With a top-level OU in place, rights over the directory service can start explicitly at the OU level rather than at the domain levelīelow the top-level OUs, you should create separate sub-OU hierarchies to represent each region or business unit that has a discrete data management team. This OU serves the specific purpose of defining the highest-level scope of management for the Tier 4 Admins.

A top-level OU (or series of OUs) should be created directly beneath the domain to house all objects.

Once roles are defined in the organization, you should define your OU and security group model. Serve as top-tier help desk and escalation point for all regional admins. * Tier 3 Admins - Responsible for management of all data administrators. Granted permissions to create most objects within their OU. * Regional Admins - Responsible for the management of their local OU structure. * Tier 2 Admins - Responsible for the selective creation and deletion of user and computer accounts for their locale or organization.

* Tier 1 Admins - Responsible for general management of directory objects, including performing password resets, modifying user account properties, and so on. Serve as an escalation point for data administrators. Granted only the rights necessary to manage necessary services. * Tier 4 Admins - Responsible for service administration across the domain. Should contain only a small, manageable number of trusted administrators. * Domain Admins - Responsible for top-level service administration across the domain. * Enterprise Admins - Responsible for top-level service administration across the enterprise. Best practices suggest using the following roles: The first thing you need to do is to create a set of administrator roles and assign them proper responsibilities.

Active directory ou permissions report