LDAP connections

VMware recommends making Lab Manager LDAP connections at the root of Active Directory (ie. DC=domain,DC=com). The reason for this is that if specifying an explicit OU in the binding string may later end up blocking access to users or groups outside of that OU and a binding string change will be required which could be disruptive to the existing Lab Manager environment.
More vQuotes