Difference between revisions of "Active Directory/Documentation/Default OU"
Jump to navigation
Jump to search
| (73 intermediate revisions by 3 users not shown) | |||
| Line 1: | Line 1: | ||
| − | =Organizational Units= | + | The following is created using the script located at https://www.wolftech.ncsu.edu/pgmurphy/phpAD/create_departmental_ou.php. Please notice the Manual Steps at the end. |
| + | |||
| + | =Default Setup= | ||
| + | ==Organizational Units== | ||
<table> | <table> | ||
| − | <th width= | + | <th width=350>OU</th> |
<th>Description</th> | <th>Description</th> | ||
<tr valign=top> | <tr valign=top> | ||
| − | <td>Root OU</td> | + | <td><Root OU></td> |
<td>The departmental root OU is the top level OU delegated to the department or college. This OU should be named using the organization's common abbreviation. For example, the Department of Electrical and Computer Engineering uses the abbreviation, ECE, so its root OU should be named ECE. | <td>The departmental root OU is the top level OU delegated to the department or college. This OU should be named using the organization's common abbreviation. For example, the Department of Electrical and Computer Engineering uses the abbreviation, ECE, so its root OU should be named ECE. | ||
| − | + | <BR>This OU should be placed under the NCSU OU hierarchy corresponding to its place within NCSU's organizational hierarchy. For example, the Department of Electrical and Computer Engineering is part of the College of Engineering, so the Department of Electrical and Computer Engineering's OU should be created under the College of Engineering's OU. | |
| − | + | <BR>The managedBy property should be set to the primary OU Admin.</td> | |
</tr> | </tr> | ||
<tr valign=top> | <tr valign=top> | ||
| Line 30: | Line 33: | ||
</tr> | </tr> | ||
<tr valign=top> | <tr valign=top> | ||
| − | <td><Root OU>\ | + | <td><Root OU>\Faculty</td> |
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Faculty\Desktops</td> | ||
<td></td> | <td></td> | ||
</tr> | </tr> | ||
<tr valign=top> | <tr valign=top> | ||
| − | <td><Root OU>\ | + | <td><Root OU>\Faculty\Laptops</td> |
<td></td> | <td></td> | ||
</tr> | </tr> | ||
<tr valign=top> | <tr valign=top> | ||
| − | <td><Root OU>\ | + | <td><Root OU>\Research Labs</td> |
<td></td> | <td></td> | ||
</tr> | </tr> | ||
<tr valign=top> | <tr valign=top> | ||
| − | <td><Root OU>\ | + | <td><Root OU>\Research Labs\Sample RLab</td> |
<td></td> | <td></td> | ||
</tr> | </tr> | ||
<tr valign=top> | <tr valign=top> | ||
| − | <td><Root OU>\ | + | <td><Root OU>\Research Labs\Sample RLab\Destops</td> |
<td></td> | <td></td> | ||
</tr> | </tr> | ||
<tr valign=top> | <tr valign=top> | ||
| − | <td><Root OU>\Research Labs</td> | + | <td><Root OU>\Research Labs\Sample RLab\Laptops</td> |
<td></td> | <td></td> | ||
</tr> | </tr> | ||
| Line 71: | Line 78: | ||
<tr valign=top> | <tr valign=top> | ||
<td><Root OU>\Software Packages\<Root OU> Software</td> | <td><Root OU>\Software Packages\<Root OU> Software</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Software Packages\<Parent OU> Software</td> | ||
<td></td> | <td></td> | ||
</tr> | </tr> | ||
| Line 87: | Line 98: | ||
<tr valign=top> | <tr valign=top> | ||
<td><Root OU>\Teaching Labs</td> | <td><Root OU>\Teaching Labs</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Teaching Labs\Sample Tlab</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Teaching Labs\Sample Tlab\Desktops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Teaching Labs\Sample Tlab\Laptops</td> | ||
<td></td> | <td></td> | ||
</tr> | </tr> | ||
| Line 95: | Line 118: | ||
</table> | </table> | ||
| − | =Users= | + | ==Users== |
<table> | <table> | ||
| − | <th width= | + | <th width=375>User</th> |
<th>Description</th> | <th>Description</th> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Departmental Users\OU Admins\<unityid>.admin</td> | ||
| + | <td>Create an Administrator account for each desired IT staff member in the department. The account should be created in the <Root OU>\Departmental Users\OU Admins OU. These accounts will be given Administrator priveleges in the departmental OU and local administrator on all computers in the departmental OU.</td> | ||
| + | </tr> | ||
| + | </table> | ||
| + | |||
| + | ==Groups== | ||
| + | <table> | ||
| + | <th width=475>Group</th> | ||
| + | <th>Description</th> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-ACS Users</td> | ||
| + | <td>Members are given read access to the ACS Q drive.<br>A GPO (NCSU-ACS Users) is linked at the People OU and is filtered to the NCSU-ACS Users group to automatically mount the Q drive. This group is a member of NCSU-ACS Users. Only staff who need access to the ACS Q Drive should be members of this group.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Allow RIS</td> | ||
| + | <td>Allows members to install computers using Remote Installation Services (RIS)<br>A GPO (Domain-Allow RIS) is linked to the domain root and filtered to the NCSU-Allow RIS group to allow members of this group to use RIS to reinstall computers. This group is a member of NCSU-Allow RIS.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Computer Admins</td> | ||
