After designing the upper layers of the NDS tree for an efficient partitioning strategy, you can add workgroup containers and leaf objects to the lower layers.
Create workgroup Organizational Units for sets of users that generally have common resource requirements, such as printers, file systems, and applications. If workgroups tend to have hundreds of User objects and more than one network administrator, you can subdivide workgroups around management responsibilities.
Planning an Organizational Unit for each workgroup lets you make a common trustee assignment and login script for the User objects in that workgroup. It also simplifies naming in the common context.
Exceptions to general workgroup boundaries are not hard to manage. If two workgroups use a common printer, for instance, you can create an Alias to the printer in one of the workgroups. You can create Group objects to manage some User objects within a workgroup or User objects across multiple workgroups. You can create Profile objects for subsets of users with unique login script requirements.