Comments
Active Directory mistake: Moving domain controller objects into a child OU of the domain controller is unsupported
Learn about this and other classic Active Directory mistakes
View full article »
Free books
Build your tech library with our book giveaways.
Hacking Exposed, Sixth Edition
By Stuart McClure, Joel Scambray, George Kurtz; Published by McGraw-Hill/Osborne
The original Hacking Exposed authors rejoin forces on this tenth anniversary edition to offer completely up-to-date coverage of today's most devastating hacks and how to prevent them. Using their proven methodology, the authors reveal how to locate and patch system vulnerabilities. The book includes new coverage of ISO images, wireless and RFID attacks, Web 2.0 vulnerabilities, anonymous hacking tools, Ubuntu, Windows Server 2008, mobile devices, and more. Enter now!
Hello there. First of all
Hello there.First of all thanks for your article, it is very good and clear. I, however, have a good reason for putting the domain controllers inside child OUs, and I have done so and incurred into problems, so I had to move them back to the default Domain Controllers OU.
My reason is that I have 5 domain controllers in 3 different and distant sites, and each site has its own WSUS server, so I would like to have the domain controllers getting their updates from their local WSUS server, but to do that I need to apply different group policies to the servers in different locations, therefore they need to be in different OUs.
So, I couldn't find any solution to that because I can't move my domain controllers, and I believe Microsoft should have thought of that... Anyway, would you have any ideas to solve my problem without moving the domain controllers to different OUs?
Thank you again!
Hey Felipe, your solution:
Hey Felipe,your solution: make 3 different GPOs that have 3 different WSUS paths. konfigure the CAL of every GPO in that way, that only the right DCs have the permission to read und apply their corresponding policy. then link EACH of the GPO with the OU domain controllers. thats all...
GPOs using WMI Filters
this is a common issue to solve in large global deployments of domains and the biggest issue people face is not updating the GPO's if they explicitly assign the DC computer object against on the security filter and they then decommission the DC and add a new one.the easiest way around this does of course depend on your global naming standard.
Using WMI filters in GPMC you can create a WMI filter that will only ensure that the GPO you assign will only apply to computers that start with a specific WMI filter.
ie root\CIMv2 Select * from Win32_ComputerSystem WHRE Name like 'SITE-A%'
assign this to the GPO on the domain controllers OU that specifies SITE A's wsus server. hence you keep them all in one OU.