| + | <td>Members of this group have Administrator priveleges on all <Root OU> computers.<br>This group is a member of the local Administrators group on all computers in the <Root OU> OU. Members of this group have Administrator priveleges on all <Root OU> computers, but no special domain priveleges. <Root OU>-OU Admins is a member of this group.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Computer Migrators</td> | ||
| + | <td>Members of this group have the ability to join computers to the domain.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Computers</td> | ||
| + | <td>This group contains all computers under the <Root OU> OU.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Desktops</td> | ||
| + | <td>This group contains all desktop computers under the <Root OU> OU.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Enable Remote Assistance</td> | ||
| + | <td>Enables Unsolicited Remote Assistance on member computers.<br>A GPO (<Root OU>-Enable Remote Assistance) is linked at the <Root OU> OU and filtered to this group that enables Unsolicited Remote Assistance on all members of this group.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Enable Remote Desktop</td> | ||
| + | <td>Enables Remote Desktop on member computers.<br>A GPO (<Root OU>-Enable Remote Desktop) is linked at the <Root OU> OU and filtered to this group that enables Remote Desktop on all members of this group.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Laptops</td> | ||
| + | <td>This group contains all laptop computers under the <Root OU> OU.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-OU Admins</td> | ||
| + | <td>This group is delegated Full access to the <Root OU> OU.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Remote Assistants</td> | ||
| + | <td>Members of this group are permitted to provide Unsolicited Remote Assistance.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Users</td> | ||
| + | <td>This group contains all users associated with the <Root OU> department.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Faculty\<Root OU>-Faculty</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Faculty\<Root OU>-Faculty.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Faculty\<Root OU>-Faculty.Desktops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Faculty\<Root OU>-Faculty.Laptops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Research Labs\<Root OU>-Research Labs.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Research Labs\<Root OU>-Research Labs.Desktops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Research Labs\<Root OU>-Research Labs.Laptops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Research Labs\<Root OU>-Research Labs.Users</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Research Labs\Sample Rlab\<Root OU>-Sample Rlab.Administrators</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Research Labs\Sample Rlab\<Root OU>-Sample Rlab.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Research Labs\Sample Rlab\<Root OU>-Sample Rlab.Desktops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Research Labs\Sample Rlab\<Root OU>-Sample Rlab.Laptops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Research Labs\Sample Rlab\<Root OU>-Sample Rlab.Users</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Staff\<Root OU>-Staff</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Staff\<Root OU>-Staff.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Staff\<Root OU>-Staff.Desktops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Staff\<Root OU>-Staff.Laptops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Teaching Labs\<Root OU>-Teaching Labs.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Teaching Labs\<Root OU>-Teaching Labs.Desktops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Teaching Labs\<Root OU>-Teaching Labs.Laptops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Teaching Labs\<Root OU>-Teaching Labs.Users</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Teaching Labs\Sample Tlab\<Root OU>-Sample Tlab.Administrators</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Teaching Labs\Sample Tlab\<Root OU>-Sample Tlab.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Teaching Labs\Sample Tlab\<Root OU>-Sample Tlab.Desktops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Teaching Labs\Sample Tlab\<Root OU>-Sample Tlab.Laptops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Teaching Labs\Sample Tlab\<Root OU>-Sample Tlab.Users</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
<tr valign=top> | <tr valign=top> | ||
<td></td> | <td></td> | ||
| Line 105: | Line 290: | ||
</table> | </table> | ||
| − | = | + | ==Group Memberships== |
<table> | <table> | ||
| − | <th width= | + | <th width=475>Group Membership</th> |
<th>Description</th> | <th>Description</th> | ||
<tr valign=top> | <tr valign=top> | ||
