<Tr> <Td> </Td> <Td> </Td> <Td> </Td> <Td> Ralph </Td> </Tr> <Tr> <Td_colspan="2"> Example of the geographical organizing of zones of interest within trees and domains . </Td> </Tr> <P> The objects held within a domain can be grouped into Organizational Units (OUs). OUs can provide hierarchy to a domain, ease its administration, and can resemble the organization's structure in managerial or geographical terms . OUs can contain other OUs--domains are containers in this sense . Microsoft recommends using OUs rather than domains for structure and to simplify the implementation of policies and administration . The OU is the recommended level at which to apply group policies, which are Active Directory objects formally named Group Policy Objects (GPOs), although policies can also be applied to domains or sites (see below). The OU is the level at which administrative powers are commonly delegated, but delegation can be performed on individual objects or attributes as well . </P> <P> Organizational units do not each have a separate namespace; e.g. user accounts with an identical username (sAMAccountName) in separate OUs within a domain are not allowed, such as "fred. staff - ou. domain" and "fred. student - ou. domain", where "staff - ou" and "student - ou" are the OUs . This is because sAMAccountName, a user object attribute, must be unique within the domain . However, two users in different OUs can have the same Common Name (CN), the name under which they are stored in the directory itself . </P>

4. what is an ou in active directory