Questions[organizational-unit](server)

So they are both objects that you use to organise other objects. You can add users, groups and computers to both of them.

1. What is the difference between them?
2. What is the best way to divide users and computers of different departments in a company (OU or Groups)?

I'm adding this Q/A because I just stumbled upon this limitation today, and I was not able to find any documentation about it; there is an old KB article about this issue, but it's currently not indexed by Google (probably because it was published years ago and never updated), and the issue is never mentioned elsewhere.

Is it possible to create a OU in the parent domain with the same name as a child domain?
Is it possible to create a child domain with the same name as a OU in the parent domain?

I have an OU structure for computers that looks like this:

Workstations
  |--  Building
  |    |--  Floor, Department, or Approximate Location
...

I want to create a child OU called "3 North" in that building's OU, but I am getting the following error:

Windows cannot create the object 3 North because:
An attempt was made to add an object to the directory with a name that is already in use.

First of all, the OU name shouldn't matter; you can have multiple containers with the same name in AD as long they appear in different parts of the tree, but secondly, the only other "3 North" that exists is an email distribution list in an entirely different container.

Why is this error happening, and how can I get around it?

If there is a GPO which is applied to all Domain Computers which disables something, is there a way to re-enable the disabled thing for some hosts in the domain, without taking those hosts out of the default Domain Computers group?

In other words, can another GPO, which re-enables the feature that was disabled, be applied to a subset OU, whose member computers are still members of Domain Computers? If so, where exactly in the domain hierarchy should that OU be made, and how should the two GPOs be applied?

The following scenario is weird. Please be advised.

I have created a GPO on an OU containing workstations like this:

This GPO purpose is to make the Backup Operators group a member of the local Administrators group on all the workstations inside the OU.

Here is the content of this GPO:

Then when I check if the GPO is applied using gpresult on a workstation inside the Organisational Unit (OU) on which the GPO is applied, I can see that it is correctly applied on that workstation:

But when I go check in the local group on the workstation, in the local Administrators group, I should see the Backup Operators group inside it, but no:

Even after a gpupdate /force followed by a reboot, I end up with the same result.

Have I done something wrong?

EDIT:

This is what I get in the Event Viewer after I do a gpudpate /force:

Security policies were propagated with warning. 0x4b8 : An extended 
error has occurred.

For best results in resolving this event, log on with a 
non-administrative account and search http://support.microsoft.com 
for "Troubleshooting Event 1202's".