| + | <td><Root OU>-ACS Users --> <Parent OU>-ACS Users</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Allow RIS --> <Parent OU>-Allow RIS</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Computer Admins --> <Root OU>-Allow RIS</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Computer Admins --> <Root OU>-Remote Assistants</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Computer Migrators --> <Parent OU>-Computer Migrators</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Desktops --> <Parent OU>-Desktops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Desktops --> <Root OU>-Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Laptops --> <Parent OU>-Laptops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Laptops --> <Root OU>-Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-OU Admins --> <Parent OU>-Departmental OU Admins</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-OU Admins --> <Root OU>-Allow RIS</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Users --> <Parent OU>-Users</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><unityid>.admin --> <Root OU>-Computer Admins</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><unityid>.admin --> <Root OU>-OU Admins</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Faculty --> <Root OU>-Users</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Faculty.Desktops --> <Root OU>-Desktops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Faculty.Desktops --> <Root OU>-Faculty.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Faculty.Laptops --> <Root OU>-Laptops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Faculty.Laptops --> <Root OU>-Faculty.Computers</td> | ||
<td></td> | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Research Labs.Users --> <Root OU>-Users</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Research Labs.Desktops --> <Root OU>-Desktops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Research Labs.Desktops --> <Root OU>-Research Labs.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Research Labs.Laptops --> <Root OU>-Laptops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Research Labs.Laptops --> <Root OU>-Research Labs.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Sample Rlab.Administrators --> <Root OU>-Sample Rlab.Users</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Sample Rlab.Desktops --> <Root OU>-Research Labs.Desktops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Sample Rlab.Desktops --> <Root OU>-Sample Rlab.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Sample Rlab.Laptops --> <Root OU>-Research Labs.Laptops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Sample Rlab.Laptops --> <Root OU>-Sample Rlab.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Sample Rlab.Users --> <Root OU>-Research Labs.Users</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Staff --> <Root OU>-Users</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Staff.Desktops --> <Root OU>-Desktops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Staff.Desktops --> <Root OU>-Staff.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Staff.Laptops --> <Root OU>-Laptops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Staff.Laptops --> <Root OU>-Staff.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Teaching Labs.Users --> <Root OU>-Users</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Teaching Labs.Desktops --> <Root OU>-Desktops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Teaching Labs.Desktops --> <Root OU>-Teaching Labs.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Teaching Labs.Laptops --> <Root OU>-Laptops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Teaching Labs.Laptops --> <Root OU>-Teaching Labs.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Sample Tlab.Administrators --> <Root OU>-Sample Tlab.Users</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Sample Tlab.Desktops --> <Root OU>-Teaching Labs.Desktops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Sample Tlab.Desktops --> <Root OU>-Sample Tlab.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Sample Tlab.Laptops --> <Root OU>-Teaching Labs.Laptops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Sample Tlab.Laptops --> <Root OU>-Sample Tlab.Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Sample Tlab.Users --> <Root OU>-Teaching Labs.Users</td> | ||
<td></td> | <td></td> | ||
</tr> | </tr> | ||
</table> | </table> | ||
| − | =Group | + | ==Group Policies== |
<table> | <table> | ||
| − | <th width= | + | <th width=250>Group Policy</th> |
<th>Description</th> | <th>Description</th> | ||
<tr valign=top> | <tr valign=top> | ||
| + | <td><Root OU>-OU Policy</td> | ||
<td></td> | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Enable Remote Assistance</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Enable Remote Desktop</td> | ||
<td></td> | <td></td> | ||
</tr> | </tr> | ||
</table> | </table> | ||
| − | = | + | ==Manual Steps== |
<table> | <table> | ||
| − | <th width= | + | <th width=525>Step</th> |
<th>Description</th> | <th>Description</th> | ||
