Summary

This chapter shows that there are many different ways to segment objects in an Active Directory hierarchy. On the one hand, you can configure a single domain with a simple OU structure. On the other hand, you can configure a multi-domain Forest with multiple namespaces and complicated multi-level OU structures. Windows 2000 and Active Directory are sophisticated enough to provide the flexibility to meet every organizational need. The deciding factors as to which configuration you implement are the business drivers for implementing Active Directory. If your business requires a complex security or access control model, or any one of the other factors that were discussed in this chapter, your Active Directory hierarchy will be complex as well.

The main point to keep in mind as you design your Active Directory hierarchy is that the more complicated the administration of the objects, including both users and computers, the more complicated the design will be. Although administration of the environment should not be a significant factor in designing the hierarchy as compared with the business drivers for your organization, it should be considered in the design process.

The next chapter discusses creating a lab environment in which you can test the Active Directory hierarchy you have designed.