diff --git a/README.md b/README.md
index 4dbd380..aaca60a 100644
--- a/README.md
+++ b/README.md
@@ -3,7 +3,7 @@
 The plugins that ship with [FOG Project](https://github.com/FOGProject/fogproject).
 One repository, one release, per-plugin versions in each manifest.
 
-This is the source of truth for the 15 bundled plugins. The FOG build pins a
+This is the source of truth for the 16 bundled plugins. The FOG build pins a
 revision of this repository and lays its contents into
 `packages/web/lib/plugins/` in the tarball.
 
@@ -87,6 +87,7 @@ the rest.
 | Plugin | Version | What it does |
 |---|---|---|
 | `capone` | 1.6.0 | Automation plugin — image a host straight from PXE without registering it |
+| `directorygroups` | 1.6.0 | Group hosts by Active Directory OU, across one or more domains |
 | `helloworld` | 1.6.0 | Skeleton example: config, model, manager, page, hooks, JS |
 | `ldap` | 1.6.0 | Authenticate FOG users against an LDAP or AD directory |
 | `location` | 1.6.0 | Serve images from the storage node nearest a host — multi-site installs |
diff --git a/directorygroups/config/plugin.config.php b/directorygroups/config/plugin.config.php
new file mode 100644
index 0000000..27bc6bd
--- /dev/null
+++ b/directorygroups/config/plugin.config.php
@@ -0,0 +1,32 @@
+<?php
+/**
+ * Plugin configuration file.
+ *
+ * PHP version 5
+ *
+ * @category Config
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+/**
+ * Plugin configuration file.
+ *
+ * @category Config
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+$fog_plugin = [];
+$fog_plugin['name'] = 'directorygroups';
+$fog_plugin['description'] = _(
+    'Directory Groups: group hosts by Active Directory OU, across one or '
+    . 'more domains.'
+);
+$fog_plugin['menuicon'] = 'fas fa-folder-tree fa-fw';
+$fog_plugin['version'] = '1.6.0';
+$fog_plugin['fog_min'] = '1.6.0';
+$fog_plugin['author'] = 'Tom Elliott';
+$fog_plugin['homepage'] = 'https://fogproject.org';
diff --git a/directorygroups/js/fog.directorydomain.add.js b/directorygroups/js/fog.directorydomain.add.js
new file mode 100644
index 0000000..fb42c8e
--- /dev/null
+++ b/directorygroups/js/fog.directorydomain.add.js
@@ -0,0 +1,3 @@
+(function($) {
+    $('#directorydomain-create-form').wireCreateForm();
+})(jQuery);
diff --git a/directorygroups/js/fog.directorydomain.edit.js b/directorygroups/js/fog.directorydomain.edit.js
new file mode 100644
index 0000000..10031eb
--- /dev/null
+++ b/directorygroups/js/fog.directorydomain.edit.js
@@ -0,0 +1,109 @@
+$(function() {
+    // ---------------------------------------------------------------
+    // GENERAL TAB
+    $.registerGeneralTab({
+        nameInputSel: '#name',
+        formSel: '#directorydomain-general-form'
+    });
+
+    // ---------------------------------------------------------------
+    // ORGANIZATIONAL UNITS TAB
+    //
+    // The whole tree, client side: listOUs() already read every page of it,
+    // so search and scroll need no further round trip. Indented by depth
+    // and kept in the server's root-first order, so it reads as a tree.
+    var table = $('#directorydomain-ous-table'),
+        sendBtn = $('#directorydomain-ous-send'),
+        loaded = false,
+        dt;
+
+    function load() {
+        if (loaded || !table.length) {
+            return;
+        }
+        loaded = true;
+        $.get(
+            '../management/index.php?node=directorydomain&sub=getOUs&id='
+                + table.data('domain-id'),
+            function(res) {
+                dt = table.DataTable({
+                    data: res.data,
+                    ordering: false,
+                    pageLength: 25,
+                    columns: [
+                        {data: 'dn'},
+                        {data: 'name'},
+                        {data: 'dn'},
+                        {data: 'groupID'}
+                    ],
+                    columnDefs: [
+                        {
+                            targets: 0,
+                            searchable: false,
+                            render: function(data, type, row) {
+                                if (row.groupID) {
+                                    return '';
+                                }
+                                return '<input type="checkbox" class="ou-pick" value="'
+                                    + $.escapeHtml(data) + '"/>';
+                            }
+                        },
+                        {
+                            targets: 1,
+                            render: function(data, type, row) {
+                                if (type !== 'display') {
+                                    return data;
+                                }
+                                return '<span style="padding-left:' + (row.depth * 1.5)
+                                    + 'em"><i class="fas fa-folder"></i> '
+                                    + $.escapeHtml(data) + '</span>';
+                            }
+                        },
+                        {
+                            targets: 3,
+                            searchable: false,
+                            render: function(data) {
+                                if (!data) {
+                                    return '';
+                                }
+                                return '<a href="../management/index.php?node=directorygroups&sub=edit&id='
+                                    + data + '">' + $.escapeHtml(String(data)) + '</a>';
+                            }
+                        }
+                    ]
+                });
+            },
+            'json'
+        ).fail(function(jqXHR) {
+            loaded = false;
+            $.notifyFromAPI(jqXHR.responseJSON, jqXHR);
+        });
+    }
+
+    // Fetched when the tab is first shown, not with the page: a slow or
+    // unreachable directory must not hold up the General tab.
+    $('a[href="#directorydomain-ous"]').on('shown.bs.tab', load);
+    if (window.location.hash === '#directorydomain-ous') {
+        load();
+    }
+
+    sendBtn.on('click', function() {
+        if (!dt) {
+            return;
+        }
+        var ous = dt.$('input.ou-pick:checked').map(function() {
+            return this.value;
+        }).get();
+        sendBtn.prop('disabled', true);
+        $.apiCall('POST', table.data('update-url'), {ous: ous}, function(err) {
+            sendBtn.prop('disabled', false);
+            if (err) {
+                return;
+            }
+            dt.destroy();
+            table.find('tbody').remove();
+            loaded = false;
+            load();
+        });
+    });
+});
diff --git a/directorygroups/js/fog.directorydomain.export.js b/directorygroups/js/fog.directorydomain.export.js
new file mode 100644
index 0000000..5cba31e
--- /dev/null
+++ b/directorygroups/js/fog.directorydomain.export.js
@@ -0,0 +1,14 @@
+(function($) {
+    // No bindPwd column: the export strips it (AddDirectoryGroupsAPI).
+    $('#directorydomain-export-table').registerExportTable([
+        {data: 'name'},
+        {data: 'description', visible: false},
+        {data: 'createdBy', visible: false},
+        {data: 'createdTime', visible: false},
+        {data: 'uri'},
+        {data: 'bindDN'},
+        {data: 'caCert', visible: false},
+        {data: 'baseDN'},
+        {data: 'ouBase', visible: false}
+    ]);
+})(jQuery);
diff --git a/directorygroups/js/fog.directorydomain.list.js b/directorygroups/js/fog.directorydomain.list.js
new file mode 100644
index 0000000..33b1d6e
--- /dev/null
+++ b/directorygroups/js/fog.directorydomain.list.js
@@ -0,0 +1,18 @@
+(function($) {
+    $.registerListPage({
+        order: [
+            [0, 'asc']
+        ],
+        columns: [
+            {data: 'mainlink'},
+            {data: 'uri'}
+        ],
+        rowId: 'id',
+        columnDefs: [
+            {
+                responsivePriority: -1,
+                targets: 0
+            }
+        ]
+    });
+})(jQuery);
diff --git a/directorygroups/js/fog.directorygroups.add.js b/directorygroups/js/fog.directorygroups.add.js
new file mode 100644
index 0000000..fcc7268
--- /dev/null
+++ b/directorygroups/js/fog.directorygroups.add.js
@@ -0,0 +1,3 @@
+(function($) {
+    $('#directorygroups-create-form').wireCreateForm();
+})(jQuery);
diff --git a/directorygroups/js/fog.directorygroups.edit.js b/directorygroups/js/fog.directorygroups.edit.js
new file mode 100644
index 0000000..07e0681
--- /dev/null
+++ b/directorygroups/js/fog.directorygroups.edit.js
@@ -0,0 +1,42 @@
+$(function() {
+    // ---------------------------------------------------------------
+    // GENERAL TAB
+    $.registerGeneralTab({
+        nameInputSel: '#ou',
+        formSel: '#directorygroups-general-form'
+    });
+
+    // ---------------------------------------------------------------
+    // HOST TAB
+    var directorygroupsHostsTable = $.registerAssociationTab({
+        slug: 'directorygroups-host',
+        item: 'host',
+        sub: 'getHostsList',
+        columns: [
+            {data: 'name'},
+            {data: 'association'}
+        ],
+        columnDefs: [
+            {
+                responsivePriority: -1,
+                // Aisle 097: this tab supplies its own column-0 render, so it
+                // bypasses the server-side escape in FOGController's mainLink
+                // formatter and concatenated the name in raw. Mitigated today
+                // only by isHostnameSafe() on the write side -- do not rely on
+                // that staying the sole gate.
+                render: function(data, type, row) {
+                    return '<a href="../management/index.php?node=host&sub=edit&id='
+                        + row.id
+                        + '">'
+                        + $.escapeHtml(data)
+                        + '</a>';
+                },
+                targets: 0
+            }
+        ]
+    });
+
+    if (Common.search && Common.search.length > 0) {
+        directorygroupsHostsTable.search(Common.search).draw();
+    }
+});
diff --git a/directorygroups/js/fog.directorygroups.export.js b/directorygroups/js/fog.directorygroups.export.js
new file mode 100644
index 0000000..7d328cf
--- /dev/null
+++ b/directorygroups/js/fog.directorygroups.export.js
@@ -0,0 +1,9 @@
+(function($) {
+    $('#directorygroups-export-table').registerExportTable([
+        {data: 'name'},
+        {data: 'description', visible: false},
+        {data: 'createdBy', visible: false},
+        {data: 'createdTime', visible: false},
+        {data: 'ou'}
+    ]);
+})(jQuery);
diff --git a/directorygroups/js/fog.directorygroups.host.edit.js b/directorygroups/js/fog.directorygroups.host.edit.js
new file mode 100644
index 0000000..1bc4a91
--- /dev/null
+++ b/directorygroups/js/fog.directorygroups.host.edit.js
@@ -0,0 +1,112 @@
+(function($) {
+    // The whole tab -- Update wiring plus the create-and-associate button and
+    // modal -- is one shared helper (fog.common.js). These nine plugin tabs are
+    // the same card with a different noun, and each used to carry its own copy
+    // of the submit wiring.
+    $.registerSelectTab({
+        slug: 'host-directorygroups',
+        send: 'directorygroups-send',
+        node: 'directorygroups'
+    });
+})(jQuery);
+(function($) {
+    // ---------------------------------------------------------------
+    // ACTIVE DIRECTORY TAB: Browse Directory
+    //
+    // Lists a domain's OUs; a click on one fills the tab's Domain Name and
+    // Organizational Unit fields. The admin still clicks Update to save.
+    var browseBtn = $('#directorygroups-browse'),
+        modal = $('#directorygroups-browse-modal'),
+        domainSel = $('#directorygroups-browse-domain'),
+        table = $('#directorygroups-browse-table'),
+        domains = {},
+        dt;
+
+    if (!browseBtn.length) {
+        return;
+    }
+
+    function showDomain(id) {
+        if (dt) {
+            dt.destroy();
+            table.find('tbody').remove();
+            dt = null;
+        }
+        $.get(
+            '../management/index.php?node=directorydomain&sub=getOUs&id=' + id,
+            function(res) {
+                dt = table.DataTable({
+                    data: res.data,
+                    ordering: false,
+                    pageLength: 25,
+                    columns: [
+                        {data: 'name'},
+                        {data: 'dn'}
+                    ],
+                    columnDefs: [
+                        {
+                            targets: 0,
+                            render: function(data, type, row) {
+                                if (type !== 'display') {
+                                    return data;
+                                }
+                                return '<span style="padding-left:' + (row.depth * 1.5)
+                                    + 'em"><i class="fas fa-folder"></i> '
+                                    + $.escapeHtml(data) + '</span>';
+                            }
+                        }
+                    ]
+                });
+            },
+            'json'
+        ).fail(function(jqXHR) {
+            $.notifyFromAPI(jqXHR.responseJSON, jqXHR);
+        });
+    }
+
+    table.on('click', 'tbody tr', function() {
+        if (!dt) {
+            return;
+        }
+        var row = dt.row(this).data();
+        if (!row) {
+            return;
+        }
+        $('#adDomain').val(domains[domainSel.val()]);
+        $('#adOU').val(row.dn);
+        modal.modal('hide');
+    });
+
+    domainSel.on('change', function() {
+        showDomain(this.value);
+    });
+
+    browseBtn.on('click', function(e) {
+        e.preventDefault();
+        modal.modal('show');
+        if (domainSel.children().length) {
+            return;
+        }
+        $.get(
+            '../management/index.php?node=directorydomain&sub=getDomains',
+            function(res) {
+                var current = ($('#adDomain').val() || '').toLowerCase(),
+                    pick = null;
+                $.each(res.data, function(i, d) {
+                    domains[d.id] = d.name;
+                    domainSel.append($('<option/>').val(d.id).text(d.name));
+                    if (d.name.toLowerCase() === current) {
+                        pick = d.id;
+                    }
+                });
+                if (pick) {
+                    domainSel.val(pick);
+                }
+                if (domainSel.val()) {
+                    showDomain(domainSel.val());
+                }
+            },
+            'json'
+        );
+    });
+})(jQuery);
diff --git a/directorygroups/js/fog.directorygroups.import.js b/directorygroups/js/fog.directorygroups.import.js
new file mode 100644
index 0000000..1051675
--- /dev/null
+++ b/directorygroups/js/fog.directorygroups.import.js
@@ -0,0 +1,3 @@
+// Import form wiring is shared: wireImportForm() in fog.common.js activates for
+// any page rendering #import-form/#import-send. Kept as a stub so the JS loader
+// serves this file rather than falling back to fog.ou.list.js.
diff --git a/directorygroups/js/fog.directorygroups.list.js b/directorygroups/js/fog.directorygroups.list.js
new file mode 100644
index 0000000..bce2541
--- /dev/null
+++ b/directorygroups/js/fog.directorygroups.list.js
@@ -0,0 +1,18 @@
+(function($) {
+    $.registerListPage({
+        order: [
+            [0, 'asc']
+        ],
+        columns: [
+            {data: 'mainlink'},
+            {data: 'ou'}
+        ],
+        rowId: 'id',
+        columnDefs: [
+            {
+                responsivePriority: -1,
+                targets: 0
+            }
+        ]
+    });
+})(jQuery);
diff --git a/directorygroups/js/fog.directorygroups.report.file.js b/directorygroups/js/fog.directorygroups.report.file.js
new file mode 100644
index 0000000..dd9f151
--- /dev/null
+++ b/directorygroups/js/fog.directorygroups.report.file.js
@@ -0,0 +1,17 @@
+(function($) {
+  var reportString = window.atob(Common.f);
+
+  // Every plugin's report JS loads on any Reports page, so guard on the
+  // report name and only act on this plugin's own report.