<tr valign=top> | <tr valign=top> | ||
| + | <td>Delegate: <Root OU> --> <Root OU>-OU Admins</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Managed By: <Root OU> --> <unityid>.admin</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Add in additonal OU admins</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Copy: <Root OU>-OU Policy</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Copy: <Root OU>-Enable Remote Assistance</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Copy: <Root OU>-Enable Remote Desktop</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Link: <Root OU>-OU Policy --> <Root OU></td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Link: <Root OU>-Enable Remote Assistance --> <Root OU></td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Link: <Root OU>-Enable Remote Desktop --> <Root OU></td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Filter: <Root OU>-Enable Remote Assistance --> <Root OU>-Enable Remote Assistance</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Filter: <Root OU>-Enable Remote Desktop --> <Root OU>-Enable Remote Desktop</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Delegate: <Root OU>-OU Policy --> <Root OU>-OU Admins</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Delegate: <Root OU>-Enable Remote Assistance --> <Root OU>-OU Admins</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Delegate: <Root OU>-Enable Remote Desktop --> <Root OU>-OU Admins</td> | ||
<td></td> | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Edit GPO: <Root OU>-OU Policy</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Edit GPO: <Root OU>-Enable Remote Assistance</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Configure software group replication</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Add OU admins to departmental_ou_admins table.</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Add OU to departmental_ous table.</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Setup user account creation.</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Authorize DNS domain name in msDS-AllowedDNSSuffixes.</td> | ||
<td></td> | <td></td> | ||
</tr> | </tr> | ||
</table> | </table> | ||
| − | = | + | =Basic Setup= |
| + | ==Organizational Units== | ||
<table> | <table> | ||
| − | <th width= | + | <th width=350>OU</th> |
<th>Description</th> | <th>Description</th> | ||
<tr valign=top> | <tr valign=top> | ||
| + | <td><Root OU></td> | ||
| + | <td>The departmental root OU is the top level OU delegated to the department or college. This OU should be named using the organization's common abbreviation. For example, the Department of Electrical and Computer Engineering uses the abbreviation, ECE, so its root OU should be named ECE. | ||
| + | |||
| + | <BR><BR>This OU should be placed under the NCSU OU hierarchy corresponding to its place within NCSU's organizational hierarchy. For example, the Department of Electrical and Computer Engineering is part of the College of Engineering, so the Department of Electrical and Computer Engineering's OU should be created under the College of Engineering's OU.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Departmental Users</td> | ||
<td></td> | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Departmental Users\OU Admins</td> | ||
<td></td> | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Software Packages</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Software Packages\Freeware</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Software Packages\NCSU Software</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Software Packages\<Root OU> Software</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Software Packages\<Parent OU> Software</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | </table> | ||
| + | |||
| + | ==Users== | ||
| + | <table> | ||
| + | <th width=375>User</th> | ||
| + | <th>Description</th> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\Departmental Users\OU Admins\<unityid>.admin</td> | ||
| + | <td>Create an Administrator account for each desired IT staff member in the department. The account should be created in the <Root OU>\Departmental Users\OU Admins OU. These accounts will be given Administrator priveleges in the departmental OU and local administrator on all computers in the departmental OU.</td> | ||
</tr> | </tr> | ||
</table> | </table> | ||
| − | = | + | ==Groups== |
<table> | <table> | ||
| − | <th width= | + | <th width=475>Group</th> |
<th>Description</th> | <th>Description</th> | ||
<tr valign=top> | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-ACS Users</td> | ||
| + | <td>Members are given read access to the ACS Q drive.<br>A GPO (NCSU-ACS Users) is linked at the People OU and is filtered to the NCSU-ACS Users group to automatically mount the Q drive. This group is a member of NCSU-ACS Users. Only staff who need access to the ACS Q Drive should be members of this group.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Allow RIS</td> | ||
