Because active directory security groups can...

• hold objects regardless of OU.
• be used for reporting, documentation, inventory, etc.
• be referenced by automated processes (Get-QADGroupMember).
• be used to apply policy
• be used by WSUS

I would like to use security groups as hierarchical tags, representing various attributes of a computer or user. I am thinking of (computer centric) tags something like these:

/tag/vendor/vendorName
/tag/system/overallSystemName
/tag/application/vendorsApplicationName
/tag/dependantOn/computerName
/tag/department/departmentName
/tag/updates/Group1

Before fumbling through implementing this, I thought I would seek comments from the community. Specifically in the areas:

• Does this make sense?
• Would it work?
• Has anyone else attempted this?
• Is there a good reference on the matter I should read?
• How best to implement the hierarchy?
  • Tag_OU\Type_OU\GroupName (limits quantity in OU, uniqueness not guaranteed)
  • Tag_OU\Type_OU\Tag-Type-GroupName (limits quantity in OU, uniqueness guaranteed, verbose)
• etc ...

Thanks in advance!