Placing leaf objects in the Directory tree

Container objects and their contents should be defined by workgroups, shared resources, and information usage. Therefore, leaf objects representing resources used by a single group should be placed in the same container.

Keep the following considerations in mind when placing leaf objects in the Directory tree:

• Design your Directory tree so that users have shared access to resources.

  For example, if you have a high-speed printer in the organization that everyone needs access to, place the Printer object for that printer in a container where you can assign rights to allow everyone access to that Printer object.

• You can always add, delete, or move leaf objects after you have installed your Directory tree.

• Create User objects only in the container object where they will typically log in. It is undesirable to create duplicate User objects for the same person.

  Plan to use User Templates in specific Organization and Organizational Unit objects.

  Also, plan to use Alias objects as necessary. Alias objects refer to an object that exists elsewhere in the tree without actually duplicating the object. Updates to an original object are immediately available to all Alias objects that reference it.

• Rights should be granted by exception. That is, you should grant rights at the container level, then at the group level, and then on an individual object level if necessary.

  For more information on container rights, see ``Developing a security strategy for the Directory tree''.