At the lowest level, some objects represent individual entities on your network such as a user or computer. These are called leaf objects and cannot contain other objects. However, to provide ease of management and simplified organization of the directory, you can place leaf objects inside of other objects called container objects. You can use an OU to categorize objects with a domain into some type of logical administrative grouping. It is important to note that an OU's structure and hierarchy within a domain is independent of the structure of any other domain.
All network objects, whether leaf or container, can only exist within a domain.
You use domains to group related objects together to reflect your organization's network. Each domain you create only stores information about the objects it contains and no others. Currently, the supported limit on the number of objects you can maintain in a domain is one million. Each domain represents a security boundary. These security settings do not cross from one domain boundary to another.