Complete Active Directory redesign and GPO application
- by Wolfgang Kuehne
after much testing and hundreds of tries and hours invested I decided to consult you experts here.
Overview:
I want to apply some GPO to our users which will add some specific site to the Trusted Sites in Internet Explorer settings for all users. However, the more I try the more confusing the results become. The GPO is either applied to one group of users, or to another one. Finally, I came to the conclusion that this weird behavior is cause rather by the poor organization in Users and Groups in Active Directory. As such I want to kick the problem from the root: Redesign the Active Directory Users and Groups.
Scenario:
There is one Domain Controller, and we use Terminal Services (so there is a Terminal Server as well). Users usually log on to the Terminal Server using Remote Desktop to perform their daily tasks. I would classify the users in the following way:
IT: Admins, Software Development
Business: Administration, Management
The current structure of the Active Directory Users and Groups is a result of the previous IT management. The company has used Small Business Server which has created multiple default user groups and containers.
Unfortunately, the guys working before me have do no documentation at all. Now, as I inherit this structure I am in the no mans land. No idea which direction to head first.
As you can see, the Active Directory User and Groups have become a bit confusing. There is no SBS anymore, but when migrating from SBS to the current Windows Server 2008 R2 environment the guys before me have simply copied the same structure.
The real question:
Where should I start cleaning from, ensuring that I won't break totally the current infrastructure? What is a nice organization for the scenario that I have explained above?
Possible useful info for the current structure:
Computers folder contains Terminal Services Computers user group
Members: TerminalServer computer located at Server -> Terminalserver OU
Member of: NONE
Foreign Security Principals : EMPTY
Managed Service Accounts : EMPTY
Microsoft Exchange Security Groups : not sure if needed, our emails are administered by external service provider
Distribution Groups : not sure if needed
Security Groups : there are couple of groups which are needed
SBS users : contains all the users
Terminalserver : contains only the TerminalServer machine
