Another way that Active Directory improves scalability in large organisations is through the use of organisational units (OUs). An OU is basically a collection of users and computers. The idea is that if you have a large domain, you can organise the domain into OUs. For example, suppose that your client's company used one large domain that spanned the entire corporation. Normally, this would mean that the administrative team would be responsible for managing the entire domain and all of the objects within it. Now imagine that your client's company has a really large finance department and that the finance department's secretary is good with computers. You could create an OU named FINANCE and move all of the user accounts and computer objects for the finance department into this OU. After doing so, you could delegate the authority to reset passwords for this OU to the finance secretary. When someone in finance needed a password reset, they wouldn't have to contact the help desk; they could just ask the secretary. This would give the department faster turnaround on password resets and free the help desk from some of the administrative burden. When you delegate authority to an OU, the person that you're delegating control to only has the permissions that you allow and only for that OU. Therefore, the secretary in finance wouldn't be able to reset passwords for the rest of the company. The secretary also would not be able to perform any other administrative tasks within the OU, unless, of course, you delegated additional permissions. If you like the idea of delegating authority, you'll be happy to know that you can also delegate authority to create, delete, or manage user accounts or groups within the OU. Multimaster replication and sites
Another cool benefit of an Active Directory environment is the concept of sites and multimaster replication. In Windows NT, when you make a change to the SAM, the change is applied directly to the PDC and is later replicated to each BDC. In an Active Directory multimaster replication environment, each domain controller contains a copy of Active Directory, not just the information for a single domain. Therefore, when a change is made to Active Directory, the change is applied to whatever domain controller is the closest, and is then replicated to the remaining domain controllers. This prevents a designated PDC from being overburdened. You can really see the benefits of multimaster replication when you consider how sites work. Sites are a logical Active Directory structure completely independent from domains. The idea is that if part of a domain is connected by a slow link, you may designate each side of the link as a separate site. Each site has its own domain controller. Therefore, when someone within a site needs to make an Active Directory update, the updates are applied to the domain controller within the site. The changes are collected and then replicated to the domain controller on the other side of the site link at preset intervals. This domain controller is known as a bridgehead server. It's the bridgehead server's job to intercept the updates and replicate them to the remaining domain controllers. Sites can be a little complicated to understand, but the basic idea is that they greatly decrease the amount of traffic that must flow across your slow or high-cost network links.
