Active Directory mistake: Moving domain controller objects into a child OU of the domain controller is unsupported

By , ITworld.com |  Operating Systems, domain, network

Think about it for a moment. Support boundaries must be defined somewhere, otherwise all hell would break loose. The test matrix for enterprise networks is huge-dozens of products each with hundreds or even thousands of configuration settings. And Microsoft explicitly says "As a best practice, keep all domain controller computer accounts in the default Domain Controllers OU to ensure that domain-controller-specific Group Policy settings are consistently applied to all domain controllers in the domain" and they also say here: "Ensure that all domain controller computer accounts reside in the Domain Controllers OU." So if Microsoft says you should do it, and they say it's a best practice, then why use "business reasons" as a justification for trying to circumvent their recommendations and do something different? After all, do you really want to use your company's network as a guinea pig?

Related reading:

Migrate your active directory, don't split it
If your company wants to spin off one of its departments into a separate business, and needs to divvy up its single-domain Active Directory (AD) assets, migrate, don't split. Learning how to perform an AD migration takes time and is somewhat complicated, but it's clearly documented in many places and more importantly, it's supported by Microsoft.

Active Directory and disaster recovery
Using a "lag site", an additional domain controller on a separate subnet, and then scheduling inter-site replication to occur only once a week with the rest of your forest is not a Microsoft-supported disaster recovery scenario.

Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

Answers - Powered by ITworld

ITworld Answers helps you solve problems and share expertise. Ask a question or take a crack at answering the new questions below.

Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

Ask a Question