| + | <td>Allows members to install computers using Remote Installation Services (RIS)<br>A GPO (Domain-Allow RIS) is linked to the domain root and filtered to the NCSU-Allow RIS group to allow members of this group to use RIS to reinstall computers. This group is a member of NCSU-Allow RIS.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Computer Admins</td> | ||
| + | <td>Members of this group have Administrator priveleges on all <Root OU> computers.<br>This group is a member of the local Administrators group on all computers in the <Root OU> OU. Members of this group have Administrator priveleges on all <Root OU> computers, but no special domain priveleges. <Root OU>-OU Admins is a member of this group.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Computer Migrators</td> | ||
| + | <td>Members of this group have the ability to join computers to the domain.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Computers</td> | ||
| + | <td>This group contains all computers under the <Root OU> OU.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Desktops</td> | ||
| + | <td>This group contains all desktop computers under the <Root OU> OU.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Laptops</td> | ||
| + | <td>This group contains all laptop computers under the <Root OU> OU.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-OU Admins</td> | ||
| + | <td>This group is delegated Full access to the <Root OU> OU.</td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>\<Root OU>-Users</td> | ||
| + | <td>This group contains all users associated with the <Root OU> department.</td> | ||
| + | </tr> | ||
| + | </table> | ||
| + | |||
| + | ==Group Memberships== | ||
| + | <table> | ||
| + | <th width=475>Group Membership</th> | ||
| + | <th>Description</th> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-ACS Users --> <Parent OU>-ACS Users</td> | ||
<td></td> | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Allow RIS --> <Parent OU>-Allow RIS</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Computer Admins --> <Root OU>-Allow RIS</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Computer Migrators --> <Parent OU>-Computer Migrators</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Desktops --> <Parent OU>-Desktops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Desktops --> <Root OU>-Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Laptops --> <Parent OU>-Laptops</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Laptops --> <Root OU>-Computers</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-OU Admins --> <Parent OU>-Departmental OU Admins</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-OU Admins --> <Root OU>-Allow RIS</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-Users --> <Parent OU>-Users</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><unityid>.admin --> <Root OU>-Computer Admins</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr valign=top> | ||
| + | <td><unityid>.admin --> <Root OU>-OU Admins</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | </table> | ||
| + | |||
| + | ==Group Policies== | ||
| + | <table> | ||
| + | <th width=250>Group Policy</th> | ||
| + | <th>Description</th> | ||
| + | <tr valign=top> | ||
| + | <td><Root OU>-OU Policy</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | </table> | ||
| + | |||
| + | ==Manual Steps== | ||
| + | <table> | ||
| + | <th width=350>Step</th> | ||
| + | <th>Description</th> | ||
| + | <tr valign=top> | ||
| + | <td>Delegate: <Root OU> --> <Root OU>-OU Admins</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Managed By: <Root OU> --> <unityid>.admin</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Add in additonal OU admins</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Copy: <Root OU>-OU Policy</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Link: <Root OU>-OU Policy --> <Root OU></td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Delegate: <Root OU>-OU Policy --> <Root OU>-OU Admins</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Edit GPO: <Root OU>-OU Policy</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Configure software group replication</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Add OU admins to departmental_ou_admins table.</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Add OU to departmental_ous table.</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Setup user account creation.</td> | ||
| + | <td></td> | ||
| + | </tr> | ||
| + | <tr> | ||
| + | <td>Authorize DNS domain name in msDS-AllowedDNSSuffixes.</td> | ||
<td></td> | <td></td> | ||
</tr> | </tr> | ||
</table> | </table> | ||
Latest revision as of 15:09, 11 June 2008
The following is created using the script located at https://www.wolftech.ncsu.edu/pgmurphy/phpAD/create_departmental_ou.php. Please notice the Manual Steps at the end.
Default Setup
Organizational Units
| OU | Description |
|---|---|
