Why are Server OUs outside Tier Model Administration OU

[KurtDeGreeff]

Maybe stupid question but I wonder why Member Server OUs are created at Domain root level and not under respective Tier 0/1/2 OUs by default?

[VAsHachiRoku]

There have been a mixture of different Tier Model structures depending on which vendor created it and depending on which Microsoft business unit was contracted to deploy the Tier Model. Bit of a history lesson and even today some of this is still true.

• OU = CLAW - This is the typical structure deployed by Microsoft Incident Response team (MS IR aka DART).
• OU = POP-SLAM - This is another structure found when PFE and CSU deploy a flavor of the Tier Model.
• OU = Admin \ Tier 0 \ Tier 0 Servers - This has been the traditional place for Tier 0 Servers when delivered by MCS.
• OU = Tier 1 Servers - This has been the traditional Tier 1 Member Servers at the root placement.
• OU = Red Forest (ESAE) - Had its own structure for a long time but was moved into the Traditional root Admin structure around 2022 before being retired.
• Other Vendors do their own thing too.

The most confusing were Tier 0 Servers under the Admin OU and Tier 1 Servers at the Root of the Domain which is the most sold and deployed closer source version of the Tier Model by Microsoft.

Now with the history lessons over there are a few reasons for this. One of the goals was to align where the T# Member Server OU's are so everyone can find them. This was achieved by moving Tier 0 Servers out from under the Admin OU to the root. Now if I ask anyone to name all their Tier Model OUs they can open ADUC and see all of them together. If I ask where a Tier 0 Member Server should be placed they can quickly find it without having to navigate down multiple OUs.

This also reduces SIEM monitoring code and KQL without having to have very complex DN structure to find Tier 0 Member Server nested deep in other OU hierarchies.

Long story short historically they are all over the place depending on when and where you got the closed source Tier Model. The new structure is just a choice to align them, reformat the names, and keep the Tier Model Administration OU focused on the Administration objects of the Tier Model and place the servers in a different area. Once you start migrating applications into the Tier Model the Tier # Member Server will get many Child OUs, once again trying to avoid nesting to far down.

If you are using the Admin OU structure today then you’ll find Tier 0 Servers under Tier 0, and Tier 1 Member servers will be at the root. If you like you are current Tier Model keep it and enjoy still works. The open-source model is the only one that will get updates and improvements such as Auth Silos are coming very soon!