Mitch Tulloch's Blog

Nesting Organizational Units Too Deeply

Article KB310997 in the Microsoft Knowledge Base recommends that you don’t nest organizational units (OUs) more deeply than 15 levels. This particular article applies to Active Directory environments that use Windows 2000 Server or Windows Server 2003. But what about Windows Server 2008? Does Windows Server 2008’s Active Directory Domain Services (AD DS—the new name for Active Directory) support more than 15 levels of OUs?

I don’t have any info on this, but I do take issue with the KB article referenced above. For while Active Directory may support 15 (or more) levels of OUs in a domain, this doesn’t mean it’s a good idea to create such a structure.

Think about it—let’s say that you create 15 levels of OUs to mirror some (freakish) aspect of the organizational structure of your company. Now imagine what the distinguished name (DN) for one of your users might look like:

CN=Gordon G. Gekko Jr.,OU=Interns,OU=Not Permanent,OU=Asset-Backed Commercial Paper,OU=Subprime Mortgages,OU=Western Trading Desk,OU=Institutional Investing Department,OU=Financial Operations,OU=Investment Banking Division,OU=Room 14,OU=North Wing,OU=Floor 12,OU=Building 14,OU=Western Campus,OU=Seattle Users,OU=Seattle,DC=Contoso,DC=COM

What’s the problem here? First, some Active Directory tools may have difficulty parsing a DN as large as this. Second, you’re more likely to hit the limit for AD attribute length when your DNs are this long. These are both technical issues that can cause real problems for managing your AD environment. And of course there’s the obvious issue of having to manage a deep and complex hierarchy of OUs.

Moral of the story? Go shallow in your OU hierarchy.

Got comments concerning this tip? Want to share a tip of your own with ITWorld readers? Email me

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world