The system container is a domain. It designated as dc=system. This container holds all of the technical and configuration information for your Identity Vault and for the Identity Manager system. The system container holds three main subcontainers:
The admins container holds all of the administrative objects for the Identity Vault and for the User Application. A best practice is to have a separate administrative user object for the User Application and not use the main administrative object for the Identity Vault.
The user padmin.admins.system is the administrative user for the User Application. The main administrative user for the Identity Vault is admin.admins.system.
The server objects have many different objects that are associated with them that must reside in the same container as the server object. As you add more servers into your tree, scrolling through all of those objects can become very cumbersome.
A best practice is to have a separate container for each server object. The name of the container is the name of the server object. All objects associated with the server (volumes, licenses, certificates) are in place and it is much easier to find the objects you need.
This structure is designed for scalability, so if you have 10 or 100 servers, it is easy to find the objects associated with a single server.
Any services that are in the Identity Vault are stored in this container. There are multiple subcontainers for the different services. The driver set objects are stored in the idm container, which is a service subcontainer. The Resource Kit only has one driver set, but this structure allows you to scale by adding more driver sets to the idm container. The work order objects and an Organizational Role are also stored in the services subtree container.