+  switch (reportString) {
+    case 'directorygroups report':
+      $('#directorygroups-report-table').registerReportTable([
+        {data: 'name'},
+        {data: 'description', visible: false},
+        {data: 'createdBy', visible: false},
+        {data: 'createdTime', visible: false},
+        {data: 'ou'}
+      ], {fullExport: true});
+      break;
+  }
+})(jQuery);
diff --git a/directorygroups/src/Hooks/AddDirectoryDomainConnection.php b/directorygroups/src/Hooks/AddDirectoryDomainConnection.php
new file mode 100644
index 0000000..85d33a9
--- /dev/null
+++ b/directorygroups/src/Hooks/AddDirectoryDomainConnection.php
@@ -0,0 +1,117 @@
+<?php
+/**
+ * Supplies each host's directory connection from its domain.
+ *
+ * PHP version 7
+ *
+ * @category AddDirectoryDomainConnection
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Hooks;
+
+use FOG\Plugins\DirectoryGroups\Items\DirectoryDomain;
+
+/**
+ * Supplies each host's directory connection from its domain.
+ *
+ * Core places a host's computer object with one connection, read from the
+ * FOG_DIRECTORY_* settings. This plugin keeps one connection per domain
+ * instead, so it answers DIRECTORY_CONNECTION with the domain the host is in,
+ * and takes those settings off the FOG Settings page while it is installed.
+ * Uninstalling the plugin brings them back, and placement uses them again.
+ *
+ * @category AddDirectoryDomainConnection
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class AddDirectoryDomainConnection extends \FOG\Base\Hook
+{
+    /**
+     * The settings the domain list replaces. FOG_DIRECTORY_PLACEMENT_ENABLED
+     * is not one of them: it is the switch for placement as a whole.
+     *
+     * @var string[]
+     */
+    const REPLACED_SETTINGS = [
+        'FOG_DIRECTORY_LDAP_URI',
+        'FOG_DIRECTORY_BIND_DN',
+        'FOG_DIRECTORY_BIND_PASSWORD',
+        'FOG_DIRECTORY_CA_CERT',
+        'FOG_DIRECTORY_BASE_DN'
+    ];
+    /**
+     * The name of this hook.
+     *
+     * @var string
+     */
+    public $name = 'AddDirectoryDomainConnection';
+    /**
+     * The description of this hook.
+     *
+     * @var string
+     */
+    public $description = 'Directory connection per domain';
+    /**
+     * The active flag.
+     *
+     * @var bool
+     */
+    public $active = true;
+    /**
+     * The node this hook enacts with.
+     *
+     * @var string
+     */
+    public $node = 'directorygroups';
+    /**
+     * Initializes object.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+        $this->registerInstalled([
+            ['DIRECTORY_CONNECTION', 'connection'],
+            ['SETTINGS_HIDDEN', 'hideSettings'],
+        ]);
+    }
+    /**
+     * Answers with the connection of the host's domain.
+     *
+     * A host whose domain is not in the list gets an empty connection, which
+     * core reads as "no server for this host" and skips. It does not fall
+     * back to the hidden settings: an admin cannot see or change those while
+     * the plugin is installed, so they must not act.
+     *
+     * @param mixed $arguments The event arguments.
+     *
+     * @return void
+     */
+    public function connection($arguments)
+    {
+        $domain = DirectoryDomain::forName($arguments['domain'] ?? '');
+        $arguments['connection'] = $domain
+            ? $domain->connection()
+            : ['uri' => '', 'bindDN' => '', 'password' => '', 'caCert' => '', 'baseDN' => ''];
+    }
+    /**
+     * Hides the settings the domain list replaces.
+     *
+     * @param mixed $arguments The event arguments.
+     *
+     * @return void
+     */
+    public function hideSettings($arguments)
+    {
+        foreach (self::REPLACED_SETTINGS as $key) {
+            $arguments['hidden'][$key] = true;
+        }
+    }
+}
diff --git a/directorygroups/src/Hooks/AddDirectoryGroupsAPI.php b/directorygroups/src/Hooks/AddDirectoryGroupsAPI.php
new file mode 100644
index 0000000..4dd2428
--- /dev/null
+++ b/directorygroups/src/Hooks/AddDirectoryGroupsAPI.php
@@ -0,0 +1,119 @@
+<?php
+/**
+ * Injects ou stuff into the api system.
+ *
+ * PHP version 5
+ *
+ * @category AddDirectoryGroupsAPI
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Hooks;
+
+/**
+ * Injects ou stuff into the api system.
+ *
+ * @category AddDirectoryGroupsAPI
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class AddDirectoryGroupsAPI extends \FOG\Base\Hook
+{
+    /**
+     * The name of the hook.
+     *
+     * @var string
+     */
+    public $name = 'AddDirectoryGroupsAPI';
+    /**
+     * The description.
+     *
+     * @var string
+     */
+    public $description = 'Add OU stuff into the api system.';
+    /**
+     * For posterity.
+     *
+     * @var bool
+     */
+    public $active = true;
+    /**
+     * The node the hook works with.
+     *
+     * @var string
+     */
+    public $node = 'directorygroups';
+    /**
+     * Initialize object.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+        $this->registerInstalled([
+            ['API_VALID_CLASSES', 'injectAPIElements'],
+            ['API_SENSITIVE_FIELDS', 'declareSensitiveFields'],
+            ['DIRECTORYDOMAIN_EXPORT_ITEMS', 'stripBindPassword'],
+        ]);
+    }
+    /**
+     * This function injects ou elements for
+     * api access.
+     *
+     * @param mixed $arguments The arguments to modify.
+     *
+     * @return void
+     */
+    public function injectAPIElements($arguments)
+    {
+        array_push(
+            $arguments['validClasses'],
+            $this->node,
+            'directorygroupsassociation',
+            'directorydomain'
+        );
+    }
+    /**
+     * Declares a domain's bind password as a secret the API never emits.
+     *
+     * The 'always' tier, as the ldap plugin does for its own bind password:
+     * only the server binds with it, so nothing has a reason to read it
+     * back, not even from a single-entity GET.
+     *
+     * @param mixed $arguments The tier maps to modify.
+     *
+     * @return void
+     */
+    public function declareSensitiveFields($arguments)
+    {
+        $arguments['always']['directorydomain'][] = 'bindPwd';
+    }
+    /**
+     * Keeps the bind password out of the domain export.
+     *
+     * The list is covered by the sensitive-field tier above. FOGPage::export()
+     * builds its CSV from the table's own columns and does not consult that
+     * tier, so without this the export would carry the password.
+     *
+     * @param mixed $arguments The arguments to modify.
+     *
+     * @return void
+     */
+    public function stripBindPassword($arguments)
+    {
+        $arguments['columns'] = array_values(
+            array_filter(
+                $arguments['columns'],
+                function ($column) {
+                    return 'bindPwd' !== $column['dt'];
+                }
+            )
+        );
+    }
+}
diff --git a/directorygroups/src/Hooks/AddDirectoryGroupsBrowse.php b/directorygroups/src/Hooks/AddDirectoryGroupsBrowse.php
new file mode 100644
index 0000000..1a39e75
--- /dev/null
+++ b/directorygroups/src/Hooks/AddDirectoryGroupsBrowse.php
@@ -0,0 +1,111 @@
+<?php
+/**
+ * Adds a directory browser to the host's Active Directory tab.
+ *
+ * PHP version 7
+ *
+ * @category AddDirectoryGroupsBrowse
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Hooks;
+
+/**
+ * Adds a directory browser to the host's Active Directory tab.
+ *
+ * The Browse button opens a modal that lists a domain's OUs. Picking one
+ * fills the tab's Domain Name and Organizational Unit fields, so an admin
+ * no longer types a DN by hand. Nothing is saved until they click Update.
+ *
+ * Shown only to a user who may view domains: the modal reads them from the
+ * directorydomain node, which would refuse anyone else.
+ *
+ * @category AddDirectoryGroupsBrowse
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class AddDirectoryGroupsBrowse extends \FOG\Base\Hook
+{
+    /**
+     * The name of this hook.
+     *
+     * @var string
+     */
+    public $name = 'AddDirectoryGroupsBrowse';
+    /**
+     * The description of this hook.
+     *
+     * @var string
+     */
+    public $description = 'Browse the directory from the host AD tab';
+    /**
+     * The active flag.
+     *
+     * @var bool
+     */
+    public $active = true;
+    /**
+     * The node this hook enacts with.
+     *
+     * @var string
+     */
+    public $node = 'directorygroups';
+    /**
+     * Initializes object.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+        $this->registerInstalled([
+            ['HOST_EDIT_AD_FIELDS', 'browseButton'],
+        ]);
+    }
+    /**
+     * Adds the Browse button and its modal.
+     *
+     * The button goes after Update in the footer: both float right, so the
+     * first emitted lands rightmost and Update stays the primary action.
+     * The modal holds no form of its own, so it can sit inside the tab's.
+     *
+     * @param mixed $arguments The event arguments.
+     *
+     * @return void
+     */
+    public function browseButton($arguments)
+    {
+        if (!\FOG\Auth\Authorization::can('directorydomain.view')) {
+            return;
+        }
+        $arguments['buttons'] .= \FOG\Base\FOGPage::makeButton(
+            'directorygroups-browse',
+            _('Browse Directory'),
+            'btn btn-secondary float-end'
+        );
+        $arguments['buttons'] .= '<div class="modal fade" id="directorygroups-browse-modal"'
+            . ' tabindex="-1" role="dialog" aria-hidden="true">'
+            . '<div class="modal-dialog modal-xl" role="document">'
+            . '<div class="modal-content">'
+            . '<div class="modal-header"><h4 class="modal-title">'
+            . _('Browse Directory')
+            . '</h4></div>'
+            . '<div class="modal-body">'
+            . '<select class="form-control mb-3" id="directorygroups-browse-domain"></select>'
+            . '<table id="directorygroups-browse-table" class="table table-bordered table-hover">'
+            . '<thead><tr><th>' . _('OU') . '</th><th>'
+            . _('Distinguished Name') . '</th></tr></thead>'
+            . '</table>'
+            . '</div>'
+            . '<div class="modal-footer">'
+            . '<button type="button" class="btn btn-outline-secondary float-start"'
+            . ' data-bs-dismiss="modal">' . _('Cancel') . '</button>'
+            . '</div>'
+            . '</div></div></div>';
+    }
+}
diff --git a/directorygroups/src/Hooks/AddDirectoryGroupsHost.php b/directorygroups/src/Hooks/AddDirectoryGroupsHost.php
new file mode 100644
index 0000000..807db6a
--- /dev/null
+++ b/directorygroups/src/Hooks/AddDirectoryGroupsHost.php
@@ -0,0 +1,467 @@
+<?php
+/**
+ * Adds the ou choice to host.
+ *
+ * PHP version 5
+ *
+ * @category AddDirectoryGroupsHost
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @author   Lee Rowlett <nah@nah.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Hooks;
+
+/**
+ * Adds the ou choice to host.
+ *
+ * @category AddDirectoryGroupsHost
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @author   Lee Rowlett <nah@nah.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class AddDirectoryGroupsHost extends \FOG\Base\Hook
+{
+    /**
+     * The name of this hook.
+     *
+     * @var string
+     */
+    public $name = 'AddDirectoryGroupsHost';
+    /**
+     * The description of this hook.
+     *
+     * @var string
+     */
+    public $description = 'Add OU to Hosts';
+    /**
+     * The active flag (always true but for posterity)
+     *
+     * @var bool
+     */
+    public $active = true;
+    /**
+     * THe node this hook enacts with.
+     *
+     * @var string
+     */
+    public $node = 'directorygroups';
+    /**
+     * Initialize object.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+        $this->registerInstalled([
+            ['PLUGINS_INJECT_TABDATA', 'hostTabData'],
+            ['HOST_EDIT_SUCCESS', 'hostAddDirectoryGroupsEdit'],
+            ['HOST_MASSEDIT_FIELDS', 'massEditFields'],
+            ['HOST_MASSEDIT_APPLY', 'massEditApply'],
+            ['HOST_ADD_FIELDS', 'hostAddDirectoryGroupsField'],
+            ['HOST_REGISTER', 'hostAddDirectoryGroupsRegister'],
+        ]);
+    }
+    /**
+     * The host tab data.
+     *
+     * @param mixed $arguments The arguments to change.
+     *
+     * @return void
+     */
+    public function hostTabData($arguments)
+    {
+        global $node;
+        if ($node != 'host') {
+            return;
+        }
+        $obj = $arguments['obj'];
+
+        $arguments['pluginsTabData'][] = [
+            'name' => _('Directory Group'),
+            'id' => 'host-directorygroups',
+            'generator' => function () use ($obj) {
+                $this->hostDirectoryGroups($obj);
+            }
+        ];
+    }
+    /**
+     * The host ou display
+     *
+     * @param object $obj The host object we're working with.
