3
Section 3: The Architecture of Success and Choosing Your Model 6:41 Eli: This is where the "art" of AD design comes in. There are three main models people use: the Geographic model, the Object Type model, and the Department model. And honestly, most successful modern setups are a hybrid of these.
6:54 Lena: Let's break those down. The Geographic model sounds pretty straightforward—splitting things up by office location, right?
7:01 Eli: Right. You have "New York," "London," "Tokyo." This is fantastic for delegating to local IT teams. If the London office has its own support staff, you give them rights to the London OU. It’s also great for location-specific policies, like mapping printers for the specific floor they’re on. The downside is if you need to apply a single policy to all "Finance" people across the whole world, a pure geographic model makes that a bit of a chore.
7:26 Lena: And then there’s the Department model, which we talked about being a bit of a trap if you follow the org chart too closely. When *is* it actually useful?
7:33 Eli: It’s useful when different business units have radically different needs. If your "Research and Development" team needs totally different software and looser security restrictions than your "Legal" team, then department-level OUs make sense. But again, you don’t need an OU for a department of three people who just use standard Office apps. That’s overkill.
7:53 Lena: That brings us to the Object Type model, which sounds very... IT-centric. "Here are the users, here are the servers, here are the workstations."
8:01 Eli: This is actually the most popular starting point. Why? Because users and computers require completely different settings. You don’t apply a "Desktop Wallpaper" policy to a Server, and you don’t apply "SQL Server Memory Limits" to a user account. By separating them at the top level, you ensure your GPOs are clean and targeted.
8:20 Lena: So, if we’re building this hybrid "blueprint," what does it actually look like on paper?
8:25 Eli: Imagine your top-level "Managed" OU. Under that, you create a few key branches: "Users," "Workstations," "Servers," and "Service Accounts." Then, *inside* the "Users" branch, you might split things up by Geography or Department if you need to. Maybe you have "Users > North America > Sales."
8:44 Lena: That feels very logical. It’s organized by what the thing *is* first, then where it *is* or what it *does* second.
0:54 Eli: Exactly. And there’s one more critical branch we have to talk about: the "Admin" or "Privileged" branch. This is part of what Microsoft calls the Tiered Administration Model. You absolutely cannot have your Domain Admins living in the same OU as the regular staff.
9:06 Lena: Because if a junior admin has "Reset Password" rights on the regular User OU, and your Domain Admin is sitting in there...
9:13 Eli: Then the junior admin can reset the Domain Admin’s password and effectively take over the whole forest. It’s a huge security hole. By putting privileged accounts in their own "Tier 0" OU, you can lock them down with much stricter policies—like forcing Multi-Factor Authentication and blocking them from logging into regular workstations.
9:33 Lena: It’s like a "safe zone" for the most sensitive accounts. I’m also seeing "Service Accounts" as its own branch. Why do those need their own home? Can’t they just live with the users?
9:42 Eli: Never! Service accounts are a huge target for attackers. They often have broad permissions and, historically, passwords that never change. If you put them in their own OU, you can apply "Fine-Grained Password Policies"—which is a fancy way of saying you can make their passwords 30 characters long while keeping regular users at 12. Or, even better, you can use gMSAs—Group Managed Service Accounts.
10:05 Lena: Oh, I’ve heard of those! Those are the ones where AD manages the password for you, right? No more manual rotations or sticky notes?
10:12 Eli: Precisely! AD rotates the password every 30 days, it’s 240 characters long, and no human even knows what it is. It’s one of the best "set it and forget it" security wins you can get. But they only work if you have a structured place to put them.
10:26 Lena: This is starting to feel like a very sturdy house. We’ve got the foundation, we’ve got the rooms labeled... but how do we make sure people don’t just start renaming things or creating "Temp" folders that stay there forever? We need some rules for the road.