An Active Directory Container that enables hierarchical organisation of:
- Users
- Computers
- Groups
- Other OUs
It is often used for administrative delegation of tasks without granting a user full admin rights, as it allows for granting permission to manage only Objects inside a specific OU.
Group Policies are linked to OUs such that they are inherited by all Objects within the OU.
Examples
Restricted management rights
We may have a top-level OU called Employees and then child OUs under it for the various departments such as Marketing, HR, Finance, Help Desk, etc.
If an account were given the right to reset passwords over the top-level OU, this user would have the right to reset passwords for all users in the company.
However, if the OU structure were such that specific departments were child OUs of the Help Desk OU, then any user placed in the Help Desk OU would have this right delegated to them if granted.
Management of Group Policies
We may want to set a specific password policy for privileged service accounts so these accounts could be placed in a particular OU and then have a Group Policy Object assigned to it, which would enforce this password policy on all accounts placed inside of it.