[Samba] Best practice OU and policy structure.

[L.P.H. van Belle]

> The problem with using OU's, is that a user can only be in one OU, so 
> what if the user needs to be in more than one ?
> 
> I would rely on group membership instead.
> 

Yes, but this is really just a thing to thing about and howto layer you GPO's. 

And as Rowland said use groups whereever you can. 
It does make things way better to maintain. 

Read these before you "just" deploy things..
https://social.technet.microsoft.com/wiki/contents/articles/52587.active-directory-design-considerations-and-best-practices.aspx

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/ad-ds-design-and-planning 

 
Greetz, 

Louis