Microsoft Active Directory security concerns

[DHegenbarth () wrberkley com]

All,

I have spent most of my time in network security and IDS/IPS technology so 
I'm fairly new to security pertaining to MS Active Directory.  We are 
being asked to evaluate web portal authentication/authorization for users, 
most of whom are not employees of our company.  Our NT group wants to add 
/ maintain users in an "external OU", in an existing domain, under our 
existing AD forest.  I think this is a bad idea but I am not versed enough 
in AD to argue the point.  Are there glaring issues with this strategy? My 
concern is that if someone were to gain access to AD they might not only 
effect external applications but internal production as well.

Are "external OU's" that secure?  Are there more secure authentication 
schemes?


Any thoughts would be greatly appreciated.



Dave