{"id":13374,"date":"2019-11-26T14:46:23","date_gmt":"2019-11-26T13:46:23","guid":{"rendered":"https:\/\/staging.dynamicgroup.net\/?page_id=13374"},"modified":"2023-03-08T14:33:32","modified_gmt":"2023-03-08T13:33:32","slug":"ou-filter","status":"publish","type":"page","link":"https:\/\/www.dynamicgroup.net\/en\/ou-filter\/","title":{"rendered":"OU filter configuration for dynamic AD groups"},"content":{"rendered":"
[vc_row top_margin=”0″ bottom_margin=”0″][vc_column][vc_column_text el_class=”FA-alignleft”]\n

OU Filter configuration<\/h1>\n

 <\/p>\n

With DynamicGroup you can define OU filters for self-updating AD groups<\/strong>.<\/p>\n

Thus, only very specific OUs are searched<\/strong> for users and included in a dynamic group.
\nA group with a defined OU filter goes beyond simple OU groups<\/a> and OU-related site groups<\/a>.<\/p>\n

With OU filters, we want to manage permissions through specific sub-OUs<\/strong>.<\/p>\n

 <\/p>\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row css=”.vc_custom_1574845217789{margin-top: -45px !important;}”][vc_column el_class=”FA-alignright”][vc_column_text]\n

Creation of dynamic OU groups with DynamicGroup<\/h2>\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column width=”1\/2″ el_class=”FA-alignleft”][vc_column_text el_class=”FA-alignleft force”]\n

Organising groups in AD can be easy: DynamicGroup and the OU filters let you quickly create dynamic groups<\/strong> based on specific OUs.
\nThe advantage of dynamic groups is that they are updated automatically.<\/p>\n

Whether in a dynamic OU group or directly in an OU group, changes are updated automatically.<\/p>\n

Let us clarify the functionality of the OU filter in two examples, based on the following OU structure (picture on the right):<\/p>\n[\/vc_column_text][\/vc_column][vc_column width=”1\/2″][vc_column_text]\n

\"OU<\/p>\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column el_class=”FA-alignright”][vc_column_text]\n

The green arrow shows the sub OUs <\/strong><\/span>for which we want to create a dynamic group.<\/p>\n

Create a new dynamic group via the DynamicGroup console and also select
\n“Use Filter for OUs” under “Query Settings” to display the required tab.<\/p>\n

 <\/p>\n

\"Use<\/p>\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column el_class=”FA-alignright”][vc_column_text]\n

AD groups with users from specific OUs<\/h2>\n

The following examples are about adding users from specific OUs<\/strong> to a dynamic group.<\/p>\n

For some basic information, see the page\/article OU Groups<\/a> and Site permissions<\/a> in AD.<\/p>\n

Examples<\/h3>\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column width=”1\/2″ el_class=”FA-alignright”][vc_column_text]\n
\n

Example 1<\/p>\n

Include users from specific OUs<\/strong> (IT, Accounting) in a dynamic group.<\/div><\/div>\n[\/vc_column_text][\/vc_column][vc_column width=”1\/2″][vc_column_text]\n

\n

Example 2<\/p>\n

Include users from similar OUs<\/strong> (users) within a location in a dynamic group.<\/p>\n<\/div><\/div>\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column el_class=”FA-alignright”][vc_column_text]\n

What are the possibilities with Windows standard tools?<\/h3>\n

With the Active Directory Users and Computers Console (ADUC) it is not possible to authorize OUs or to create OU groups<\/strong>.
\nIt is only possible to manually go through all sub-OUs and add all users (step by step) to a group.
\nHowever, the generated group will not be updated automatically.<\/p>\n

Fortunately, there is a much faster method.<\/p>\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row fullwidth=”yes” background_color=”#eff5ff”][vc_column el_class=”FA-alignright”][vc_column_text]\n

OU filter for dynamic group with users from specific OUs (example 1)<\/h2>\n

This example shows how to include users from specific OUs<\/strong> (IT, Accounting) in a dynamic group.
\nUnder the tab “OU Filter” you need to carry out the following settings:<\/p>\n

 <\/p>\n

\"Add<\/p>\n

 <\/p>\n

In the blue-marked area<\/span><\/strong>, you can choose whether to include sub structures or only objects that are directly in the filtered OU.
\nIn our example, objects from sub structures are also included in the dynamic group.<\/p>\n

 <\/p>\n

 <\/p>\n

\"OU<\/p>\n

 <\/p>\n

In the red-marked area<\/strong><\/span>, we determine the Search root<\/span>, thus the OU from which objects are selected. In this example, this is the site OU.<\/p>\n

 <\/p>\n

In the green-marked area<\/strong><\/span> is the actual filter<\/span>. In this simple example, we only filter that the attribute “ou” has the value “IT<\/strong>” or “Accounting<\/strong>“.
\nThis will select all OUs below the search root corresponding to this filter in this OU filter.<\/p>\n

You can look at the result of the OU filter in the preview. The OUs “demofa.net\/Corp\/US\/Accounting” and “demofa.net\/Corp\/US\/IT” are found here.<\/p>\n

 <\/p>\n

Depending on whether you only want to include users in the dynamic group or other objects, you must also make restrictions under the “Member Query” tab. In our example, we restricted the members of the dynamic group to user objects<\/strong>. In this tab you can no longer select Search Root because the OUs (Search Roots) are used by the OU filter.<\/p>\n

 <\/p>\n

\"Member<\/p>\n

 <\/p>\n

Once we have created the dynamic group, we no longer need to make any customizations to users, as the dynamic group will now do it for you.<\/p>\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column el_class=”FA-alignright”][vc_column_text]\n

OU filter for dynamic group with users from similar OUs (example 2)<\/h2>\n

This example explain how to include users from specific OUs (Users) within a site in a dynamic group.<\/p>\n

 <\/p>\n

\"OU<\/p>\n

 <\/p>\n

Under the tab “OU Filter” you must now carry out the following settings:<\/p>\n

\"OU<\/p>\n

 <\/p>\n

In the gren-marked area<\/span><\/strong>\u00a0is our OU filter, which filters out all OUs with the name “Users”<\/span><\/strong>. To obtain this result, you have to set “ou is equal Users” in the Query Builder. The result of the preview shows that four OUs with the name “Users” were found in the Search root “US”<\/span>. Here too, the Member Query tab can be set according to its requirements.<\/p>\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row fullwidth=”yes” background_color=”#eff5ff” css=”.vc_custom_1678282206131{margin-bottom: -60px !important;}”][vc_column][vc_column_text]\n

Conclusion<\/h2>\n

Sites or departments are often mapped via OU structures in Active Directory.
\nYou can use this with DynamicGroup<\/a> to your advantage.
\nSimply create dynamic groups with OU filtering.<\/p>\n

 <\/p>\n

The Smart Creation Wizard<\/strong> is available for the intelligent mass creation of groups.
\nAttribute-based groups<\/strong> (ex: for locations) are created in the same way as dynamic department groups<\/a>.<\/p>\n

 <\/p>\n