organizationalUnit

An organizational unit (OU) is a container used to organize and manage resources in directory services. It serves as a logical grouping for users, groups, computers, printers, and other objects within a directory. OUs exist in LDAP-compatible directories, such as OpenLDAP and Microsoft Active Directory, and are the primary means to reflect an organization's administrative structure within the directory tree.

In LDAP, an organizational unit is a structural object class (organizationalUnit). An OU can contain other entries and other OUs, and is identified by a distinguished name ending in ou=SubUnit,dc=example,dc=com. The OU is not a security boundary; permissions are typically inherited from higher levels.

In Active Directory, OUs are containers that support delegation of administration and are targets for Group Policy Objects (GPOs). They can be nested to reflect departments, locations, or roles; GPOs linked to OUs apply policies to all objects within.

Design considerations include using OUs to reflect administrative or policy boundaries, avoiding excessive nesting, planning for delegation and replication scope, and using security groups and GPOs for access control and policy assignment.

See also: Distinguished name, LDAP, Active Directory, Group Policy, Container.