+     *
+     * @return void
+     */
+    public function hostDirectoryGroups($obj)
+    {
+        $items = \FOG\Router\Route::getList('directorygroupsassociation');
+        $ou = 0;
+        foreach ($items as &$item) {
+            if ($item->hostID == $obj->get('id')) {
+                $ou = $item->directorygroupsID;
+                unset($item);
+                break;
+            }
+            unset($item);
+        }
+        $directorygroupsID = (
+            (int)filter_input(INPUT_POST, 'directorygroups') ?:
+            $ou
+        );
+        $ouSelector = (new \FOG\Plugins\DirectoryGroups\Managers\DirectoryGroupsManager())
+            ->buildSelectBox($directorygroupsID, 'directorygroups');
+
+        $fields = [
+            \FOG\Base\FOGPage::makeLabel(
+                'col-sm-3 col-form-label',
+                'directorygroups',
+                _('Host OU')
+            ) => $ouSelector
+        ];
+
+        $buttons = \FOG\Base\FOGPage::makeButton(
+            'directorygroups-send',
+            _('Update'),
+            'btn btn-primary float-end'
+        );
+        // Create-and-associate, the same button and modal the core association
+        // tabs get. Added before the *_FIELDS event so a listener can still see
+        // it, and immediately after Update so Update stays the row's rightmost
+        // (primary) button with this one to its left. The modal it returns is
+        // echoed after the form -- see below for why it cannot go inside.
+        $createModal = \FOG\Base\FOGPage::renderAssocCreate(
+            'host-directorygroups',
+            'directorygroups',
+            $buttons,
+            $obj->get('id'),
+            _('OU')
+        );
+
+        self::$HookManager->processEvent(
+            'HOST_DIRECTORYGROUPS_FIELDS',
+            [
+                'fields' => &$fields,
+                'buttons' => &$buttons,
+                'Host' => &$obj
+            ]
+        );
+        $rendered = \FOG\Base\FOGPage::formFields($fields);
+        unset($fields);
+
+        echo \FOG\Base\FOGPage::makeFormTag(
+            '',
+            'host-directorygroups-form',
+            \FOG\Base\FOGPage::makeTabUpdateURL(
+                'host-directorygroups',
+                $obj->get('id')
+            ),
+            'post',
+            'application/x-www-form-urlencoded',
+            true
+        );
+        echo '<div class="card">';
+        echo '<div class="card-header">';
+        echo '<h4 class="card-title">';
+        echo _('OU');
+        echo '</h4>';
+        echo '</div>';
+        echo '<div class="card-body">';
+        echo $rendered;
+        echo '</div>';
+        echo '<div class="card-footer">';
+        echo $buttons;
+        echo '</div>';
+        echo '</div>';
+        echo '</form>';
+        // Outside the form, deliberately. The modal holds the fetched create
+        // form, and a <form> inside another <form> is invalid markup: the
+        // browser drops the inner one and the create would post nothing.
+        echo $createModal;
+    }
+    /**
+     * The ou updater element.
+     *
+     * @param object $obj The object we're working with.
+     *
+     * @return void
+     */
+    public function hostDirectoryGroupsPost($obj)
+    {
+        self::checkAuthAndCSRF();
+        $directorygroupsID = trim(
+            (int)filter_input(INPUT_POST, 'directorygroups')
+        );
+        $insert_fields = ['hostID', 'directorygroupsID'];
+        $insert_values = [];
+        $hosts = [$obj->get('id')];
+        if (count($hosts ?: [])) {
+            \FOG\Router\Route::deletemass(
+                'directorygroupsassociation',
+                ['hostID' => $hosts]
+            );
+            if ($directorygroupsID > 0) {
+                foreach ((array)$hosts as $ind => &$hostID) {
+                    $insert_values[] = [$hostID, $directorygroupsID];
+                    unset($hostID);
+                }
+            }
+        }
+        if (count($insert_values) > 0) {
+            (new \FOG\Plugins\DirectoryGroups\Managers\DirectoryGroupsAssociationManager())
+                ->insertBatch(
+                    $insert_fields,
+                    $insert_values
+                );
+        }
+    }
+    /**
+     * Associates the OU posted during host (auto) registration.
+     *
+     * The Registration class decodes $_POST in place before firing
+     * HOST_REGISTER, so the posted 'directorygroups' is already a plain id here.
+     *
+     * @param mixed $arguments The hook arguments (contains Host).
+     *
+     * @return void
+     */
+    public function hostAddDirectoryGroupsRegister($arguments)
+    {
+        $obj = $arguments['Host'];
+        if (!$obj->isValid()) {
+            return;
+        }
+        $directorygroupsID = (int)($_POST['directorygroups'] ?? 0);
+        if ($directorygroupsID < 1) {
+            return;
+        }
+        (new \FOG\Plugins\DirectoryGroups\Managers\DirectoryGroupsAssociationManager())
+            ->insertBatch(
+                ['hostID', 'directorygroupsID'],
+                [[$obj->get('id'), $directorygroupsID]]
+            );
+    }
+    /**
+     * The host ou selector.
+     *
+     * @param mixed $arguments The arguments to change.
+     *
+     * @return void
+     */
+    public function hostAddDirectoryGroupsEdit($arguments)
+    {
+        self::checkAuthAndCSRF();
+        global $tab;
+        global $node;
+        if ($node != 'host') {
+            return;
+        }
+        $obj = $arguments['Host'];
+        try {
+            switch ($tab) {
+                case 'host-directorygroups':
+                    $this->hostDirectoryGroupsPost($obj);
+                    break;
+                default:
+                    return;
+            }
+            $arguments['code'] = \FOG\Router\HTTPResponseCodes::HTTP_ACCEPTED;
+            $arguments['hook'] = 'HOST_EDIT_DIRECTORYGROUPS_SUCCESS';
+            $arguments['msg'] = json_encode(
+                [
+                    'msg' => _('Host OU Updated!'),
+                    'title' => _('Host OU Update Success')
+                ]
+            );
+        } catch (\Exception $e) {
+            $arguments['code'] = (
+                $arguments['serverFault'] ?
+                \FOG\Router\HTTPResponseCodes::HTTP_INTERNAL_SERVER_ERROR :
+                \FOG\Router\HTTPResponseCodes::HTTP_BAD_REQUEST
+            );
+            $arguments['hook'] = 'HOST_EDIT_DIRECTORYGROUPS_FAIL';
+            $arguments['msg'] = json_encode(
+                [
+                    'error' => $e->getMessage(),
+                    'title' => _('Host Update OU Fail')
+                ]
+            );
+        }
+    }
+    /**
+     * The host ou field for function add.
+     *
+     * @param mixed $arguments The arguments to change.
+     *
+     * @return void
+     */
+    public function hostAddDirectoryGroupsField($arguments)
+    {
+        global $node;
+        if ($node != 'host') {
+            return;
+        }
+        $directorygroupsID = (int)filter_input(INPUT_POST, 'directorygroups');
+        $ouSelector = (new \FOG\Plugins\DirectoryGroups\Managers\DirectoryGroupsManager())
+            ->buildSelectBox($directorygroupsID, 'directorygroups');
+
+        $arguments['fields'][
+            \FOG\Base\FOGPage::makeLabel(
+                'col-sm-3 col-form-label',
+                'directorygroups',
+                _('Host OU')
+            )
+        ] = $ouSelector;
+    }
+    /**
+     * Contributes the ou to the host list's Mass Edit form.
+     *
+     * ADR 0038 decision 13. This replaces AddOUGroup, whose only job was
+     * to set one ou across a group's members. That hook was a copy, not a
+     * grant: it read the membership at the instant the button was pressed and
+     * wrote a row per member, so a host added to the group afterward got
+     * nothing and a host removed kept what it had. Worse, it had no way to
+     * express "leave this host alone" -- every save deleted the association
+     * for every member first, so setting one host's ou through the group
+     * wiped it from all of them.
+     *
+     * A ou is single-valued per host: the write path has always been
+     * delete-then-insert-one. That is why this is a mass edit rather than one
+     * of ADR 0038's grant tables -- a grant is a SET that several groups can
+     * union into, and unioning two ous means nothing.
+     *
+     * Core draws the three-state action control around this field, which is
+     * what makes "leave alone" expressible at all. The value control is
+     * rendered EMPTY on purpose: there is no honest value to pre-fill it with
+     * when the selection disagrees. What the hosts hold is stated in the hint
+     * instead, where "(varies)" is sayable.
+     *
+     * @param mixed $arguments The arguments to change.
+     *
+     * @return void
+     */
+    public function massEditFields($arguments)
+    {
+        $hostIDs = (array)$arguments['hostIDs'];
+
+        $arguments['fields']['directorygroups'] = [
+            'label' => _('Host OU'),
+            'input' => (new \FOG\Plugins\DirectoryGroups\Managers\DirectoryGroupsManager())->buildSelectBox(
+                '',
+                'value[directorygroups]',
+                'name',
+                '',
+                false,
+                'id',
+                'massedit-directorygroups'
+            ),
+            'hint' => \FOG\Util\SharedHostValues::hint(
+                $this->_sharedDirectoryGroups($hostIDs)
+            ),
+        ];
+    }
+    /**
+     * What the selected hosts hold, as a name rather than an id.
+     *
+     * SharedHostValues::forHostRows() answers in the column's own terms, so a
+     * uniform selection comes back as the ou id. Rendering that would put
+     * a bare number in front of the admin where every other hint shows the
+     * value they set. The lookup only happens when the answer is uniform and
+     * non-empty, which is the only case where there is one name to show.
+     *
+     * forHostRows() is also the reason this is not a hand-rolled query: a
+     * host with no ou has no row at all, so counting rows would call
+     * three hosts out of five "in agreement". It compares the row count to
+     * the selection size for exactly that reason.
+     *
+     * @param array $hostIDs the selection
+     *
+     * @return array a SharedHostValues info array
+     */
+    private function _sharedDirectoryGroups(array $hostIDs)
+    {
+        $info = \FOG\Util\SharedHostValues::forHostRows(
+            $hostIDs,
+            'directoryOUAssoc',
+            'doaHostID',
+            ['directorygroups' => 'doaOUID']
+        )['directorygroups'];
+
+        if (!empty($info['uniform']) && '' !== (string)$info['value']) {
+            $item = new \FOG\Plugins\DirectoryGroups\Items\DirectoryGroups((int)$info['value']);
+            if ($item->isValid()) {
+                $info['value'] = $item->get('name');
+            }
+        }
+
+        return $info;
+    }
+    /**
+     * Applies a resolved ou action across the selection.
+     *
+     * The action arrives already reduced to leave/set/clear, so there is no
+     * sentinel to parse and no way for an empty control to be mistaken for
+     * "clear it" -- which is the failure the three-state model exists to stop
+     * and the one AddOUGroup could not avoid.
+     *
+     * @param mixed $arguments The arguments to change.
+     *
+     * @return void
+     */
+    public function massEditApply($arguments)
+    {
+        if (!isset($arguments['actions']['directorygroups'])) {
+            return;
+        }
+        $instruction = $arguments['actions']['directorygroups'];
+        $action = $instruction['action'];
+        if ('leave' === $action) {
+            return;
+        }
+        $hostIDs = array_values(
+            array_filter(
+                array_map('intval', (array)$arguments['hostIDs']),
+                function ($id) {
+                    return $id > 0;
+                }
+            )
+        );
+        if (count($hostIDs) < 1) {
+            return;
+        }
+
+        $itemID = 0;
+        if ('set' === $action) {
+            $itemID = (int)$instruction['value'];
+            // A set naming a ou that does not exist is a bad request, not
+            // an instruction to clear: silently turning it into one would
+            // strip the ou off every selected host.
+            if ($itemID < 1
+                || !(new \FOG\Plugins\DirectoryGroups\Items\DirectoryGroups($itemID))->isValid()
+            ) {
+                throw new \Exception(_('Invalid OU selected'));
+            }
+        }
+
+        // Both branches clear first. The association is single-valued per
+        // host, so a set is a replace -- and doing it in one deletemass
+        // rather than per host keeps it to one statement.
+        \FOG\Router\Route::deletemass(
+            'directorygroupsassociation',
+            ['hostID' => $hostIDs]
+        );
+        if ($itemID < 1) {
+            return;
+        }
+        $insert_values = [];
+        foreach ($hostIDs as $hostID) {
+            $insert_values[] = [$hostID, $itemID];
+        }
+        (new \FOG\Plugins\DirectoryGroups\Managers\DirectoryGroupsAssociationManager())
+            ->insertBatch(['hostID', 'directorygroupsID'], $insert_values);
+    }
+}
diff --git a/directorygroups/src/Hooks/AddDirectoryGroupsJS.php b/directorygroups/src/Hooks/AddDirectoryGroupsJS.php
new file mode 100644
index 0000000..635e575
--- /dev/null
+++ b/directorygroups/src/Hooks/AddDirectoryGroupsJS.php
@@ -0,0 +1,81 @@
+<?php
+/**
+ * Sets the javascript files up for this plugin.
+ *
+ * PHP version 5
+ *
+ * @category AddSiteJS
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @author   Lee Rowlett <nah@nah.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Hooks;
+
+/**
+ * Sets the javascript files up for this plugin.
+ *
+ * @category AddSiteJS
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @author   Lee Rowlett <nah@nah.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class AddDirectoryGroupsJS extends \FOG\Base\Hook
+{
+    /**
+     * The name of this hook.
+     *
+     * @var string
+     */
+    public $name = 'AddDirectoryGroupsJS';
+    /**
+     * The description.
+     *
+     * @var string
+     */
+    public $description = 'Add OU JS files.';
+    /**
+     * For posterity.
+     *
+     * @var bool
+     */
+    public $active = true;
+    /**
+     * What plugin this works against.
+     *
+     * @var string
+     */
+    public $node = 'directorygroups';
+    /**
+     * Initialize object.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+        $this->registerInstalled([
+            ['PAGE_JS_FILES', 'injectJSFiles'],
+        ]);
+    }
+    /**
+     * The files we need to inject.
+     *
+     * @param mixed $arguments The arguments to modify.
+     *
+     * @return void
+     */
+    public function injectJSFiles($arguments)
+    {
+        $this->injectPluginJS($arguments, [
+            'directorygroups' => ['fallback' => true],
+            'directorydomain' => ['fallback' => true],
+            'report' => ['secondary' => true, 'fallback' => true],
+            'host' => ['secondary' => true],
+        ]);
+    }
+}
diff --git a/directorygroups/src/Hooks/AddDirectoryGroupsMenuItem.php b/directorygroups/src/Hooks/AddDirectoryGroupsMenuItem.php
new file mode 100644
index 0000000..c43b2ca
--- /dev/null
+++ b/directorygroups/src/Hooks/AddDirectoryGroupsMenuItem.php
@@ -0,0 +1,173 @@
+<?php
+/**
+ * Adds the ou menu item.