| <Root OU> | The departmental root OU is the top level OU delegated to the department or college. This OU should be named using the organization's common abbreviation. For example, the Department of Electrical and Computer Engineering uses the abbreviation, ECE, so its root OU should be named ECE.
The managedBy property should be set to the primary OU Admin. |
| <Root OU>\Departmental Users | |
| <Root OU>\Departmental Users\Class Accounts | |
| <Root OU>\Departmental Users\OU Admins | |
| <Root OU>\Departmental Users\Other Users | |
| <Root OU>\Departmental Users\Service Accounts | |
| <Root OU>\Faculty | |
| <Root OU>\Faculty\Desktops | |
| <Root OU>\Faculty\Laptops | |
| <Root OU>\Research Labs | |
| <Root OU>\Research Labs\Sample RLab | |
| <Root OU>\Research Labs\Sample RLab\Destops | |
| <Root OU>\Research Labs\Sample RLab\Laptops | |
| <Root OU>\Servers | |
| <Root OU>\Software Packages | |
| <Root OU>\Software Packages\Freeware | |
| <Root OU>\Software Packages\NCSU Software | |
| <Root OU>\Software Packages\<Root OU> Software | |
| <Root OU>\Software Packages\<Parent OU> Software | |
| <Root OU>\Staff | |
| <Root OU>\Staff\Desktops | |
| <Root OU>\Staff\Laptops | |
| <Root OU>\Teaching Labs | |
| <Root OU>\Teaching Labs\Sample Tlab | |
| <Root OU>\Teaching Labs\Sample Tlab\Desktops | |
| <Root OU>\Teaching Labs\Sample Tlab\Laptops | |
| <Root OU>\Unassigned |
Users
| User | Description |
|---|---|
| <Root OU>\Departmental Users\OU Admins\<unityid>.admin | Create an Administrator account for each desired IT staff member in the department. The account should be created in the <Root OU>\Departmental Users\OU Admins OU. These accounts will be given Administrator priveleges in the departmental OU and local administrator on all computers in the departmental OU. |
Groups
| Group | Description |
|---|---|
| <Root OU>\<Root OU>-ACS Users | Members are given read access to the ACS Q drive. A GPO (NCSU-ACS Users) is linked at the People OU and is filtered to the NCSU-ACS Users group to automatically mount the Q drive. This group is a member of NCSU-ACS Users. Only staff who need access to the ACS Q Drive should be members of this group. |
| <Root OU>\<Root OU>-Allow RIS | Allows members to install computers using Remote Installation Services (RIS) A GPO (Domain-Allow RIS) is linked to the domain root and filtered to the NCSU-Allow RIS group to allow members of this group to use RIS to reinstall computers. This group is a member of NCSU-Allow RIS. |
| <Root OU>\<Root OU>-Computer Admins | Members of this group have Administrator priveleges on all <Root OU> computers. This group is a member of the local Administrators group on all computers in the <Root OU> OU. Members of this group have Administrator priveleges on all <Root OU> computers, but no special domain priveleges. <Root OU>-OU Admins is a member of this group. |
| <Root OU>\<Root OU>-Computer Migrators | Members of this group have the ability to join computers to the domain. |
| <Root OU>\<Root OU>-Computers | This group contains all computers under the <Root OU> OU. |
| <Root OU>\<Root OU>-Desktops | This group contains all desktop computers under the <Root OU> OU. |
| <Root OU>\<Root OU>-Enable Remote Assistance | Enables Unsolicited Remote Assistance on member computers. A GPO (<Root OU>-Enable Remote Assistance) is linked at the <Root OU> OU and filtered to this group that enables Unsolicited Remote Assistance on all members of this group. |
| <Root OU>\<Root OU>-Enable Remote Desktop | Enables Remote Desktop on member computers. A GPO (<Root OU>-Enable Remote Desktop) is linked at the <Root OU> OU and filtered to this group that enables Remote Desktop on all members of this group. |
| <Root OU>\<Root OU>-Laptops | This group contains all laptop computers under the <Root OU> OU. |
| <Root OU>\<Root OU>-OU Admins | This group is delegated Full access to the <Root OU> OU. |
| <Root OU>\<Root OU>-Remote Assistants | Members of this group are permitted to provide Unsolicited Remote Assistance. |
| <Root OU>\<Root OU>-Users | This group contains all users associated with the <Root OU> department. |
| <Root OU>\Faculty\<Root OU>-Faculty | |
| <Root OU>\Faculty\<Root OU>-Faculty.Computers | |
| <Root OU>\Faculty\<Root OU>-Faculty.Desktops | |
| <Root OU>\Faculty\<Root OU>-Faculty.Laptops | |
| <Root OU>\Research Labs\<Root OU>-Research Labs.Computers | |
| <Root OU>\Research Labs\<Root OU>-Research Labs.Desktops | |
| <Root OU>\Research Labs\<Root OU>-Research Labs.Laptops | |
| <Root OU>\Research Labs\<Root OU>-Research Labs.Users | |
| <Root OU>\Research Labs\Sample Rlab\<Root OU>-Sample Rlab.Administrators | |
| <Root OU>\Research Labs\Sample Rlab\<Root OU>-Sample Rlab.Computers | |
| <Root OU>\Research Labs\Sample Rlab\<Root OU>-Sample Rlab.Desktops | |
| <Root OU>\Research Labs\Sample Rlab\<Root OU>-Sample Rlab.Laptops | |
| <Root OU>\Research Labs\Sample Rlab\<Root OU>-Sample Rlab.Users | |
| <Root OU>\Staff\<Root OU>-Staff | |
| <Root OU>\Staff\<Root OU>-Staff.Computers | |
| <Root OU>\Staff\<Root OU>-Staff.Desktops | |
| <Root OU>\Staff\<Root OU>-Staff.Laptops | |
| <Root OU>\Teaching Labs\<Root OU>-Teaching Labs.Computers | |
| <Root OU>\Teaching Labs\<Root OU>-Teaching Labs.Desktops | |
