You can take several approaches when planning how to register your LDAP servers. Taking the time in advance to plan your server registration strategy helps you get it right the first time and reduce problems with user authentication.
Ideally, authentication and authorization is a process you do once, and only change if your overall network topology changes. Once servers are registered and Windows authentication is configured, you do not have to modify these settings often.
User account network topology
The effort required to fully configure Windows authentication and authorization depends on your network topology, and the distribution of user accounts across your network.
If the credentials for users are contained in a small set of domains or servers in a single domain tree, register the root of the tree.
If your user accounts are more spread out, register a number of servers or domains. Determine the minimum number of domain (or server) subtrees you need and register the roots of those trees. Try to register them in the order of usage. Placing the most commonly used domains at the top of the list improves average authentication performance.
Permission structure
For users to be able to log on to a ePO - On-prem server using Windows authentication, attach a permission set to the Active Directory group on the domain their account belongs to. When determining how permission sets are assigned, consider the following capabilities:
Permission sets can be assigned to multiple Active Directory groups.
Permission sets can be dynamically assigned only to an entire Active Directory group. They cannot be assigned to just some users in a group.
If you want to assign special permissions to an individual user, you can do so by creating an Active Directory group that contains only that user.