+ *
+ * PHP version 5
+ *
+ * @category AddDirectoryGroupsMenuItem
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @author   Lee Rowlett <nah@nah.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Hooks;
+
+/**
+ * Adds the ou menu item.
+ *
+ * @category AddDirectoryGroupsMenuItem
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @author   Lee Rowlett <nah@nah.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class AddDirectoryGroupsMenuItem extends \FOG\Base\Hook
+{
+    /**
+     * The domains' own node. It is separate from the groups so a role can
+     * be allowed to group hosts without being allowed to read or change a
+     * domain's bind account.
+     *
+     * @var string
+     */
+    const DOMAIN_NODE = 'directorydomain';
+    /**
+     * The name of this hook.
+     *
+     * @var string
+     */
+    public $name = 'AddDirectoryGroupsMenuItem';
+    /**
+     * The description of this hook.
+     *
+     * @var string
+     */
+    public $description = 'Add menu item for ou';
+    /**
+     * The active flag.
+     *
+     * @var bool
+     */
+    public $active = true;
+    /**
+     * The node this hook enacts with.
+     *
+     * @var string
+     */
+    public $node = 'directorygroups';
+    /**
+     * Initialize object.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+        $this->registerInstalled([
+            ['MAIN_MENU_DATA', 'menuData'],
+            ['SEARCH_PAGES', 'addSearch'],
+            ['PAGES_WITH_OBJECTS', 'addPageWithObject'],
+            ['PERMISSION_REGISTRY_DATA', 'permData'],
+            ['SUB_MENULINK_DATA', 'menuUpdate'],
+            ['REPORT_TITLE_DATA', 'reportTitle'],
+        ]);
+    }
+    /**
+     * Names this plugin's report in the Reports menu.
+     *
+     * Without this the sidebar shows ucwords() of the FILE name -- "Ou Report"
+     * -- while the page it opens is headed "Export OUs". Two names for one
+     * screen, and the file name is the half nobody chose.
+     *
+     * Keyed the way the menu and the base64 `f` parameter are: the file
+     * name with underscores as spaces, lower case. The report reads the
+     * same map back through reportTitle() for its heading, so the two
+     * cannot drift apart again.
+     *
+     * @param mixed $arguments The titles to modify.
+     *
+     * @return void
+     */
+    public function reportTitle($arguments)
+    {
+        $arguments['titles']['directorygroups report'] = _('Export OUs');
+    }
+    /**
+     * Add the new items beyond list/create.
+     *
+     * @param mixed $arguments The items to modify.
+     *
+     * @return void
+     */
+    public function menuUpdate($arguments)
+    {
+        if ($arguments['node'] == self::DOMAIN_NODE) {
+            $arguments['menu']['export'] = _('Export Domains');
+            return;
+        }
+        if ($arguments['node'] != $this->node) {
+            return;
+        }
+        $arguments['menu']['export'] = _('Export OUs');
+        $arguments['menu']['import'] = _('Import OUs');
+    }
+    /**
+     * The menu data to change.
+     *
+     * @param mixed $arguments The arguments to change.
+     *
+     * @return void
+     */
+    public function menuData($arguments)
+    {
+        $arguments['hook_main'][$this->node]
+            = [_('Directory Groups'), 'fas fa-folder-tree'];
+        $arguments['hook_main'][self::DOMAIN_NODE]
+            = [_('Directory Domains'), 'fas fa-sitemap'];
+    }
+    /**
+     * Adds the ou page to search elements.
+     *
+     * @param mixed $arguments The arguments to change.
+     *
+     * @return void
+     */
+    public function addSearch($arguments)
+    {
+        $arguments['searchPages'][] = $this->node;
+        $arguments['searchPages'][] = self::DOMAIN_NODE;
+    }
+    /**
+     * Adds the ou page to objects elements.
+     *
+     * @param mixed $arguments The arguments to change.
+     *
+     * @return void
+     */
+    public function addPageWithObject($arguments)
+    {
+        $arguments['PagesWithObjects'][] = $this->node;
+        $arguments['PagesWithObjects'][] = self::DOMAIN_NODE;
+    }
+
+    /**
+     * Registers this plugin's permission node and actions so its pages
+     * are gated by RBAC and shown in the role permission matrix.
+     *
+     * @param mixed $arguments The permission registry to modify.
+     *
+     * @return void
+     */
+    public function permData($arguments)
+    {
+        $arguments['registry'][$this->node] = [
+            'view', 'create', 'edit', 'delete'
+        ];
+        $arguments['registry'][self::DOMAIN_NODE] = [
+            'view', 'create', 'edit', 'delete'
+        ];
+    }
+}
diff --git a/directorygroups/src/Hooks/AddDirectoryGroupsType.php b/directorygroups/src/Hooks/AddDirectoryGroupsType.php
new file mode 100644
index 0000000..fe5204d
--- /dev/null
+++ b/directorygroups/src/Hooks/AddDirectoryGroupsType.php
@@ -0,0 +1,65 @@
+<?php
+/**
+ * Adds the ou report type.
+ *
+ * PHP version 5
+ *
+ * @category AddDirectoryGroupsType
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @author   Lee Rowlett <nah@nah.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Hooks;
+
+/**
+ * Adds the ou report type.
+ *
+ * @category AddDirectoryGroupsType
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @author   Lee Rowlett <nah@nah.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class AddDirectoryGroupsType extends \FOG\Base\Hook
+{
+    /**
+     * The name of this hook.
+     *
+     * @var string
+     */
+    public $name = 'AddDirectoryGroupsType';
+    /**
+     * The description of this hook.
+     *
+     * @var string
+     */
+    public $description = 'Add Report Management Type';
+    /**
+     * The active flag.
+     *
+     * @var bool
+     */
+    public $active = true;
+    /**
+     * The node this hook enacts with.
+     *
+     * @var string
+     */
+    public $node = 'directorygroups';
+    /**
+     * Initialize object.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+        $this->registerInstalled([
+            ['REPORT_TYPES', 'reportTypes'],
+        ]);
+    }
+}
diff --git a/directorygroups/src/Hooks/DirectoryGroupsChangeItems.php b/directorygroups/src/Hooks/DirectoryGroupsChangeItems.php
new file mode 100644
index 0000000..2d923f0
--- /dev/null
+++ b/directorygroups/src/Hooks/DirectoryGroupsChangeItems.php
@@ -0,0 +1,106 @@
+<?php
+/**
+ * Changes the elements we need.
+ *
+ * PHP version 5
+ *
+ * @category ChangeItems
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @author   Lee Rowlett <nah@nah.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Hooks;
+
+/**
+ * Changes the elements we need.
+ *
+ * @category ChangeItems
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @author   Lee Rowlett <nah@nah.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+/**
+ * Named for its plugin -- see LocationChangeItems, which shared this hook's
+ * old changeitems.hook.php filename and therefore its class name. Only one of
+ * the two ever loaded per request, decided by readdir order. Namespacing
+ * closed that off structurally (fogproject ADR 0035); the distinct names stay
+ * because they are what the log shows.
+ */
+class DirectoryGroupsChangeItems extends \FOG\Base\Hook
+{
+    /**
+     * The name of this hook.
+     *
+     * @var string
+     */
+    public $name = 'DirectoryGroupsChangeItems';
+    /**
+     * The description of this hook.
+     *
+     * @var string
+     */
+    public $description = 'Add OU During client checkin';
+    /**
+     * The active flag.
+     *
+     * @var bool
+     */
+    public $active = true;
+    /**
+     * The node this hook enacts with.
+     *
+     * @var string
+     */
+    public $node = 'directorygroups';
+    /**
+     * Initialize object.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+        $this->registerInstalled([
+            ['HOSTNAME_CHANGER_CLIENT', 'changeADItems'],
+        ]);
+    }
+    /**
+     * Sets up host for the new OU
+     *
+     * @param mixed $arguments The items to change.
+     *
+     * @return void
+     */
+    public function changeADItems($arguments)
+    {
+        if (!$arguments['Host']->isValid()) {
+            return;
+        }
+        $OUAssocs = \FOG\Router\Route::getList(
+            'directorygroupsassociation',
+            ['hostID' => $arguments['Host']->get('id')]
+        );
+        // listem() returns the paginated envelope, so the rows are under
+        // ->data. Iterating the envelope itself walked its scalar counters
+        // instead: every client check-in warned "Attempt to read property
+        // directorygroupsID on int" and ADOU was never set. LocationChangeItems, which is
+        // the same shape, has always had this right.
+        foreach ($OUAssocs as $OUAssoc) {
+            // getClass() rather than Route::indiv(): indiv() answers a missing
+            // row with sendResponse(404), and that exits. An ouassociation
+            // left behind by a deleted OU would end the whole check-in with a
+            // 404 the client reads as a transport failure, rather than skip
+            // one association.
+            $OU = new \FOG\Plugins\DirectoryGroups\Items\DirectoryGroups($OUAssoc->directorygroupsID);
+            if (!$OU->isValid()) {
+                continue;
+            }
+            $arguments['val']['ADOU'] = $OU->get('ou');
+        }
+    }
+}
diff --git a/directorygroups/src/Hooks/DirectoryGroupsDeleteMassItems.php b/directorygroups/src/Hooks/DirectoryGroupsDeleteMassItems.php
new file mode 100644
index 0000000..d5bd696
--- /dev/null
+++ b/directorygroups/src/Hooks/DirectoryGroupsDeleteMassItems.php
@@ -0,0 +1,89 @@
+<?php
+/**
+ * Deletes the OU the elements en-mass.
+ *
+ * PHP version 5
+ *
+ * @category DirectoryGroupsDeleteMassItems
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Hooks;
+
+/**
+ * Deletes the OU the elements en-mass.
+ *
+ * @category DirectoryGroupsDeleteMassItems
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class DirectoryGroupsDeleteMassItems extends \FOG\Base\Hook
+{
+    /**
+     * The name of this hook.
+     *
+     * @var string
+     */
+    public $name = 'DirectoryGroupsDeleteMassItems';
+    /**
+     * The description of this hook.
+     *
+     * @var string
+     */
+    public $description = 'Delete En-mass Route altering for OU';
+    /**
+     * The active flag.
+     *
+     * @var bool
+     */
+    public $active = true;
+    /**
+     * The node this hook enacts with.
+     *
+     * @var string
+     */
+    public $node = 'directorygroups';
+    /**
+     * Initialize object.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+        $this->registerInstalled([
+            ['DELETEMASS_API', 'deletemassitems'],
+        ]);
+    }
+    /**
+     * Prepares to clean up associations
+     *
+     * @param mixed $arguments The items to change.
+     *
+     * @return void
+     */
+    public function deletemassitems($arguments)
+    {
+        switch ($arguments['classname']) {
+            case 'host':
+                $arguments['removeItems']['directorygroupsassociation'] = [
+                    'hostID' => $arguments['itemIDs']
+                ];
+                break;
+            case 'directorygroups':
+                // Only treat itemIDs as ouIDs when an OU itself is deleted.
+                // A bare default would mis-fire for every other entity now that
+                // all delete paths funnel through DELETEMASS_API, deleting
+                // ouassociation rows whose directorygroupsID collides with the deleted id.
+                $arguments['removeItems']['directorygroupsassociation'] = [
+                    'directorygroupsID' => $arguments['itemIDs']
+                ];
+                break;
+        }
+    }
+}
diff --git a/directorygroups/src/Items/DirectoryDomain.php b/directorygroups/src/Items/DirectoryDomain.php
new file mode 100644
index 0000000..5b4ce64
--- /dev/null
+++ b/directorygroups/src/Items/DirectoryDomain.php
@@ -0,0 +1,169 @@
+<?php
+/**
+ * One Active Directory domain and the account FOG reads it with.
+ *
+ * PHP version 7
+ *
+ * @category DirectoryDomain
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Items;
+
+/**
+ * One Active Directory domain and the account FOG reads it with.
+ *
+ * Each domain carries its own connection, so one install can place hosts in
+ * several domains (GH-1879). Core asks for a host's connection through
+ * DIRECTORY_CONNECTION, and AddDirectoryDomainConnection answers it from the
+ * domain whose name matches the host's AD domain.
+ *
+ * The bind password is stored as typed, the same as the ldap plugin's bind
+ * password and the FOG_DIRECTORY_BIND_PASSWORD setting it replaces. It never
+ * leaves the server: the API strips it in the 'always' tier, and the edit form
+ * does not render it back.
+ *
+ * @category DirectoryDomain
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class DirectoryDomain extends \FOG\Base\FOGController
+{
+    /**
+     * The table.
+     *
+     * @var string
+     */
+    protected $databaseTable = 'directoryDomains';
+    /**
+     * The fields.
+     *
+     * name is the domain's DNS name (fogad.local), the value a host carries
+     * in ADDomain. baseDN is where placement searches for computer objects;
+     * ouBase is where the OU browser starts, and defaults to the domain root.
+     *
+     * @var array
+     */
+    protected $databaseFields = [
+        'id' => 'ddID',
+        'name' => 'ddName',
+        'description' => 'ddDesc',
+        'createdBy' => 'ddCreatedBy',
+        'createdTime' => 'ddCreatedTime',
+        'uri' => 'ddURI',
+        'bindDN' => 'ddBindDN',
+        'bindPwd' => 'ddBindPwd',
+        'caCert' => 'ddCACert',
+        'baseDN' => 'ddBaseDN',
+        'ouBase' => 'ddOUBase'
+    ];
+    /**
+     * The required fields.
+     *
+     * @var array
+     */
+    protected $databaseFieldsRequired = [
+        'name',
+        'uri'
+    ];
+    /**
+     * The domain whose name matches a host's AD domain, or null.
+     *
+     * Case-insensitive, because DNS names are, and an admin types
+     * FOGAD.local on one host and fogad.local on the next.
+     *
+     * @param string $domain the host's ADDomain
+     *
+     * @return self|null
+     */
+    public static function forName($domain)
+    {
+        $domain = strtolower(trim((string)$domain));
+        if ('' === $domain) {
+            return null;
+        }
+        foreach ((array)\FOG\Router\Route::getIds('directorydomain') as $id) {
+            $item = new self($id);
+            if ($item->isValid()
+                && strtolower(trim((string)$item->get('name'))) === $domain
+            ) {
+                return $item;
+            }
+        }
+        return null;
+    }
+    /**
+     * The connection core's placement uses, in the DIRECTORY_CONNECTION shape.
