Also, just because OUs exist
doesn??™t mean groups don??™t exist anymore. Windows groups are still the primary way to
group user and computer accounts. You will need to make a conscious decision whether
or not grouping should be performed through the creation of OUs or through some form
of Windows group. In some cases, using groups won??™t be optional. For example, if you
are grouping users or computers for the purpose of assigning access to resources such as
a file share, you can accomplish that only via security groups.
Figure 4-3. A two-way transitive trust
2-way trust
Domain A Domain B Domain C
Domain A has a 2-way trust with Domain C
2-way trust
102 Microsoft Windows Server 2008 Administration
OUs are chosen for two main reasons: to deploy group policies and to delegate security.
Figure 4-4 shows how a domain can be split up into OUs.
NOTE If you haven??™t noticed already, I??™ve been using triangles to denote Windows Active Directory
domains. This is standard Microsoft convention since the triangle symbolizes the hierarchical nature
of Active Directory.
Flexible Single Master Operations Roles
Each server in an Active Directory domain can be either a domain controller or a member
server. A domain controller hosts the Active Directory domain service and stores a physical
copy of the Active Directory store, and it is also responsible for authenticating users
and computers.
Pages:
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144