http://technet2.microsoft.com/windowsserver/en/library/5dbc99be-7404-41a6-9b
e7-171d40c398db1033.mspx?mfr=true
I hope this helps. If anything is unclear, please feel free to post back.
Sincerely
Morgan Che
Microsoft Online Support
Microsoft Global Technical Support Center
Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
--->Thread-Topic: Groups That Must Remain In AD Users OU?
--->thread-index: AciQWu71OKuLmVccQV27PrYodsLL6A==
--->X-WBNR-Posting-Host: 207.46.19.168
--->From: =?Utf-8?B?QnJpYW5H?= <BrianG@xxxxxxxxxxxxxxxx>
--->Subject: Groups That Must Remain In AD Users OU?
--->Date: Thu, 27 Mar 2008 15:36:01 -0700
--->Lines: 4
--->Message-ID: <8925F729-EAFA-4DC6-AAB4-5A029FF3184B@xxxxxxxxxxxxx>
--->MIME-Version: 1.0
--->Content-Type: text/plain;
---> charset="Utf-8"
--->Content-Transfer-Encoding: 7bit
--->X-Newsreader: Microsoft CDO for Windows 2000
--->Content-Class: urn:content-classes:message
--->Importance: normal
--->Priority: normal
--->X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
--->Newsgroups: microsoft.public.windows.server.active_directory
--->Path: TK2MSFTNGHUB02.phx.gbl
--->Xref: TK2MSFTNGHUB02.phx.gbl
microsoft.public.windows.server.active_directory:39272
--->NNTP-Posting-Host: tk2msftsbfm01.phx.gbl 10.40.244.148
--->X-Tomcat-NG: microsoft.public.windows.server.active_directory
--->
--->Does anyone have a link to a document that lists which groups must
remain in
--->the AD Users OU, especially when you have other Microsoft products in
your
--->domain like Exchange? I've seen this document before, but haven't been
able
--->to find it.
--->
- References:
- Groups That Must Remain In AD Users OU?
- From: BrianG
- RE: Groups That Must Remain In AD Users OU?
- From: Morgan che(MSFT)
- Groups That Must Remain In AD Users OU?
- Prev by Date: Re: DSADD COMPUTER - Doesn't work right!
- Next by Date: Changing CUSTOM attributes from commandline
- Previous by thread: RE: Groups That Must Remain In AD Users OU?
- Next by thread: Computer Does Not Allow ANY Use To Search Using AD Group Alias Nam
- Index(es):
Relevant Pages
|