+     *
+     * @return array{uri:string,bindDN:string,password:string,caCert:string,baseDN:string}
+     */
+    public function connection()
+    {
+        return [
+            'uri' => (string)$this->get('uri'),
+            'bindDN' => (string)$this->get('bindDN'),
+            'password' => \FOG\Agent\DirectoryPlacement::decodeStored(
+                $this->get('bindPwd')
+            ),
+            'caCert' => (string)$this->get('caCert'),
+            'baseDN' => (string)$this->get('baseDN')
+        ];
+    }
+    /**
+     * Where the OU browser starts.
+     *
+     * The configured base, or else the domain root built from the name:
+     * fogad.local becomes DC=fogad,DC=local. That is the root of every
+     * Active Directory domain, so the default shows the whole tree.
+     *
+     * @return string
+     */
+    public function browseBase()
+    {
+        $base = trim((string)$this->get('ouBase'));
+        if ('' !== $base) {
+            return $base;
+        }
+        $labels = array_filter(
+            explode('.', trim((string)$this->get('name'))),
+            'strlen'
+        );
+        if (!$labels) {
+            return '';
+        }
+        return 'DC=' . implode(',DC=', $labels);
+    }
+    /**
+     * Every OU under the browse base, root first.
+     *
+     * @throws \Exception with the directory's reason when it cannot be read
+     * @return array<int,array{dn:string,name:string}>
+     */
+    public function listOUs()
+    {
+        $connection = $this->connection();
+        $ldap = new \FOG\Net\FOGLdap();
+        try {
+            if (!$ldap->connect(
+                $connection['uri'],
+                $connection['bindDN'],
+                $connection['password'],
+                $connection['caCert']
+            )) {
+                throw new \Exception($ldap->error());
+            }
+            $ous = $ldap->listOUs($this->browseBase());
+            if (null === $ous) {
+                throw new \Exception($ldap->error());
+            }
+            return $ous;
+        } finally {
+            $ldap->close();
+        }
+    }
+}
diff --git a/directorygroups/src/Items/DirectoryGroups.php b/directorygroups/src/Items/DirectoryGroups.php
new file mode 100644
index 0000000..1982088
--- /dev/null
+++ b/directorygroups/src/Items/DirectoryGroups.php
@@ -0,0 +1,134 @@
+<?php
+/**
+ * The OU class.
+ *
+ * PHP version 5
+ *
+ * @category OU
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Items;
+
+/**
+ * The OU class.
+ *
+ * @category OU
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class DirectoryGroups extends \FOG\Base\FOGController
+{
+    /**
+     * The location table
+     *
+     * @var string
+     */
+    protected $databaseTable = 'directoryOUs';
+    /**
+     * The location table fields and common names
+     *
+     * @var array
+     */
+    protected $databaseFields = [
+        'id' => 'doID',
+        'name' => 'doName',
+        'description' => 'doDesc',
+        'createdBy' => 'doCreatedBy',
+        'createdTime' => 'doCreatedTime',
+        'ou' => 'doDN',
+        'domainID' => 'doDomainID'
+    ];
+    /**
+     * The required fields
+     *
+     * @var array
+     */
+    protected $databaseFieldsRequired = [
+        'name',
+        'ou'
+    ];
+    /**
+     * Additional fields.
+     *
+     * @var array
+     */
+    protected $additionalFields = [
+        'hosts'
+    ];
+    /**
+     * Destroy this particular object.
+     *
+     * @param string $key the key to destroy for match
+     *
+     * @return bool
+     */
+    public function destroy($key = 'id')
+    {
+        \FOG\Router\Route::deletemass(
+            'directorygroupsassociation',
+            ['directorygroupsID' => $this->get('id')]
+        );
+        return parent::destroy($key);
+    }
+    /**
+     * Stores the item in the DB either stored or updated.
+     *
+     * @return object
+     */
+    public function save()
+    {
+        parent::save();
+        return $this
+            ->assocSetter('DirectoryGroups', 'host')
+            ->load();
+    }
+    /**
+     * Add host to the location.
+     *
+     * @param array $addArray the items to add.
+     *
+     * @return object
+     */
+    public function addHost($addArray)
+    {
+        return $this->addRemItem(
+            'hosts',
+            (array)$addArray,
+            'merge'
+        );
+    }
+    /**
+     * Remove host from the location.
+     *
+     * @param array $removeArray the items to remove.
+     *
+     * @return object
+     */
+    public function removeHost($removeArray)
+    {
+        return $this->addRemItem(
+            'hosts',
+            (array)$removeArray,
+            'diff'
+        );
+    }
+    /**
+     * Loads the locations hosts.
+     *
+     * @return void
+     */
+    protected function loadHosts()
+    {
+        $this->_loadHostIds(
+            'directorygroupsassociation',
+            ['directorygroupsID' => $this->get('id')],
+            'hostID'
+        );
+    }
+}
diff --git a/directorygroups/src/Items/DirectoryGroupsAssociation.php b/directorygroups/src/Items/DirectoryGroupsAssociation.php
new file mode 100644
index 0000000..3ea7369
--- /dev/null
+++ b/directorygroups/src/Items/DirectoryGroupsAssociation.php
@@ -0,0 +1,96 @@
+<?php
+/**
+ * The association between hosts and ous.
+ *
+ * PHP version 5
+ *
+ * @category DirectoryGroupsAssociation
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Items;
+
+/**
+ * The association between hosts and ous.
+ *
+ * @category DirectoryGroupsAssociation
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class DirectoryGroupsAssociation extends \FOG\Base\FOGController
+{
+    /**
+     * The association table.
+     *
+     * @var string
+     */
+    protected $databaseTable = 'directoryOUAssoc';
+    /**
+     * The association fields and common names.
+     *
+     * @var array
+     */
+    protected $databaseFields = [
+        'id' => 'doaID',
+        'directorygroupsID' => 'doaOUID',
+        'hostID' => 'doaHostID'
+    ];
+    /**
+     * The required fields
+     *
+     * @var array
+     */
+    protected $databaseFieldsRequired = [
+        'directorygroupsID',
+        'hostID'
+    ];
+    /**
+     * Additional fields
+     *
+     * @var array
+     */
+    protected $additionalFields = [
+        'host',
+        'directorygroups'
+    ];
+    /**
+     * Database -> Class field relationships
+     *
+     * @var array
+     */
+    protected $databaseFieldClassRelationships = [
+        'Host' => [
+            'id',
+            'hostID',
+            'host'
+        ],
+        'DirectoryGroups' => [
+            'id',
+            'directorygroupsID',
+            'directorygroups'
+        ]
+    ];
+    /**
+     * Return the associated directory group.
+     *
+     * @return object
+     */
+    public function getDirectoryGroups()
+    {
+        return $this->get('directorygroups');
+    }
+    /**
+     * Return the associated host.
+     *
+     * @return host
+     */
+    public function getHost()
+    {
+        return $this->get('host');
+    }
+}
diff --git a/directorygroups/src/Managers/DirectoryDomainManager.php b/directorygroups/src/Managers/DirectoryDomainManager.php
new file mode 100644
index 0000000..5f843a8
--- /dev/null
+++ b/directorygroups/src/Managers/DirectoryDomainManager.php
@@ -0,0 +1,109 @@
+<?php
+/**
+ * Directory domain manager.
+ *
+ * PHP version 7
+ *
+ * @category DirectoryDomainManager
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Managers;
+
+/**
+ * Directory domain manager.
+ *
+ * The table is created and dropped by DirectoryGroupsManager, which owns the
+ * plugin's whole schema, so one install and one uninstall cover all three
+ * tables.
+ *
+ * @category DirectoryDomainManager
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class DirectoryDomainManager extends \FOG\Base\FOGManagerController
+{
+    /**
+     * The base table name.
+     *
+     * @var string
+     */
+    public $tablename = 'directoryDomains';
+    /**
+     * The create statement for the domain table.
+     *
+     * @return string
+     */
+    public function createSql()
+    {
+        return $this->createTableSql(
+            $this->tablename,
+            true,
+            [
+                'ddID',
+                'ddName',
+                'ddDesc',
+                'ddCreatedBy',
+                'ddCreatedTime',
+                'ddURI',
+                'ddBindDN',
+                'ddBindPwd',
+                'ddCACert',
+                'ddBaseDN',
+                'ddOUBase'
+            ],
+            [
+                'INTEGER',
+                'VARCHAR(255)',
+                'LONGTEXT',
+                'VARCHAR(40)',
+                'TIMESTAMP',
+                'VARCHAR(255)',
+                'VARCHAR(255)',
+                'LONGTEXT',
+                'VARCHAR(255)',
+                'VARCHAR(255)',
+                'VARCHAR(255)'
+            ],
+            [
+                false,
+                false,
+                false,
+                false,
+                false,
+                false,
+                false,
+                false,
+                false,
+                false,
+                false
+            ],
+            [
+                false,
+                false,
+                false,
+                false,
+                'CURRENT_TIMESTAMP',
+                false,
+                false,
+                false,
+                false,
+                false,
+                false
+            ],
+            [
+                'ddID',
+                'ddName'
+            ],
+            'InnoDB',
+            'utf8',
+            'ddID',
+            'ddID'
+        );
+    }
+}
diff --git a/directorygroups/src/Managers/DirectoryGroupsAssociationManager.php b/directorygroups/src/Managers/DirectoryGroupsAssociationManager.php
new file mode 100644
index 0000000..cd9146f
--- /dev/null
+++ b/directorygroups/src/Managers/DirectoryGroupsAssociationManager.php
@@ -0,0 +1,84 @@
+<?php
+/**
+ * OU association manager class.
+ *
+ * PHP version 5
+ *
+ * @category DirectoryGroupsAssociationManager
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Managers;
+
+/**
+ * OU association manager class.
+ *
+ * @category DirectoryGroupsAssociationManager
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class DirectoryGroupsAssociationManager extends \FOG\Base\FOGManagerController
+{
+    /**
+     * The base table name.
+     *
+     * @var string
+     */
+    public $tablename = 'directoryOUAssoc';
+    /**
+     * Returns the CREATE TABLE (IF NOT EXISTS) statement for this table.
+     *
+     * Non-destructive and safe to re-run. Used as a step in DirectoryGroupsManager::schema().
+     *
+     * @return string
+     */
+    public function createSql()
+    {
+        return $this->createTableSql(
+            $this->tablename,
+            true,
+            [
+                'doaID',
+                'doaOUID',
+                'doaHostID'
+            ],
+            [
+                'INTEGER',
+                'INTEGER',
+                'INTEGER'
+            ],
+            [
+                false,
+                false,
+                false
+            ],
+            [
+                false,
+                false,
+                false
+            ],
+            [
+                'doaID',
+                'doaHostID'
+            ],
+            'InnoDB',
+            'utf8',
+            'doaID',
+            'doaID'
+        );
+    }
+    /**
+     * Install our table non-destructively.
+     *
+     * @return bool
+     */
+    public function install()
+    {
+        return self::$DB->query($this->createSql());
+    }
+}
diff --git a/directorygroups/src/Managers/DirectoryGroupsManager.php b/directorygroups/src/Managers/DirectoryGroupsManager.php
new file mode 100644
index 0000000..b13ef4c
--- /dev/null
+++ b/directorygroups/src/Managers/DirectoryGroupsManager.php
@@ -0,0 +1,333 @@
+<?php
+/**
+ * OU manager mass management class
+ *
+ * PHP version 5
+ *
+ * @category DirectoryGroupsManager
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Managers;
+
+/**
+ * OU manager mass management class
+ *
+ * @category DirectoryGroupsManager
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class DirectoryGroupsManager extends \FOG\Base\FOGManagerController
+{
+    /**
+     * The base table name.
+     *
+     * @var string
+     */
+    public $tablename = 'directoryOUs';
+    /**
+     * Returns the CREATE TABLE (IF NOT EXISTS) statement for this table.
+     *
+     * Non-destructive and safe to re-run. Used as a step in schema().
+     *
+     * @return string
+     */
+    public function createSql()
+    {
+        return $this->createTableSql(
+            $this->tablename,
+            true,
+            [
+                'doID',
+                'doName',
+                'doDesc',
+                'doCreatedBy',
+                'doCreatedTime',
+                'doDN',
+                'doDomainID'
+            ],
+            [
+                'INTEGER',
+                'VARCHAR(255)',
+                'LONGTEXT',
+                'VARCHAR(40)',
+                'TIMESTAMP',
+                'VARCHAR(255)',
+                'INTEGER'
+            ],
+            [
+                false,
+                false,
+                false,
+                false,
+                false,
+                false,
+                true
+            ],
+            [
+                false,
+                false,
+                false,
+                false,
+                'CURRENT_TIMESTAMP',
+                false,
+                false
+            ],
+            [
+                'doID',
+                'doName'
+            ],
+            'InnoDB',
+            'utf8',
+            'doID',
+            'doID'
+        );
+    }
+    /**
+     * The plugin's ordered, append-only schema migration list (all tables).
+     * Append new steps (e.g. "ALTER TABLE `directoryOUs` ADD COLUMN ...") to the END.
+     *
+     * @return array
+     */
+    public function schema()
+    {
+        return [
+            // 0 - the domains first: directoryOUs.doDomainID points at them.
+            (new \FOG\Plugins\DirectoryGroups\Managers\DirectoryDomainManager())->createSql(),
+            // 1
+            $this->createSql(),
+            // 2
+            (new \FOG\Plugins\DirectoryGroups\Managers\DirectoryGroupsAssociationManager())->createSql(),
+            // 3 - carry over what the install already had. Before the keys,
+            // so the sweep below also clears any orphan the ou plugin left.
+            function () {
+                return self::migrate();
+            },
+            // 4 - the plugin's foreign keys.
+            //
+            // fogproject ADR 0031 decision 8: sweep, then add. ADD CONSTRAINT
+            // validates the rows already in the table and answers 1452 if any
+            // of them point at a parent that is gone -- and applyConstraints()
+            // REPORTS a refusal rather than returning it, so an install that
+            // skipped the sweep would succeed while silently not creating the
+            // constraint. The sweep is the precondition for the statement, not
+            // a policy choice.
