Active Directory OU Structure in Windows 2000

In Microsoft Windows 2000, Active Directory organizes network resources by using Organizational Units (OUs) as logical containers within a domain. OUs allow administrators to group objects—such as user accounts, computer accounts, groups, and printers—into a manageable, hierarchical structure. This organization primarily serves two critical administrative purposes: delegating administrative authority over specific sets of objects and scoping the application of Group Policy settings across the organization.

Hierarchical Arrangement

Windows 2000 Active Directory organizes OUs into a tree-like hierarchy directly beneath the domain level. Administrators structure this hierarchy to mirror the organization's operational model. Common design models include:

  • Geographic Structure: Root-level OUs represent regional offices or physical locations (e.g., New York, London), with sub-OUs representing departments within those locations.
  • Functional/Departmental Structure: Top-level OUs reflect business units or departments (e.g., Human Resources, Finance, IT), with sub-OUs dividing objects by function or location.
  • Object-Type Structure: OUs are divided strictly by the type of resource (e.g., Users, Workstations, Servers).
  • Hybrid Structure: A combination of geographic and departmental divisions tailored to specific administrative needs.

OUs can be nested inside other OUs to an arbitrary depth, allowing granular structuring that reflects internal business divisions without requiring multiple separate domains.

Contained Objects

An OU serves as a container that can hold leaf objects and other containers. The primary objects organized within an OU include:

  • User Accounts: Individual credentials and profiles.
  • Computer Accounts: Workstations and member servers.
  • Security and Distribution Groups: Collections of accounts used for permissions or messaging.
  • Shared Resources: Published printers and shared network folders.
  • Child OUs: Sub-containers that extend the hierarchy.

Objects can only exist within one OU at a time, though they can be moved freely between OUs using the Active Directory Users and Computers management console.

Administrative Delegation

One of the primary mechanisms of OU organization in Windows 2000 is the delegation of control. In earlier NT 4.0 architectures, administrative rights were largely all-or-nothing at the domain level. Windows 2000 uses OUs to establish administrative boundaries.

By using the Delegation of Control Wizard, domain administrators grant specific permissions over an OU to designated users or groups. For example, a local helpdesk team can be granted the right to reset passwords and unlock accounts exclusively within a specific regional OU, without having access to modify objects in other OUs or domain-wide settings.

Group Policy Application

Windows 2000 utilizes OUs to deploy and enforce configuration settings through Group Policy Objects (GPOs). GPOs can be linked directly to specific OUs to manage security policies, software installation, desktop environments, and script execution.

Policies are applied hierarchically: Local, Site, Domain, and then OU. When multiple OUs are nested, policies flow downward through inheritance from parent OUs to child OUs. Administrators can override standard inheritance by applying "Block Policy Inheritance" on child OUs or "No Override" on higher-level GPOs to maintain strict compliance where necessary.