Considerations When Joining Multiple FSx for Windows File Server File Systems to the Same AD, and OU Naming Conventions

Issue

We plan to deploy Amazon FSx for Windows File Server in a self-managed Active Directory environment.
We would like to confirm the following points.

1. Is it possible to join multiple FSx for Windows File Server file systems to the same Active Directory?
2. If we separate the OU that FSx joins, is it acceptable for the AD administrator to name the OU arbitrarily?

Answer

Can multiple FSx file systems join the same AD?

Yes, you can join multiple Amazon FSx for Windows File Server file systems to the same Active Directory. This is supported not only with AWS Managed Microsoft AD but also with self-managed Active Directory.
Each FSx file system creates its own independent computer object in Active Directory and operates as an independent management unit. Therefore, operations or configuration changes on one FSx file system do not affect other FSx file systems.
In addition, the operations that FSx performs against Active Directory are executed within the scope of the delegated permissions. By separating OUs appropriately and delegating only the minimum necessary permissions, other OUs that were not specified at the time of joining will not be affected.

Notes

When setting up multiple file systems, please keep the following points in mind.

• Because each FSx file system creates and manages one computer object in Active Directory, please confirm that the necessary permissions (delegation of control) are configured on the OU you specify in advance.
• Active Directory has a default limit on the number of computer objects that a regular user can create (ms-DS-MachineAccountQuota, default value: 10). However, if the permission to create computer objects has been explicitly delegated to the target OU, objects can be created without depending on this default limit.
• Because your existing FSx environment assumes delegation of control on the OU (explicitly granting permission to create computer objects), you do not need to be concerned about the default quota as long as you continue your current operations. However, if you change the service account or delegation settings you use in the future, we recommend checking the impact of this quota again.

Naming rules for OU names

Amazon FSx for Windows File Server does not define any AWS-specific naming rules for the name of the OU to be joined. Therefore, you may name the OU arbitrarily in accordance with your Active Directory operating policy.
However, you must follow the general naming rules of Active Directory. According to the Microsoft documentation (reference [1]), they are as follows.

• Characters allowed: All characters are allowed, and extended characters can also be used. However, a short, manageable name that describes the purpose of the OU is recommended
• Name length: minimum 1 character / maximum 64 characters

References

[1]Naming conventions for computers, domains, sites, and OUs - Windows Server | Microsoft Learn

Characters allowed: All characters are allowed, and extended characters can also be used. However, although Active Directory Users and Computers allows you to name OUs using extended characters, it is recommended that you use a short, manageable name that describes the purpose of the OU. In the Lightweight Directory Access Protocol (LDAP), there is no restriction because the CN of an object is enclosed in quotation marks.
Characters not allowed: Characters are not allowed.
Name length rules:
Minimum name length: 1 character
Maximum name length: 64 characters

[2]Using self-managed Microsoft Active Directory - Amazon FSx for Windows File Server