+            //
+            // Both calls are filtered to this plugin's own group, so neither
+            // can reach another plugin's tables or core's. The relationships
+            // themselves are declared in fogproject's
+            // commons/schema-constraints.php: directoryOUAssoc.doaOUID CASCADE
+            // to `directoryOUs`, directoryOUAssoc.doaHostID CASCADE to
+            // `hosts`, and directoryOUs.doDomainID CASCADE to
+            // `directoryDomains`. One of them points at a core table, and
+            // that map is meant to answer "what points at hosts?" from one
+            // file.
+            //
+            // Once the plugin is released, a later change is APPENDED as a new
+            // step rather than folded into one of these: installdb() SKIPS the
+            // pSchema steps an install has already passed instead of replaying
+            // them, so an edit to an earlier step is invisible to everyone
+            // already past it.
+            //
+            // No sentinel is needed: doaOUID and doaHostID are int(11) NOT NULL
+            // against int(11) parents, and an association row exists only to
+            // name both ends. doDomainID is NULL when an OU belongs to no
+            // domain, never 0.
+            //
+            // Idempotent, and re-run by the unfiltered reconcile after every
+            // core schema update: planConstraints() skips a constraint whose
+            // declaration already matches the map.
+            function () {
+                $res = \FOG\Db\SchemaReconciler::sweepOrphans('directorygroups');
+                if (is_string($res)) {
+                    return $res;
+                }
+                return \FOG\Db\SchemaReconciler::applyConstraints('directorygroups');
+            },
+        ];
+    }
+    /**
+     * Installs the database non-destructively (create-if-absent + apply any
+     * pending additive steps). Does not drop existing data.
+     *
+     * @return bool
+     */
+    public function install()
+    {
+        $res = \FOG\Items\Schema::applyUpdates($this->schema(), 0);
+        return $res['error'] === null;
+    }
+    /**
+     * Uninstalls the database
+     *
+     * @return bool
+     */
+    public function uninstall()
+    {
+        // Children before parents, so a declared key never refuses a drop.
+        (new \FOG\Plugins\DirectoryGroups\Managers\DirectoryGroupsAssociationManager())->uninstall();
+        $res = parent::uninstall();
+        (new \FOG\Plugins\DirectoryGroups\Managers\DirectoryDomainManager())->uninstall();
+        return $res;
+    }
+    /**
+     * Copies the install's existing directory setup into the plugin.
+     *
+     * Two sources, both read-only here:
+     * - the FOG_DIRECTORY_* connection becomes the first domain, so placement
+     *   keeps working the moment the plugin hides those settings;
+     * - the ou plugin's OUs and host links become directory groups, so
+     *   nothing an admin entered there is lost. This has to run while the ou
+     *   plugin is still installed: uninstalling it drops its tables.
+     *
+     * Idempotent. The domain is seeded only into an empty table, and the ou
+     * rows keep their ids, so INSERT IGNORE skips what a previous run copied.
+     * The ou plugin is left installed; retiring it is a separate step.
+     *
+     * @return true|string true, or the database error
+     */
+    public static function migrate()
+    {
+        $res = self::_seedDomain();
+        if (true !== $res) {
+            return $res;
+        }
+        if (!self::_tableExists('ou') || !self::_tableExists('ouAssoc')) {
+            return true;
+        }
+        $statements = [
+            'INSERT IGNORE INTO `directoryOUs`'
+            . ' (`doID`, `doName`, `doDesc`, `doCreatedBy`, `doCreatedTime`, `doDN`)'
+            . ' SELECT `ouID`, `ouName`, `ouDesc`, `ouCreatedBy`, `ouCreatedTime`, `ouDN`'
+            . ' FROM `ou`',
+            // Only links whose both ends still exist; the ou plugin had no
+            // keys for most of its life and can hold orphans.
+            'INSERT IGNORE INTO `directoryOUAssoc` (`doaID`, `doaOUID`, `doaHostID`)'
+            . ' SELECT `oa`.`oaID`, `oa`.`oaOUID`, `oa`.`oaHostID` FROM `ouAssoc` `oa`'
+            . ' JOIN `directoryOUs` `d` ON `d`.`doID` = `oa`.`oaOUID`'
+            . ' JOIN `hosts` `h` ON `h`.`hostID` = `oa`.`oaHostID`'
+        ];
+        foreach ($statements as $sql) {
+            if (false !== self::$DB->query($sql)->error) {
+                return self::$DB->error;
+            }
+        }
+        return self::_linkGroupsToDomains();
+    }
+    /**
+     * Seeds the first domain from the FOG_DIRECTORY_* settings.
+     *
+     * Only into an empty table, and only when a server is configured. The
+     * name is the DNS name the base DN spells (DC=fogad,DC=local is
+     * fogad.local), because that is what hosts carry in ADDomain and what
+     * the connection hook matches on. With no DC= parts to read, the
+     * install's default AD domain name is used instead.
+     *
+     * @return true|string
+     */
+    private static function _seedDomain()
+    {
+        $uri = trim((string)self::getSetting('FOG_DIRECTORY_LDAP_URI'));
+        if ('' === $uri) {
+            return true;
+        }
+        $count = self::$DB->query(
+            'SELECT COUNT(*) AS `c` FROM `directoryDomains`'
+        )->fetch()->get('c');
+        if ((int)$count > 0) {
+            return true;
+        }
+        $baseDN = trim((string)self::getSetting('FOG_DIRECTORY_BASE_DN'));
+        $name = self::dnToDomain($baseDN)
+            ?: trim((string)self::getSetting('FOG_AD_DEFAULT_DOMAINNAME'));
+        if ('' === $name) {
+            return true;
+        }
+        $sql = 'INSERT INTO `directoryDomains`'
+            . ' (`ddName`, `ddDesc`, `ddCreatedBy`, `ddURI`, `ddBindDN`,'
+            . ' `ddBindPwd`, `ddCACert`, `ddBaseDN`, `ddOUBase`)'
+            . ' VALUES (:name, :desc, :by, :uri, :bind, :pwd, :ca, :base, :oubase)';
+        $params = [
+            ':name' => $name,
+            ':desc' => 'Copied from the FOG_DIRECTORY_* settings on install.',
+            ':by' => 'fog',
+            ':uri' => $uri,
+            ':bind' => trim((string)self::getSetting('FOG_DIRECTORY_BIND_DN')),
+            // As stored: the item reads it back through decodeStored(), which
+            // accepts every shape the setting does.
+            ':pwd' => (string)self::getSetting('FOG_DIRECTORY_BIND_PASSWORD'),
+            ':ca' => trim((string)self::getSetting('FOG_DIRECTORY_CA_CERT')),
+            ':base' => $baseDN,
+            ':oubase' => ''
+        ];
+        if (false !== self::$DB->query($sql, [], $params)->error) {
+            return self::$DB->error;
+        }
+        return true;
+    }
+    /**
+     * Gives each copied group with no domain the domain its DN is under.
+     *
+     * @return true|string
+     */
+    private static function _linkGroupsToDomains()
+    {
+        $domains = self::$DB->query(
+            'SELECT `ddID` AS `id`, `ddName` AS `name` FROM `directoryDomains`'
+        )->fetch(\PDO::FETCH_ASSOC, 'fetch_all')->get();
+        foreach ((array)$domains as $domain) {
+            $root = 'DC=' . implode(',DC=', array_filter(explode('.', (string)$domain['name']), 'strlen'));
+            // The column's collation is case-insensitive, as DNs are.
+            $sql = 'UPDATE `directoryOUs` SET `doDomainID` = :id'
+                . ' WHERE `doDomainID` IS NULL AND `doDN` LIKE :suffix';
+            $params = [
+                ':id' => (int)$domain['id'],
+                ':suffix' => '%,' . addcslashes($root, '%_\\')
+            ];
+            if (false !== self::$DB->query($sql, [], $params)->error) {
+                return self::$DB->error;
+            }
+        }
+        return true;
+    }
+    /**
+     * The DNS name a DN's DC= parts spell, or ''.
+     *
+     * @param string $dn e.g. OU=Sales,DC=fogad,DC=local
+     *
+     * @return string e.g. fogad.local
+     */
+    public static function dnToDomain($dn)
+    {
+        $labels = [];
+        foreach (explode(',', (string)$dn) as $rdn) {
+            $rdn = trim($rdn);
+            if (0 === stripos($rdn, 'DC=')) {
+                $labels[] = substr($rdn, 3);
+            }
+        }
+        return strtolower(implode('.', $labels));
+    }
+    /**
+     * Is there a table of this name in FOG's database?
+     *
+     * @param string $table the table
+     *
+     * @return bool
+     */
+    private static function _tableExists($table)
+    {
+        $count = self::$DB->query(
+            'SELECT COUNT(*) AS `c` FROM `information_schema`.`TABLES`'
+            . ' WHERE `TABLE_SCHEMA` = DATABASE() AND `TABLE_NAME` = :table',
+            [],
+            [':table' => $table]
+        )->fetch()->get('c');
+        return (int)$count > 0;
+    }
+}
diff --git a/directorygroups/src/Pages/DirectoryDomainManagement.php b/directorygroups/src/Pages/DirectoryDomainManagement.php
new file mode 100644
index 0000000..c0bc92e
--- /dev/null
+++ b/directorygroups/src/Pages/DirectoryDomainManagement.php
@@ -0,0 +1,531 @@
+<?php
+/**
+ * Directory domain management page.
+ *
+ * PHP version 7
+ *
+ * @category DirectoryDomainManagement
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Pages;
+
+use FOG\Plugins\DirectoryGroups\Items\DirectoryDomain;
+use FOG\Plugins\DirectoryGroups\Items\DirectoryGroups;
+use FOG\Plugins\DirectoryGroups\Managers\DirectoryDomainManager;
+
+/**
+ * Directory domain management page.
+ *
+ * Lists the domains FOG places hosts in, edits each one's connection, and
+ * browses a domain's OUs so they can be added as directory groups without
+ * typing a DN.
+ *
+ * @category DirectoryDomainManagement
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class DirectoryDomainManagement extends \FOG\Base\FOGPage
+{
+    /**
+     * The node this page displays from.
+     *
+     * @var string
+     */
+    public $node = 'directorydomain';
+    /**
+     * Initializes the page.
+     *
+     * @param string $name The name to pass in.
+     *
+     * @return void
+     */
+    public function __construct($name = '')
+    {
+        $this->name = _('Directory Domains');
+        parent::__construct($this->name);
+        $this->headerData = [
+            _('Domain'),
+            _('Server URI')
+        ];
+        $this->attributes = [
+            [],
+            []
+        ];
+    }
+    /**
+     * The connection fields, shared by the create form and the General tab.
+     *
+     * The bind password is never rendered back. An empty one on edit keeps
+     * the stored value, so editing any other field cannot wipe it.
+     *
+     * @param array $values the current values, keyed by field
+     * @param bool  $isEdit is this the General tab of an existing domain
+     *
+     * @return array
+     */
+    private function _fields(array $values, $isEdit)
+    {
+        $labelClass = 'col-sm-3 col-form-label';
+        $text = function ($name, $label, $placeholder, $required = false) use ($values, $labelClass) {
+            return [
+                self::makeLabel($labelClass, $name, $label) => self::makeInput(
+                    'form-control',
+                    $name,
+                    $placeholder,
+                    'text',
+                    $name,
+                    $values[$name] ?? '',
+                    $required
+                )
+            ];
+        };
+        return $text('name', _('Domain Name'), 'example.com', true)
+            + [
+                self::makeLabel($labelClass, 'description', _('Description'))
+                => self::makeTextarea(
+                    'form-control',
+                    'description',
+                    _('Description'),
+                    'description',
+                    $values['description'] ?? ''
+                )
+            ]
+            + $text('uri', _('Server URI'), 'ldaps://dc1.example.com:636', true)
+            + $text('bindDN', _('Bind DN'), 'CN=fog-read,CN=Users,DC=example,DC=com')
+            + [
+                self::makeLabel($labelClass, 'bindPwd', _('Bind Password'))
+                => self::makeInput(
+                    'form-control',
+                    'bindPwd',
+                    $isEdit ? _('Leave blank to keep the current password') : '',
+                    'password',
+                    'bindPwd',
+                    ''
+                )
+            ]
+            + $text('caCert', _('CA Certificate Path'), '/etc/ssl/certs/example-ca.pem')
+            + $text('baseDN', _('Computer Search Base'), 'DC=example,DC=com')
+            + $text('ouBase', _('OU Browse Base'), _('Blank starts at the domain root'));
+    }
+    /**
+     * The posted connection fields, trimmed.
+     *
+     * The password is the exception: it is used as typed.
+     *
+     * @return array
+     */
+    private static function _posted()
+    {
+        $out = [];
+        foreach (['name', 'description', 'uri', 'bindDN', 'caCert', 'baseDN', 'ouBase'] as $key) {
+            $out[$key] = trim((string)filter_input(INPUT_POST, $key));
+        }
+        $out['name'] = strtolower($out['name']);
+        $out['bindPwd'] = (string)filter_input(INPUT_POST, 'bindPwd');
+        return $out;
+    }
+    /**
+     * Throws when the posted name is taken by another domain.
+     *
+     * @param string $name the posted name
+     * @param int    $id   the domain being edited, or 0
+     *
+     * @throws \Exception
+     * @return void
+     */
+    private static function _assertNameFree($name, $id = 0)
+    {
+        if ((new DirectoryDomainManager())->exists($name, $id)) {
+            throw new \Exception(_('A domain already exists with this name!'));
+        }
+    }
+    /**
+     * The create form's fields.
+     *
+     * @return array
+     */
+    protected function _addFields()
+    {
+        return $this->_fields(self::_posted(), false);
+    }
+    /**
+     * Create new domain.
+     *
+     * @return void
+     */
+    public function add()
+    {
+        $this->renderAddForm(
+            'directorydomain',
+            _('Create New Domain'),
+            'DIRECTORYDOMAIN_ADD_FIELDS',
+            'DirectoryDomain'
+        );
+    }
+    /**
+     * Create new domain, in a modal.
+     *
+     * @return void
+     */
+    public function addModal()
+    {
+        $this->renderAddModalForm(
+            'directorydomain',
+            'DIRECTORYDOMAIN_ADD_FIELDS',
+            'DirectoryDomain'
+        );
+    }
+    /**
+     * Actually create the domain.
