Create Managed Units and link Access Templates to Managed Unit by script or PowerShell

Question

Hello, 
 I have a very large client with a very flat AD structure, would it be possible to script the creation of Managed Units and link Access templates to the Managed Units? 
 
 Also is there any recommendations about the number of managed units to have? 
 Due to the flat AD structure and 200,000+ users and groups we need a method to create around 5000+ managed units one for each site.

Aidar.Karabalaev · Answer

200K+ users in flat AD OU tree. Makes sense and today is a valid scenario. 
 #1. ARS is designed to *virtualize* AD Management Workflow: 
 
 segregate ad objects/users in virtual OUs &lsquo;MU&rsquo; based on any LDAP query 
 apply management workflow (virtual granular permissions (Roles) and Policies/scripts) 
 Virtual Attribute (VA) feature helps to *virtualize* AD schema extension to mark and segregate AD users (say VA_LineOfBusiness) and create MU=LDAP query(VA_LineOfBusiness = &ldquo;Finance&rdquo;) without direct impact/update native AD attributes. 
 
 Change Control. That makes major reason for ARS to exist: to be able to land *virtually* on any &ldquo;rocky&rdquo; ground and &ldquo;flatten&rdquo; it up for AD management workflow to &ldquo;skate&rdquo; on it without changing OU structure, ACL OUs and other Change Controls against AD. Instead, all Change Controls are evoked on *virtual* AD management layer which helps to leverage risks both &lsquo;technical&rsquo; and &lsquo;political&rsquo; nature in timely manner and provides room to &ldquo;breath&rdquo; for &ldquo;smooth transition&rdquo; to a better, healthy and transparent AD state. 
 #2. To create 5K+ MUs, group 200K+ users in MUs, assign workflow to MUs (permissions and policies) &ndash; for such a large project you will probably need to involve PSO to discuss the smooth transition &lsquo;strategy&rsquo; and script it &lsquo;technically&rsquo;. 
 Risk. If the input AD data is &lsquo;garbage&rsquo;: you will get &lsquo;garbage&rsquo; MUs and workflow &lsquo;out&rsquo;. That is the major reason for PSO to discuss and design in &ldquo;ARS language&rdquo; the transition to &lsquo;straighten and transparent&rsquo; up your big AD via &ldquo;ARS path&rdquo;. 
 Here HR comes into play: most probably, you will need to have HR data to be synced to AD via ARS/AD Management Workflow. ARS Sync Service allows to sync \SHARE\HR.CSV dump into AD users.

Endpoint Privilege Management

Create Managed Units and link Access Templates to Managed Unit by script or PowerShell