Technical Anshu
Tutorials Blog
🗂️ Active Directory Basics

Active Directory Structure Guide Create OUs Users and Groups the Clean Way

A messy Active Directory is easy to create and painful to clean. This guide builds the structure in the right order - OUs first, then users, then groups - so policy and delegation stay simple for years.

✍️ Technical Anshu🪟 Windows Server⏱️ 12 minute setup
🎥 Watch the full video - every OU, user and group created live, step by step

Most small networks grow like this: one default container, fifty user accounts dumped in together, and permissions given person by person until nobody knows who can open what. The fix is not a new tool - it is structure, decided before you create a single account. Below is the same order used in the video: plan the OU tree, create the OUs, create users inside them, then create security groups and hand out rights through the groups. Do it in this order and every later job - Group Policy, delegation, audits - becomes ten times easier.

Active Directory Users and Computers - a planned OU tree (example names)
office.local
📁 Delhi Office (OU) — Accounts · Sales · Computers · Groups
📁 Jaipur Office (OU) — Accounts · Sales · Computers · Groups
📁 New Computers (OU) — staging area for freshly joined machines
📁 Disabled Users (OU) — leavers kept here before deletion

An OU tree that mirrors the real office. Names above are examples - copy the pattern, not the names.

1

Plan the OU tree before creating anything

An OU is not just a folder. It is the unit you later use to apply Group Policy and to delegate small jobs like password resets. So design OUs around how the office is actually run:

  1. One top OU per site or branch - Delhi Office, Jaipur Office
  2. Inside each site, child OUs by department or function - Accounts, Sales
  3. Separate OUs for Users, Computers and Groups inside each site - policies for people and machines are different
  4. Two utility OUs at the top: New Computers (staging) and Disabled Users (leavers)

Honest rule: if an OU does not change a policy or a delegation decision, it is decoration. Keep the tree shallow - three levels is plenty for most offices.

2

Create the OUs in Active Directory Users and Computers

Open dsa.msc on the domain controller, right-click the domain, choose New → Organizational Unit, and build the tree from your plan. PowerShell does the same job and is easier to repeat:

  1. New-ADOrganizationalUnit -Name "Delhi Office" -Path "DC=office,DC=local"
  2. New-ADOrganizationalUnit -Name "Accounts" -Path "OU=Delhi Office,DC=office,DC=local"
  3. Tick Protect container from accidental deletion (PowerShell does this by default) - more on this in the last section

Replace office.local with your own domain name everywhere in this guide. The structure matters, the example names do not.

3

Create users inside the right OU, with a naming rule

Right-click the department OU → New → User. Two decisions here decide how clean your directory stays:

  1. One naming rule for logon names - for example firstname.lastname - decided once and never broken, even for similar names
  2. Tick User must change password at next logon so the password you set is only a one-time starter password
  3. Fill in department and description now - future you will thank present you during every audit

The same account from PowerShell: New-ADUser -Name "Rahul Sharma" -SamAccountName "rahul.sharma" -UserPrincipalName "[email protected]" -Path "OU=Accounts,OU=Delhi Office,DC=office,DC=local" -Enabled $true -ChangePasswordAtLogon $true

4

Create security groups and give rights to groups, never to people

Groups are how permissions stay manageable. Create one security group per resource - for example GRP-Accounts-Share for the accounts file share - then add users to the group, and give the share permission to the group only.

  1. New-ADGroup -Name "GRP-Accounts-Share" -GroupScope Global -GroupCategory Security -Path "OU=Groups,OU=Delhi Office,DC=office,DC=local"
  2. Add-ADGroupMember -Identity "GRP-Accounts-Share" -Members "rahul.sharma"
  3. When Rahul changes department, you move his group membership - the share itself is never touched again

Honest warning: the day you give a folder permission to one person directly, you have started the mess this guide exists to prevent.

5

Protect what you built and verify it

Finish with two habits that separate a maintained directory from a lucky one:

  1. Confirm every OU has Protected from accidental deletion on - right-click the OU → Properties → Object tab
  2. Verify with one command: Get-ADUser -Filter * -SearchBase "OU=Delhi Office,DC=office,DC=local" - the list should show users only in their planned OUs
  3. Write down your naming rule and OU plan in one page and keep it with the server documentation

That is the whole foundation: a shallow OU tree that mirrors the office, users created under a naming rule, and every permission flowing through a group.

🔴 The one rule that keeps AD clean: permissions go to groups, people go into groups. The moment a share, printer or policy points at a single person, your directory starts rotting - and nobody notices until that person leaves.

🎥 Watch the Complete Video

The full OU, user and group creation process - live on a real domain controller, step by step.

▶️ Watch Full Video
❓ Common Questions (FAQ)

What is the difference between an OU and a container like Users?

Containers such as Users and Computers are built-in and cannot take Group Policy or delegation. OUs are the objects you create yourself, and they are the ones policies link to and rights are delegated on. That is why new objects are always moved out of the default containers into your own OUs.

Should OUs be made by department or by location?

By whichever one changes policy or support responsibility. Most small companies need location first (each branch has its own support person), then department inside each branch. If one admin manages everything and policy differs by team, department-first is equally valid - pick one logic and stay consistent.

How deep should the OU tree be?

Shallow. Two to three levels cover almost every office: site, then department, then the Users and Computers split. Deep trees make policy inheritance hard to predict and slow down every future admin who has to understand your layout.

This guide is based on the Technical Anshu video on Active Directory OU, user and group creation • Stuck on a step? Ask in the video comments - you will get a reply 🙏