samba - Nov 2015 - Cannot create OrganizationalUnit under ou=Users

Am 03.11.2015 um 16:43 schrieb James:
> Not possible. It's a container and not a OU.
Right.


However Roel, you can create an OU for your users/computers and redirect
the standard to them:
https://support.microsoft.com/en-us/kb/324949

Then you can have sub-OUs, link GPOs to them, etc. and ignore
cn=Users/cn=Computer.


Regards,
Marc

Marc Muehlfeld writes:
> > Not possible. It's a container and not a OU.
>
> Right.
Ok, I understand.
> However Roel, you can create an OU for your users/computers and redirect
> the standard to them:
> https://support.microsoft.com/en-us/kb/324949
>
> Then you can have sub-OUs, link GPOs to them, etc. and ignore
> cn=Users/cn=Computer.
I see, thank you for this!

Would there be a performance penalty if I changed the search base for users  
from the CN=Users container to the domain DN in my applications?

Thanks,

Roel

On Wed, 2015-11-04 at 07:15 +0100, Roel van Meer wrote:
> Marc Muehlfeld writes:
> 
> > > Not possible. It's a container and not a OU.
> > 
> > Right.
> 
> Ok, I understand.
> 
> > However Roel, you can create an OU for your users/computers and
> > redirect
> > the standard to them:
> > https://support.microsoft.com/en-us/kb/324949
> > 
> > Then you can have sub-OUs, link GPOs to them, etc. and ignore
> > cn=Users/cn=Computer.
> 
> I see, thank you for this!
> 
> Would there be a performance penalty if I changed the search base for
> users  
> from the CN=Users container to the domain DN in my applications?
In Samba?  Essentially none.  Our database isn't tree-structured, so we
actually check the index over the whole domain, then filter down those
results by the tree.  

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba