Designing OU/GPO structure

I'm investigating setting up the OU structure on our migration to Win2K3
server and am having some problems sorting out what is possible, or even
desirable.

Simple version of our setup:

1 Domain with 3 Sites.

3 types of computer: Server, Workstation and Laptop.

5 User Types: IT, Finance, Engineers, Reception, Admin.

There's no real difference (at them moment) between sites in terms of
access/usage.

All 5 User types can use either the Laptops or the Workstations. Laptops
need to be more secure than Workstations so that they are safe if lost.
Workstations access is controlled largely by the access to the office.

Servers are restricted to IT Users.

As I see it I want to have separate OUs for the Computers and Users, with
differing, but overlapping GPOs for each. However this is where I get
stuck...

Any suggestions

 

I think it will be better to design your GPOs first in order to set OUs.
Start with settings that will affect all domain users or workstation and
narrow it to specific machines or users this will be easier to design your
OU,GPO structure.

Thanks

Serkan Varoglu