Active Directory OUs and Containers
Inside a domain, objects are organized into containers — the generic structural class — and organizational units (OUs), which are containers with two extra powers:
- Exclusive ownership — an object (user, computer, group) lives in exactly one OU at a time, whereas it can be a member of many groups. OUs are for management scope; groups are for access control.
- GPO attachment — OUs (along with domains and sites) are the only directory objects a Group Policy Object can be linked to. This is the entire reason OUs exist: they are the unit of policy targeting and delegation.
Built-in containers (CN=Users, CN=Computers, CN=Builtin) are the
default landing zones for new objects. They look like OUs but can’t take GPO
links and can’t be delegated the same way — one reason well-run environments
redirect new objects (via redirusr / redircmp) into real OUs.
Properties that matter:
- OUs do not cross domain boundaries — an OU exists inside exactly one domain of the forest.
- OUs nest hierarchically, and GPOs inherit down the tree: settings applied closer to the object override conflicting settings from higher levels (with Enforced / Block Inheritance as the escape hatches on either side).
- Delegation of control (the Delegation of Control wizard /
ACLs on the OU) grants subtree-scoped admin
rights — e.g. “the helpdesk may reset passwords only under
OU=Workstations.” Overly permissive OU ACLs (GenericAll,WriteDacl,WriteOwner, GPO-editing rights) are prime privesc and persistence paths (see active-directory-weak-permissions).
Related
- active-directory-domains-trees-forests — the layers above the OU
- active-directory-groups — membership-based access control vs. OU-based management scope
- active-directory-weak-permissions — how delegated OU rights get weaponized