search for: aa374928

...is allowing 'Domain Computers' access to "CN=demo01,CN=Users,DC=samdom,DC=example,DC=com", the container will inherit ACES and 'Domain Computers' can read the sddls, list children and read control. :-) See here: https://msdn.microsoft.com/en-gb/library/windows/desktop/aa374928%28v=vs.85%29.aspx and here: https://msdn.microsoft.com/en-gb/library/windows/desktop/aa379602%28v=vs.85%29.aspx

I need to create a couple of OUs under Users to separate my internal users from my external users that have LDAP backed accounts so I can put ACLs over the external users so I can limit what they can see on the tree. What options do I have to create the OUs and the ACLs in a Samba4 AD-DC domain?