computing Computing is any goal-oriented activity requiring, benefiting from, or creating computing machinery. It includes the study and experimentation of algorithmic processes, and development of both hardware and software. Computing has scientific, ...

, an organizational unit (OU) provides a way of classifying objects located in

directories Directory may refer to: * Directory (computing), or folder, a file system structure in which to store computer files * Directory (OpenVMS command) * Directory service, a software application for organizing information about a computer network's ...

, or names in a

digital certificate In cryptography, a public key certificate, also known as a digital certificate or identity certificate, is an electronic document used to prove the validity of a public key. The certificate includes information about the key, information about the ...

hierarchy, typically used either to differentiate between objects with the same name (John Doe in OU "marketing" versus John Doe in OU "customer service"), or to parcel out authority to create and manage objects (for example: to give rights for user-creation to local technicians instead of having to manage all accounts from a single central group). Organizational units most commonly appear in X.500 directories,

X.509 In cryptography, X.509 is an International Telecommunication Union (ITU) standard defining the format of public key certificates. X.509 certificates are used in many Internet protocols, including TLS/SSL, which is the basis for HTTPS, the secu ...

certificates,

Lightweight Directory Access Protocol The Lightweight Directory Access Protocol (LDAP ) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. Directory ser ...

(LDAP) directories,

Active Directory Active Directory (AD) is a directory service developed by Microsoft for Windows domain networks. It is included in most Windows Server operating systems as a set of Process (computing), processes and Windows service, services. Initially, Active D ...

(AD), and

Lotus Notes HCL Notes (formerly IBM Notes and Lotus Notes; see Branding below) and HCL Domino (formerly IBM Domino and Lotus Domino) are the client and server Server may refer to: Computing *Server (computing), a computer program or a device that provide ...

directories and certificate trees, but they may feature in almost any modern directory or digital certificate

container A container is any receptacle or enclosure for holding a product used in storage, packaging, and transportation, including shipping. Things kept inside of a container are protected on several sides by being inside of its structure. The term ...

grouping system. In most systems, organizational units appear within a top-level organization grouping or organization certificate, called a domain. In many systems one OU can also exist within another OU. When OUs are nested, as one OU contains another OU, this creates a relationship where the contained OU is called the child and the container is called the parent. Thus, OUs are used to create a hierarchy of containers within a domain. Only OUs within the same domain can have relationships. OUs of the same name in different domains are independent.

Specific uses

The name ''organizational unit'' appears to represent a single organization with multiple units (departments) within that organization. However, OUs do not always follow this model. They might represent geographical regions, job-functions, associations with other (external) groups, or the technology used in relation to the objects. Examples would include: * Department (e.g. human resources) within a corporation * Division (e.g. LifeScan, Inc.) that is owned by but separate from a parent corporation ( Johnson & Johnson), although this would commonly be placed in a separate domain * Association (e.g. contractors) that is external to the organization. * To identify geographically distinct regions (e.g. Kansas City) the X.521 standard recommends a "locality" entry instead. * Job types or functions (e.g. managers, storage servers) that runs across all divisions of a company should be represented by an "organizational role" entry.

Sun Enterprise Directory Server and Active Directory

In Sun Java System Directory Server and

Microsoft Microsoft Corporation is an American multinational technology corporation producing computer software, consumer electronics, personal computers, and related services headquartered at the Microsoft Redmond campus located in Redmond, Washin ...

(AD), an organizational unit (OU) can contain any other unit, including other OUs, users, groups, and computers. Organizational units in separate domains may have identical names but are independent of each other. OUs let an administrator group computers and users so as to apply a common policy to them. Organizational Units give a hierarchical structure, and when properly designed can ease administration.

Origins with X.500, Novell, and Lotus software

Novell and Lotus supplied the two largest software directory systems. Each of these companies started with flat account and directory structures, and encountered the support and name-conflict limitations inherent in their flat structures. They adopted the X.500 OU concept into their next-generation software around 1993 – Novell with the release of

Novell Directory Services eDirectory is an X.500-compatible directory service software product from NetIQ. Previously owned by Novell, the product has also been known as Novell Directory Services (NDS) and sometimes referred to as ''NetWare Directory Services''. NDS was in ...

(subsequently known as eDirectory), and Lotus with the release of the third version of Lotus Notes. Microsoft allegedly used Novell's directory as a blueprint for the first released versions of AD, but this claim appears suspect, given that X.500 served as the "granddaddy" of all directory systems.

References

{{reflist Computer networking Identity management