+     *
+     * @return void
+     */
+    public function addPost()
+    {
+        $this->handleAddPost(
+            'DirectoryDomain',
+            'DIRECTORYDOMAIN_ADD',
+            _('Domain added!'),
+            _('Domain Create Success'),
+            _('Domain Create Fail'),
+            function (&$serverFault) {
+                $in = self::_posted();
+                self::_assertNameFree($in['name']);
+                $Domain = new DirectoryDomain();
+                foreach ($in as $key => $value) {
+                    $Domain->set($key, $value);
+                }
+                if (!$Domain->save()) {
+                    $serverFault = true;
+                    throw new \Exception(_('Add domain failed!'));
+                }
+                return $Domain;
+            }
+        );
+    }
+    /**
+     * The General tab.
+     *
+     * @return void
+     */
+    public function directorydomainGeneral()
+    {
+        $values = [];
+        foreach (['name', 'description', 'uri', 'bindDN', 'caCert', 'baseDN', 'ouBase'] as $key) {
+            $values[$key] = filter_input(INPUT_POST, $key) ?: $this->obj->get($key);
+        }
+        $fields = $this->_fields($values, true);
+
+        $buttons = self::makeButton(
+            'general-send',
+            _('Update'),
+            'btn btn-primary float-end'
+        );
+        $buttons .= self::makeButton(
+            'general-delete',
+            _('Delete'),
+            'btn btn-danger float-start'
+        );
+
+        self::$HookManager->processEvent(
+            'DIRECTORYDOMAIN_GENERAL_FIELDS',
+            [
+                'fields' => &$fields,
+                'buttons' => &$buttons,
+                'DirectoryDomain' => &$this->obj
+            ]
+        );
+        $rendered = self::formFields($fields);
+        unset($fields);
+
+        echo self::makeFormTag(
+            '',
+            'directorydomain-general-form',
+            self::makeTabUpdateURL(
+                'directorydomain-general',
+                $this->obj->get('id')
+            ),
+            'post',
+            'application/x-www-form-urlencoded',
+            true
+        );
+        echo '<div class="card">';
+        echo '<div class="card-body">';
+        echo $rendered;
+        echo '</div>';
+        echo '<div class="card-footer">';
+        echo $buttons;
+        echo $this->deleteModal();
+        echo '</div>';
+        echo '</div>';
+        echo '</form>';
+    }
+    /**
+     * Saves the General tab.
+     *
+     * @return void
+     */
+    public function directorydomainGeneralPost()
+    {
+        $in = self::_posted();
+        self::_assertNameFree($in['name'], $this->obj->get('id'));
+        if ('' === $in['bindPwd']) {
+            unset($in['bindPwd']);
+        }
+        foreach ($in as $key => $value) {
+            $this->obj->set($key, $value);
+        }
+    }
+    /**
+     * The Organizational Units tab.
+     *
+     * The tree itself is fetched by the browser from getOUs, so opening the
+     * domain does not wait on the directory.
+     *
+     * @return void
+     */
+    public function directorydomainOUs()
+    {
+        $buttons = '';
+        if (\FOG\Auth\Authorization::can('directorygroups.create')) {
+            $buttons = self::makeButton(
+                'directorydomain-ous-send',
+                _('Add selected as groups'),
+                'btn btn-primary float-end'
+            );
+        }
+        echo '<div class="card">';
+        echo '<div class="card-header"><h4 class="card-title">';
+        echo \Initiator::e($this->obj->browseBase());
+        echo '</h4></div>';
+        echo '<div class="card-body">';
+        echo '<table id="directorydomain-ous-table"'
+            . ' class="table table-bordered table-striped"'
+            . ' data-domain-id="' . (int)$this->obj->get('id') . '"'
+            . ' data-update-url="' . \Initiator::e(
+                self::makeTabUpdateURL('directorydomain-ous', $this->obj->get('id'))
+            ) . '">';
+        echo '<thead><tr><th></th><th>' . _('OU') . '</th>'
+            . '<th>' . _('Distinguished Name') . '</th>'
+            . '<th>' . _('Group') . '</th></tr></thead>';
+        echo '</table>';
+        echo '</div>';
+        echo '<div class="card-footer">';
+        echo $buttons;
+        echo '</div>';
+        echo '</div>';
+    }
+    /**
+     * Adds the selected OUs as directory groups.
+     *
+     * A DN that already has a group is skipped, not duplicated, so a repeat
+     * of the same selection changes nothing. Only DNs the directory lists
+     * under this domain's browse base are accepted: the post names DNs, and
+     * this is what stops a hand-built one from becoming a group.
+     *
+     * @throws \Exception
+     * @return void
+     */
+    public function directorydomainOUsPost()
+    {
+        if (!\FOG\Auth\Authorization::can('directorygroups.create')) {
+            throw new \Exception(_('You may not create directory groups.'));
+        }
+        $wanted = array_flip(array_map('strtolower', array_map(
+            'trim',
+            (array)filter_input(INPUT_POST, 'ous', FILTER_DEFAULT, FILTER_REQUIRE_ARRAY)
+        )));
+        if (!$wanted) {
+            throw new \Exception(_('No OU selected.'));
+        }
+        $existing = self::_groupsByDN();
+        foreach ($this->obj->listOUs() as $ou) {
+            $key = strtolower($ou['dn']);
+            if (!isset($wanted[$key]) || isset($existing[$key])) {
+                continue;
+            }
+            $Group = (new DirectoryGroups())
+                ->set('name', self::groupName($this->obj->get('name'), $ou['dn']))
+                ->set('description', '')
+                ->set('ou', $ou['dn'])
+                ->set('domainID', $this->obj->get('id'));
+            if (!$Group->save()) {
+                throw new \Exception(_('Add group failed!'));
+            }
+        }
+    }
+    /**
+     * The group name for an OU: the domain, then the OU path from the top.
+     *
+     * OU names repeat across a tree ("Computers" under every site), so the
+     * bare name cannot be the group name. fogad.local/Sales/Staging is
+     * unique and reads in the order an admin navigates.
+     *
+     * @param string $domain the domain name
+     * @param string $dn     the OU's DN
+     *
+     * @return string
+     */
+    public static function groupName($domain, $dn)
+    {
+        $path = [];
+        foreach (self::_rdns($dn) as $rdn) {
+            if (0 === stripos($rdn, 'OU=')) {
+                array_unshift($path, substr($rdn, 3));
+            }
+        }
+        return $domain . '/' . implode('/', $path);
+    }
+    /**
+     * A DN's components, leaf first.
+     *
+     * Through FOGLdap's own splitter, which honors an escaped comma
+     * (OU=Smith\, John); a plain explode would cut that name in two.
+     *
+     * @param string $dn the DN
+     *
+     * @return string[]
+     */
+    private static function _rdns($dn)
+    {
+        $out = [];
+        $dn = (string)$dn;
+        while ('' !== $dn) {
+            $out[] = \FOG\Net\FOGLdap::rdn($dn);
+            $dn = \FOG\Net\FOGLdap::parentDn($dn);
+        }
+        return $out;
+    }
+    /**
+     * Group ids keyed by lowercased DN.
+     *
+     * @return array<string,int>
+     */
+    private static function _groupsByDN()
+    {
+        $out = [];
+        foreach ((array)\FOG\Router\Route::getIds('directorygroups', [], ['id', 'ou']) as $row) {
+            $row = (array)$row;
+            $out[strtolower((string)$row['ou'])] = (int)$row['id'];
+        }
+        return $out;
+    }
+    /**
+     * The domain's OUs, as JSON, for the tree and the host browser.
+     *
+     * Each row says whether a group already exists for it, so the tree can
+     * mark the OUs that are already grouped.
+     *
+     * @return void
+     */
+    public function getOUs()
+    {
+        header('Content-type: application/json');
+        try {
+            $groups = self::_groupsByDN();
+            $base = count(self::_rdns($this->obj->browseBase()));
+            $rows = [];
+            foreach ($this->obj->listOUs() as $ou) {
+                $rows[] = [
+                    'dn' => $ou['dn'],
+                    'name' => $ou['name'],
+                    'depth' => max(0, count(self::_rdns($ou['dn'])) - $base),
+                    'groupID' => $groups[strtolower($ou['dn'])] ?? 0
+                ];
+            }
+            $this->jsonSend(
+                \FOG\Router\HTTPResponseCodes::HTTP_SUCCESS,
+                json_encode([
+                    'domain' => $this->obj->get('name'),
+                    'data' => $rows
+                ])
+            );
+        } catch (\Exception $e) {
+            $this->jsonSend(
+                \FOG\Router\HTTPResponseCodes::HTTP_BAD_REQUEST,
+                json_encode([
+                    'error' => $e->getMessage(),
+                    'title' => _('Cannot read the directory')
+                ])
+            );
+        }
+    }
+    /**
+     * The domains, as JSON, for the host browser's domain picker.
+     *
+     * @return void
+     */
+    public function getDomains()
+    {
+        header('Content-type: application/json');
+        $rows = [];
+        foreach ((array)\FOG\Router\Route::getIds('directorydomain', [], ['id', 'name']) as $row) {
+            $row = (array)$row;
+            $rows[] = ['id' => (int)$row['id'], 'name' => (string)$row['name']];
+        }
+        $this->jsonSend(
+            \FOG\Router\HTTPResponseCodes::HTTP_SUCCESS,
+            json_encode(['data' => $rows])
+        );
+    }
+    /**
+     * Present the domain to edit.
+     *
+     * @return void
+     */
+    public function edit()
+    {
+        $tabData = [];
+        $tabData[] = [
+            'name' => _('General'),
+            'id' => 'directorydomain-general',
+            'generator' => function () {
+                $this->directorydomainGeneral();
+            }
+        ];
+        $tabData[] = [
+            'name' => _('Organizational Units'),
+            'id' => 'directorydomain-ous',
+            'generator' => function () {
+                $this->directorydomainOUs();
+            }
+        ];
+        $this->renderEditTabs($tabData, $this->obj);
+    }
+    /**
+     * Saves the tab that was posted.
+     *
+     * @return void
+     */
+    public function editPost()
+    {
+        $this->handleEditPost(
+            'DirectoryDomain',
+            'DIRECTORYDOMAIN_EDIT',
+            _('Domain updated!'),
+            _('Domain Update Success'),
+            _('Domain Update Fail'),
+            function (&$serverFault) {
+                global $tab;
+                switch ($tab) {
+                    case 'directorydomain-general':
+                        $this->directorydomainGeneralPost();
+                        break;
+                    case 'directorydomain-ous':
+                        $this->directorydomainOUsPost();
+                        return;
+                }
+                if (!$this->obj->save()) {
+                    $serverFault = true;
+                    throw new \Exception(_('Domain update failed!'));
+                }
+            }
+        );
+    }
+}
diff --git a/directorygroups/src/Pages/DirectoryGroupsManagement.php b/directorygroups/src/Pages/DirectoryGroupsManagement.php
new file mode 100644
index 0000000..d052741
--- /dev/null
+++ b/directorygroups/src/Pages/DirectoryGroupsManagement.php
@@ -0,0 +1,425 @@
+<?php
+/**
+ * OU management page.
+ *
+ * PHP version 5
+ *
+ * @category DirectoryGroupsManagement
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @author   Lee Rowlett <nah@nah.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Pages;
+
+/**
+ * OU management page.
+ *
+ * @category DirectoryGroupsManagement
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @author   Lee Rowlett <nah@nah.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class DirectoryGroupsManagement extends \FOG\Base\FOGPage
+{
+    /**
+     * The node this page operates on.
+     *
+     * @var string
+     */
+    public $node = 'directorygroups';
+    /**
+     * Initializes the OU management page.
+     *
+     * @param string $name Something to lay it out as.
+     *
+     * @return void
+     */
+    public function __construct($name = '')
+    {
+        $this->name = _('OU Management');
+        parent::__construct($this->name);
+        $this->headerData = [
+            _('OU Name'),
+            _('OU DN')
+        ];
+        $this->attributes = [
+            [],
+            []
+        ];
+    }
+    /**
+     * Builds the create-form fields (shared by add() and addModal()).
+     *
+     * @return array
+     */
+    protected function _addFields()
+    {
+        $ou = filter_input(INPUT_POST, 'ou');
+        $description = filter_input(INPUT_POST, 'description');
+        $oudn = filter_input(INPUT_POST, 'oudn');
+
+        $labelClass = 'col-sm-3 col-form-label';
+
+        return [
+            self::makeLabel(
+                $labelClass,
+                'ou',
+                _('OU Name')
+            ) => self::makeInput(
+                'form-control ouname-input',
+                'ou',
+                _('OU Name'),
+                'text',
+                'ou',
+                $ou,
+                true
+            ),
+            self::makeLabel(
+                $labelClass,
+                'description',
+                _('OU Description')
+            ) => self::makeTextarea(
+                'form-control oudescription-input',
+                'description',
+                _('OU Description'),
+                'description',
+                $description
+            ),
+            self::makeLabel(
+                $labelClass,
+                'oudn',
+                _('OU DN')
+            ) => self::makeInput(
+                'form-control oudn-input',
+                'oudn',
+                'ou=computers,dc=example,dc=com',
+                'text',
+                'oudn',
+                $oudn,
+                true
+            )
+        ];
+    }
+    /**
+     * Creates new item.
+     *
+     * @return void
+     */
+    public function add()
+    {
+        $this->renderAddForm(
+            'directorygroups',
+            _('Create New OU'),
+            'DIRECTORYGROUPS_ADD_FIELDS',
+            'DirectoryGroups'
+        );
+    }
+    /**
+     * Creates new item.
+     *
+     * @return void
+     */
+    public function addModal()
+    {
+        $this->renderAddModalForm(
+            'directorygroups',
+            'DIRECTORYGROUPS_ADD_FIELDS',
+            'DirectoryGroups'
+        );
+    }
+    /**
+     * Actually create the ou.
