Deleting an OU deletes everything inside it - and the confirmation box is easy to click through. This page covers the protection flag that stops the accident, and the yearly audit that keeps the structure honest.
The scariest dialog in Active Directory is a small one, and it appears after the mistake: deleting an OU deletes every user, computer and group inside it. Microsoft added a seatbelt for exactly this - the Protect object from accidental deletion flag - and it costs nothing to switch on. This page pairs that five-minute protection job with the habit that keeps a directory healthy long-term: a yearly audit of structure, stale accounts and group drift.
New OUs made in the console or by PowerShell usually get this protection by default. Anything older, imported or hand-built must be checked.
With the flag on, the object carries a deny entry that blocks deletion - for everyone, including domain admins, until someone deliberately removes the flag first. That two-step design is the point: a genuine deletion is still possible, but a tired click at 7 pm is not. New OUs created in ADUC or by New-ADOrganizationalUnit get the flag by default; OUs that arrived by migration, scripting tools or old habits often do not.
Turn on Advanced Features in ADUC (View menu) so the Object tab appears, then check each OU's flag and tick the missing ones. For a fleet-wide pass, PowerShell is faster:
Get-ADOrganizationalUnit -Filter * -Properties ProtectedFromAccidentalDeletion | Where-Object { -not $_.ProtectedFromAccidentalDeletion }Set-ADObject -ProtectedFromAccidentalDeletion $trueOnce a year, list accounts that have not signed in for a long stretch: Search-ADAccount -AccountInactive -TimeSpan 180.00:00:00 -UsersOnly. Every name on that list is a question - left, transferred, forgotten service account, or a shared login nobody admits to. Work the list with HR and department heads, disable what is unexplained, and let the leaver routine finish the job. An inactive-but-enabled account is an unlocked door nobody walks past anymore.
Groups drift the same way accounts do. Export each resource group's membership and ask the owner to confirm it - the quarterly habit from the groups guide, done completely once a year. Then read the OU tree itself with fresh eyes: OUs for departments that no longer exist, a staging OU holding antiques, service accounts living in a person's OU. A structure audit is mostly archaeology - removing the layers that describe a company that has already changed.
An audit without a record repeats itself next year. One page is enough: the date, the stale accounts found and what happened to each, the groups whose owners did not reply (chase those first next time), and the structural changes made. Keep it with the OU plan and naming rule from day one, and your directory documentation stays a short, living file instead of a rumour.
The full OU, user and group creation process - live on a real domain controller, step by step.
▶️ Watch Full VideoOpen the Object tab (Advanced Features on), untick Protect object from accidental deletion, apply, and then delete. The deliberate two-step is the entire design - accidents are blocked, intentions are not.
It protects against deletion operations however they arrive, because the deny entry sits on the object itself. It is not a backup, though - it does not help with modified attributes or a damaged database, which is why a real AD backup still matters.
A full pass once a year fits most offices, with the small habits running between audits - the weekly staging check, the quarterly group review, and the leaver routine on the day someone leaves. The yearly audit catches whatever those habits missed.