| <Root OU>\Teaching Labs\<Root OU>-Teaching Labs.Laptops | |
| <Root OU>\Teaching Labs\<Root OU>-Teaching Labs.Users | |
| <Root OU>\Teaching Labs\Sample Tlab\<Root OU>-Sample Tlab.Administrators | |
| <Root OU>\Teaching Labs\Sample Tlab\<Root OU>-Sample Tlab.Computers | |
| <Root OU>\Teaching Labs\Sample Tlab\<Root OU>-Sample Tlab.Desktops | |
| <Root OU>\Teaching Labs\Sample Tlab\<Root OU>-Sample Tlab.Laptops | |
| <Root OU>\Teaching Labs\Sample Tlab\<Root OU>-Sample Tlab.Users | |
Group Memberships
| Group Membership | Description |
|---|---|
| <Root OU>-ACS Users --> <Parent OU>-ACS Users | |
| <Root OU>-Allow RIS --> <Parent OU>-Allow RIS | |
| <Root OU>-Computer Admins --> <Root OU>-Allow RIS | |
| <Root OU>-Computer Admins --> <Root OU>-Remote Assistants | |
| <Root OU>-Computer Migrators --> <Parent OU>-Computer Migrators | |
| <Root OU>-Desktops --> <Parent OU>-Desktops | |
| <Root OU>-Desktops --> <Root OU>-Computers | |
| <Root OU>-Laptops --> <Parent OU>-Laptops | |
| <Root OU>-Laptops --> <Root OU>-Computers | |
| <Root OU>-OU Admins --> <Parent OU>-Departmental OU Admins | |
| <Root OU>-OU Admins --> <Root OU>-Allow RIS | |
| <Root OU>-Users --> <Parent OU>-Users | |
| <unityid>.admin --> <Root OU>-Computer Admins | |
| <unityid>.admin --> <Root OU>-OU Admins | |
| <Root OU>-Faculty --> <Root OU>-Users | |
| <Root OU>-Faculty.Desktops --> <Root OU>-Desktops | |
| <Root OU>-Faculty.Desktops --> <Root OU>-Faculty.Computers | |
| <Root OU>-Faculty.Laptops --> <Root OU>-Laptops | |
| <Root OU>-Faculty.Laptops --> <Root OU>-Faculty.Computers | |
| <Root OU>-Research Labs.Users --> <Root OU>-Users | |
| <Root OU>-Research Labs.Desktops --> <Root OU>-Desktops | |
| <Root OU>-Research Labs.Desktops --> <Root OU>-Research Labs.Computers | |
| <Root OU>-Research Labs.Laptops --> <Root OU>-Laptops | |
| <Root OU>-Research Labs.Laptops --> <Root OU>-Research Labs.Computers | |
| <Root OU>-Sample Rlab.Administrators --> <Root OU>-Sample Rlab.Users | |
| <Root OU>-Sample Rlab.Desktops --> <Root OU>-Research Labs.Desktops | |
| <Root OU>-Sample Rlab.Desktops --> <Root OU>-Sample Rlab.Computers | |
| <Root OU>-Sample Rlab.Laptops --> <Root OU>-Research Labs.Laptops | |
| <Root OU>-Sample Rlab.Laptops --> <Root OU>-Sample Rlab.Computers | |
| <Root OU>-Sample Rlab.Users --> <Root OU>-Research Labs.Users | |
| <Root OU>-Staff --> <Root OU>-Users | |
| <Root OU>-Staff.Desktops --> <Root OU>-Desktops | |
| <Root OU>-Staff.Desktops --> <Root OU>-Staff.Computers | |
| <Root OU>-Staff.Laptops --> <Root OU>-Laptops | |
| <Root OU>-Staff.Laptops --> <Root OU>-Staff.Computers | |
| <Root OU>-Teaching Labs.Users --> <Root OU>-Users | |
| <Root OU>-Teaching Labs.Desktops --> <Root OU>-Desktops | |
| <Root OU>-Teaching Labs.Desktops --> <Root OU>-Teaching Labs.Computers | |
| <Root OU>-Teaching Labs.Laptops --> <Root OU>-Laptops | |
| <Root OU>-Teaching Labs.Laptops --> <Root OU>-Teaching Labs.Computers | |
| <Root OU>-Sample Tlab.Administrators --> <Root OU>-Sample Tlab.Users | |
| <Root OU>-Sample Tlab.Desktops --> <Root OU>-Teaching Labs.Desktops | |
| <Root OU>-Sample Tlab.Desktops --> <Root OU>-Sample Tlab.Computers | |
| <Root OU>-Sample Tlab.Laptops --> <Root OU>-Teaching Labs.Laptops | |
| <Root OU>-Sample Tlab.Laptops --> <Root OU>-Sample Tlab.Computers | |
| <Root OU>-Sample Tlab.Users --> <Root OU>-Teaching Labs.Users |
Group Policies
| Group Policy | Description |
|---|---|
| <Root OU>-OU Policy | |
| <Root OU>-Enable Remote Assistance | |
| <Root OU>-Enable Remote Desktop |
Manual Steps
| Step | Description |
|---|---|
| Delegate: <Root OU> --> <Root OU>-OU Admins | |
| Managed By: <Root OU> --> <unityid>.admin | |
| Add in additonal OU admins | |
| Copy: <Root OU>-OU Policy | |
| Copy: <Root OU>-Enable Remote Assistance | |
| Copy: <Root OU>-Enable Remote Desktop | |
| Link: <Root OU>-OU Policy --> <Root OU> | |
| Link: <Root OU>-Enable Remote Assistance --> <Root OU> | |
| Link: <Root OU>-Enable Remote Desktop --> <Root OU> | |
| Filter: <Root OU>-Enable Remote Assistance --> <Root OU>-Enable Remote Assistance | |
| Filter: <Root OU>-Enable Remote Desktop --> <Root OU>-Enable Remote Desktop | |
| Delegate: <Root OU>-OU Policy --> <Root OU>-OU Admins | |
| Delegate: <Root OU>-Enable Remote Assistance --> <Root OU>-OU Admins | |
| Delegate: <Root OU>-Enable Remote Desktop --> <Root OU>-OU Admins | |
| Edit GPO: <Root OU>-OU Policy | |
| Edit GPO: <Root OU>-Enable Remote Assistance | |
| Configure software group replication | |
| Add OU admins to departmental_ou_admins table. | |
| Add OU to departmental_ous table. | |
| Setup user account creation. | |
| Authorize DNS domain name in msDS-AllowedDNSSuffixes. |
Basic Setup
Organizational Units
| OU | Description |
|---|---|
| <Root OU> | The departmental root OU is the top level OU delegated to the department or college. This OU should be named using the organization's common abbreviation. For example, the Department of Electrical and Computer Engineering uses the abbreviation, ECE, so its root OU should be named ECE.