+     *
+     * @return void
+     */
+    public function addPost()
+    {
+        $this->handleAddPost(
+            'DirectoryGroups',
+            'DIRECTORYGROUPS_ADD',
+            _('OU added!'),
+            _('OU Create Success'),
+            _('OU Create Fail'),
+            function (&$serverFault) {
+                $ou = trim(
+                    filter_input(INPUT_POST, 'ou')
+                );
+                $description = trim(
+                    filter_input(INPUT_POST, 'description')
+                );
+                $oudn = trim(
+                    filter_input(INPUT_POST, 'oudn')
+                );
+                $exists = (new \FOG\Plugins\DirectoryGroups\Managers\DirectoryGroupsManager())
+                    ->exists($ou);
+                if ($exists) {
+                    throw new \Exception(
+                        _('An ou already exists with this name!')
+                    );
+                }
+                $OU = (new \FOG\Plugins\DirectoryGroups\Items\DirectoryGroups())
+                    ->set('name', $ou)
+                    ->set('description', $description)
+                    ->set('ou', $oudn);
+                if (!$OU->save()) {
+                    $serverFault = false;
+                    throw new \Exception(_('Add ou failed!'));
+                }
+                return $OU;
+            }
+        );
+    }
+    /**
+     * Displays the ou general tab.
+     *
+     * @return void
+     */
+    public function directorygroupsGeneral()
+    {
+        $ou = (
+            filter_input(INPUT_POST, 'ou') ?:
+            $this->obj->get('name')
+        );
+        $description = (
+            filter_input(INPUT_POST, 'description') ?:
+            $this->obj->get('description')
+        );
+        $oudn = (
+            filter_input(INPUT_POST, 'oudn') ?:
+            $this->obj->get('ou')
+        );
+
+        $labelClass = 'col-sm-3 col-form-label';
+
+        $fields = [
+            self::makeLabel(
+                $labelClass,
+                'ou',
+                _('OU Name')
+            ) => self::makeInput(
+                'form-control ouname-input',
+                'ou',
+                _('OU Name'),
+                'text',
+                'ou',
+                $ou,
+                true
+            ),
+            self::makeLabel(
+                $labelClass,
+                'description',
+                _('OU Description')
+            ) => self::makeTextarea(
+                'form-control oudescription-input',
+                'description',
+                _('OU Description'),
+                'description',
+                $description
+            ),
+            self::makeLabel(
+                $labelClass,
+                'oudn',
+                _('OU DN')
+            ) => self::makeInput(
+                'form-control oudn-input',
+                'oudn',
+                'ou=computers,dc=example,dc=com',
+                'text',
+                'oudn',
+                $oudn,
+                true
+            )
+        ];
+
+        $buttons = self::makeButton(
+            'general-send',
+            _('Update'),
+            'btn btn-primary float-end'
+        );
+        $buttons .= self::makeButton(
+            'general-delete',
+            _('Delete'),
+            'btn btn-danger float-start'
+        );
+
+        self::$HookManager->processEvent(
+            'DIRECTORYGROUPS_GENERAL_FIELDS',
+            [
+                'fields' => &$fields,
+                'buttons' => &$buttons,
+                'DirectoryGroups' => &$this->obj
+            ]
+        );
+        $rendered = self::formFields($fields);
+        unset($fields);
+
+        echo self::makeFormTag(
+            '',
+            'directorygroups-general-form',
+            self::makeTabUpdateURL(
+                'directorygroups-general',
+                $this->obj->get('id')
+            ),
+            'post',
+            'application/x-www-form-urlencoded',
+            true
+        );
+        echo '<div class="card">';
+        echo '<div class="card-body">';
+        echo $rendered;
+        echo '</div>';
+        echo '<div class="card-footer">';
+        echo $buttons;
+        echo $this->deleteModal();
+        echo '</div>';
+        echo '</div>';
+        echo '</form>';
+    }
+    /**
+     * Actually update the general information.
+     *
+     * @return void
+     */
+    public function directorygroupsGeneralPost()
+    {
+        self::checkAuthAndCSRF();
+        $ou = trim(
+            filter_input(INPUT_POST, 'ou')
+        );
+        $description = trim(
+            filter_input(INPUT_POST, 'description')
+        );
+        $oudn = trim(
+            filter_input(INPUT_POST, 'oudn')
+        );
+
+        $exists = (new \FOG\Plugins\DirectoryGroups\Managers\DirectoryGroupsManager())
+            ->exists($ou);
+        if ($ou != $this->obj->get('name')
+            && $exists
+        ) {
+            throw new \Exception(
+                _('An OU already exists with this name!')
+            );
+        }
+        $this->obj
+            ->set('name', $ou)
+            ->set('description', $description)
+            ->set('ou', $oudn);
+    }
+    /**
+     * Present the host membership tab.
+     *
+     * @return void
+     */
+    public function directorygroupsHosts()
+    {
+        $this->renderAssocTab(
+            'directorygroups-host',
+            _('OU Host Associations'),
+            _('Host Name'),
+            'host'
+        );
+    }
+    /**
+     * Update host membership.
+     *
+     * @return void
+     */
+    public function directorygroupsHostPost()
+    {
+        $this->assocPost('addHost', 'removeHost');
+    }
+    /**
+     * Present the ou to edit the page.
+     *
+     * @return void
+     */
+    public function edit()
+    {
+        $tabData = [];
+
+        // General
+        $tabData[] = [
+            'name' => _('General'),
+            'id' => 'directorygroups-general',
+            'generator' => function () {
+                $this->directorygroupsGeneral();
+            }
+        ];
+
+        // Hosts
+        $tabData[] = [
+            'tabs' => [
+                'name' => _('Associations'),
+                'tabData' => [
+                    [
+                        'name' => _('Host Association'),
+                        'id' => 'directorygroups-host',
+                        'generator' => function () {
+                            $this->directorygroupsHosts();
+                        }
+                    ]
+                ]
+            ]
+        ];
+        $this->renderEditTabs($tabData, $this->obj);
+    }
+    /**
+     * Actually update the ou.
+     *
+     * @return void
+     */
+    public function editPost()
+    {
+        $this->handleEditPost(
+            'DirectoryGroups',
+            'DIRECTORYGROUPS_EDIT',
+            _('OU updated!'),
+            _('OU Update Success'),
+            _('OU Update Fail'),
+            function (&$serverFault) {
+                global $tab;
+                switch ($tab) {
+                    case 'directorygroups-general':
+                        $this->directorygroupsGeneralPost();
+                        break;
+                    case 'directorygroups-host':
+                        $this->directorygroupsHostPost();
+                }
+                if (!$this->obj->save()) {
+                    $serverFault = true;
+                    throw new \Exception(_('OU update failed!'));
+                }
+            }
+        );
+    }
+    /**
+     * OU -> host membership list
+     *
+     * @return void
+     */
+    public function getHostsList()
+    {
+        return $this->assocItemsList(
+            'host',
+            'directorygroupsassociation',
+            'directoryOUAssoc',
+            '`hosts`.`hostID`',
+            '`directoryOUAssoc`.`doaHostID`',
+            '`directoryOUAssoc`.`doaOUID`',
+            [
+                [
+                    'db' => 'directoryOUAssoc',
+                    'dt' => 'association',
+                    'removeFromQuery' => true
+                ]
+            ]
+        );
+    }
+}
diff --git a/directorygroups/src/Reports/DirectoryGroups_Report.php b/directorygroups/src/Reports/DirectoryGroups_Report.php
new file mode 100644
index 0000000..d2a009b
--- /dev/null
+++ b/directorygroups/src/Reports/DirectoryGroups_Report.php
@@ -0,0 +1,80 @@
+<?php
+/**
+ * OU report.
+ *
+ * PHP Version 5
+ *
+ * @category DirectoryGroups_Report
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+
+namespace FOG\Plugins\DirectoryGroups\Reports;
+
+/**
+ * OU report.
+ *
+ * @category DirectoryGroups_Report
+ * @package  FOGProject
+ * @author   Tom Elliott <tommygunsster@gmail.com>
+ * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
+ * @link     https://fogproject.org
+ */
+class DirectoryGroups_Report extends \FOG\Pages\ReportManagement
+{
+    /**
+     * The page to display.
+     *
+     * @return void
+     */
+    public function file()
+    {
+        $this->title = self::reportTitle();
+
+        $this->headerData = [
+            _('OU Name'),
+            _('Description'),
+            _('Created By'),
+            _('Created Time'),
+            _('OU DN')
+        ];
+        $this->attributes = [
+            [],
+            [],
+            [],
+            [],
+            []
+        ];
+
+        echo '<div class="card">';
+        echo '<div class="card-header">';
+        echo '<h4 class="card-title">';
+        echo $this->title;
+        echo '</h4>';
+        echo '<p class="form-text">';
+        echo _('Use the selector to choose how many items you want exported');
+        echo '</p>';
+        echo '</div>';
+        echo '<div class="card-body">';
+        echo $this->render(12, 'directorygroups-report-table');
+        echo '</div>';
+        echo '</div>';
+    }
+    /**
+     * The rows this report serves.
+     *
+     * Split from the emit so the grid and the "CSV (All)" export run the
+     * same query -- ReportManagement::exportAll() serves this, and cannot
+     * take back control from a getList() that exits.
+     *
+     * @return array
+     */
+    protected function reportRows()
+    {
+        \FOG\Router\Route::listem('directorygroups');
+
+        return (array) json_decode(\FOG\Router\Route::getData(), true);
+    }
+}
diff --git a/tests/fk-writes-are-null-not-zero.test.php b/tests/fk-writes-are-null-not-zero.test.php
index 60ee374..ae56379 100644
--- a/tests/fk-writes-are-null-not-zero.test.php
+++ b/tests/fk-writes-are-null-not-zero.test.php
@@ -84,6 +84,9 @@
     'laHostID' => ['location', 'LocationAssociation', 'hostID'],
     'oaOUID' => ['ou', 'OUAssociation', 'ouID'],
     'oaHostID' => ['ou', 'OUAssociation', 'hostID'],
+    'doaOUID' => ['directorygroups', 'DirectoryGroupsAssociation', 'directorygroupsID'],
+    'doaHostID' => ['directorygroups', 'DirectoryGroupsAssociation', 'hostID'],
+    'doDomainID' => ['directorygroups', 'DirectoryGroups', 'domainID'],
     'sgGroupID' => ['subnetgroup', 'SubnetGroup', 'groupID'],
     // satellite / junction, ldap
     'lgServerID' => ['ldap', 'LDAPGroup', 'serverID'],
diff --git a/tests/foreign-keys-applied-per-plugin.test.php b/tests/foreign-keys-applied-per-plugin.test.php
index 3779684..c147fc1 100644
--- a/tests/foreign-keys-applied-per-plugin.test.php
+++ b/tests/foreign-keys-applied-per-plugin.test.php
@@ -54,6 +54,7 @@
 $expected = [
     'location' => 'location/src/Managers/LocationManager.php',
     'ou' => 'ou/src/Managers/OUManager.php',
+    'directorygroups' => 'directorygroups/src/Managers/DirectoryGroupsManager.php',
     'windowskey' => 'windowskey/src/Managers/WindowsKeyManager.php',
     'ldap' => 'ldap/src/Managers/LDAPManager.php',
     'oidc' => 'oidc/src/Managers/OIDCManager.php',
diff --git a/tests/group-push-became-mass-edit.test.php b/tests/group-push-became-mass-edit.test.php
index 1c42f81..64e6be4 100644
--- a/tests/group-push-became-mass-edit.test.php
+++ b/tests/group-push-became-mass-edit.test.php
@@ -148,6 +148,13 @@ function check($label, $cond)
         'assoc' => 'ouassociation',
         'col'   => 'ouID',
     ],
+    [
+        'file'  => 'directorygroups/src/Hooks/AddDirectoryGroupsHost.php',
+        'class' => 'FOG\Plugins\DirectoryGroups\Hooks\AddDirectoryGroupsHost',
+        'key'   => 'directorygroups',
+        'assoc' => 'directorygroupsassociation',
+        'col'   => 'directorygroupsID',
+    ],
 ];
 
 foreach ($cases as $case) {
@@ -230,6 +237,7 @@ function check($label, $cond)
         \FOG\Base\Hook::$classes = [
             'LocationAssociationManager' => $manager,
             'OUAssociationManager' => $manager,
+            'DirectoryGroupsAssociationManager' => $manager,
         ];
         if (isset($action['invalid'])) {
             \FOG\Base\Hook::$classes['Location'] = function ($id) {
@@ -240,6 +248,8 @@ function check($label, $cond)
             };
             \FOG\Base\Hook::$classes['OU'] =
                 \FOG\Base\Hook::$classes['Location'];
+            \FOG\Base\Hook::$classes['DirectoryGroups'] =
+                \FOG\Base\Hook::$classes['Location'];
         }
         $hostIDs = [1, 2, 3];
         $actions = [$key => $action];
diff --git a/tests/plugin-id-columns-are-classified.test.php b/tests/plugin-id-columns-are-classified.test.php
index e551c45..fd4c211 100644
--- a/tests/plugin-id-columns-are-classified.test.php
+++ b/tests/plugin-id-columns-are-classified.test.php
@@ -57,6 +57,7 @@
     'ldapUserGrant.lugID', 'location.lID', 'locationAssoc.laID', 'ntfy.nID',
     'oidcGroupRoleAssoc.ograID', 'oidcGroupUserGroupAssoc.ogugID',
     'oidcIdentity.oiID', 'oidcUserGrant.ougID', 'ou.ouID', 'ouAssoc.oaID',
+    'directoryOUs.doID', 'directoryOUAssoc.doaID', 'directoryDomains.ddID',
     'pushbullet.pID', 'slack.sID', 'subnetgroup.sgID', 'windowsKeys.wkID',
     'windowsKeysAssoc.wkaID', 'wolbroadcast.wbID',
 ];
@@ -69,6 +70,8 @@
     'locationAssoc.laLocationID', 'locationAssoc.laHostID',
     'location.lStorageGroupID', 'location.lStorageNodeID',
     'ouAssoc.oaOUID', 'ouAssoc.oaHostID',
+    'directoryOUAssoc.doaOUID', 'directoryOUAssoc.doaHostID',
+    'directoryOUs.doDomainID',
     'windowsKeysAssoc.wkaImageID', 'windowsKeysAssoc.wkaKeyID',
     'LDAPGroups.lgServerID', 'ldapGroupRoleAssoc.lgraGroupID',
     'ldapGroupRoleAssoc.lgraRoleID', 'ldapGroupUserGroupAssoc.lgugGroupID',