This OU should be placed under the NCSU OU hierarchy corresponding to its place within NCSU's organizational hierarchy. For example, the Department of Electrical and Computer Engineering is part of the College of Engineering, so the Department of Electrical and Computer Engineering's OU should be created under the College of Engineering's OU. |
| <Root OU>\Departmental Users | |
| <Root OU>\Departmental Users\OU Admins | |
| <Root OU>\Software Packages | |
| <Root OU>\Software Packages\Freeware | |
| <Root OU>\Software Packages\NCSU Software | |
| <Root OU>\Software Packages\<Root OU> Software | |
| <Root OU>\Software Packages\<Parent OU> Software |
Users
| User | Description |
|---|---|
| <Root OU>\Departmental Users\OU Admins\<unityid>.admin | Create an Administrator account for each desired IT staff member in the department. The account should be created in the <Root OU>\Departmental Users\OU Admins OU. These accounts will be given Administrator priveleges in the departmental OU and local administrator on all computers in the departmental OU. |
Groups
| Group | Description |
|---|---|
| <Root OU>\<Root OU>-ACS Users | Members are given read access to the ACS Q drive. A GPO (NCSU-ACS Users) is linked at the People OU and is filtered to the NCSU-ACS Users group to automatically mount the Q drive. This group is a member of NCSU-ACS Users. Only staff who need access to the ACS Q Drive should be members of this group. |
| <Root OU>\<Root OU>-Allow RIS | Allows members to install computers using Remote Installation Services (RIS) A GPO (Domain-Allow RIS) is linked to the domain root and filtered to the NCSU-Allow RIS group to allow members of this group to use RIS to reinstall computers. This group is a member of NCSU-Allow RIS. |
| <Root OU>\<Root OU>-Computer Admins | Members of this group have Administrator priveleges on all <Root OU> computers. This group is a member of the local Administrators group on all computers in the <Root OU> OU. Members of this group have Administrator priveleges on all <Root OU> computers, but no special domain priveleges. <Root OU>-OU Admins is a member of this group. |
| <Root OU>\<Root OU>-Computer Migrators | Members of this group have the ability to join computers to the domain. |
| <Root OU>\<Root OU>-Computers | This group contains all computers under the <Root OU> OU. |
| <Root OU>\<Root OU>-Desktops | This group contains all desktop computers under the <Root OU> OU. |
| <Root OU>\<Root OU>-Laptops | This group contains all laptop computers under the <Root OU> OU. |
| <Root OU>\<Root OU>-OU Admins | This group is delegated Full access to the <Root OU> OU. |
| <Root OU>\<Root OU>-Users | This group contains all users associated with the <Root OU> department. |
Group Memberships
| Group Membership | Description |
|---|---|
| <Root OU>-ACS Users --> <Parent OU>-ACS Users | |
| <Root OU>-Allow RIS --> <Parent OU>-Allow RIS | |
| <Root OU>-Computer Admins --> <Root OU>-Allow RIS | |
| <Root OU>-Computer Migrators --> <Parent OU>-Computer Migrators | |
| <Root OU>-Desktops --> <Parent OU>-Desktops | |
| <Root OU>-Desktops --> <Root OU>-Computers | |
| <Root OU>-Laptops --> <Parent OU>-Laptops | |
| <Root OU>-Laptops --> <Root OU>-Computers | |
| <Root OU>-OU Admins --> <Parent OU>-Departmental OU Admins | |
| <Root OU>-OU Admins --> <Root OU>-Allow RIS | |
| <Root OU>-Users --> <Parent OU>-Users | |
| <unityid>.admin --> <Root OU>-Computer Admins | |
| <unityid>.admin --> <Root OU>-OU Admins |
Group Policies
| Group Policy | Description |
|---|---|
| <Root OU>-OU Policy |
Manual Steps
| Step | Description |
|---|---|
| Delegate: <Root OU> --> <Root OU>-OU Admins | |
| Managed By: <Root OU> --> <unityid>.admin | |
| Add in additonal OU admins | |
| Copy: <Root OU>-OU Policy | |
| Link: <Root OU>-OU Policy --> <Root OU> | |
| Delegate: <Root OU>-OU Policy --> <Root OU>-OU Admins | |
| Edit GPO: <Root OU>-OU Policy | |
| Configure software group replication | |
| Add OU admins to departmental_ou_admins table. | |
| Add OU to departmental_ous table. | |
| Setup user account creation. | |
| Authorize DNS domain name in msDS-AllowedDNSSuffixes. |