How to Delete a Protected OU in Active Directory

As your organization’s logical layout changes, you may need to delete OUs in Active Directory (AD) from your domain controllers. In this post, we’ll show you two different ways to delete protected OUs (Organizational Units) and what minor roadblocks you may come across while doing so.

Why you cannot delete protected OU in Active Directory

There are two main situations where the deletion of an organizational unit in just one step isn’t possible.

Protection from accidental deletion is enabled

When you try to delete an OU in Active Directory Users and Computers (ADUC), you may run into the following error message telling you that you don’t have sufficient privileges to delete Domain Windows Computers, or that the object is protected from accidental deletion. I’ll explain how to circumvent this limitation later.

An OU is referred to as a ‘default’ OU

The second situation that may prevent you from deleting an OU/ is when you’re trying to delete is what’s referred to as a ‘default’ OU. These are OUs that were either installed as default when Active Directory Domain Services (AD DS) was installed and configured (Computers, Users), or were modified to carry the ‘default’ attribute post-installation.

You should also make sure that you’re seeing ‘all’ the objects in your directory – Click View in ADUC and make sure Advanced Features is checked.

Delete a protected OU in Active Directory in 3 easy steps

The process to delete a protected OU in Active Directory is straightforward. Here are the steps you need to follow.

1. Open Active Directory Users and Computers, right-click on the OU you wish to delete and click Properties.
2. Click the Object tab and clear the ‘Protect object from accidental deletion,’ then click OK.

3. Right-click on the OU, click Delete, and click Yes. Voila! The protected OU is no more.

Delete a protected OU in Active Directory using PowerShell

I’m always looking for ways to boost my efficiency as an IT Pro, especially with PowerShell. We previously covered how to move and delete Active Directory OUs with PowerShell on Petri, but let me show you how to use PowerShell to remove a protected OUs in one fell swoop.

For this example, we’ll be removing our protected ‘Member Computers’ OU with three PowerShell commands:

• The first cmdlet we’ll use, Get-ADOrganizationlUnit, identifies the specific OU and holds it in memory, so to speak.
• The second cmdlet, Set-ADObject, removes the flag for ‘Protect object from accidental deletion.’
• The final cmdlet, Remove-ADOrganizationalUnit, deletes the OU and suppresses any confirmation prompts. Incidentally, the ‘-PassThru‘ switch tells the final cmdlet to reference the object already specified (our OU).

Get-ADOrganizationalUnit -identity "OU=Member Computers,DC=Reinders,DC=local" | Set-ADObject -ProtectedFromAccidentalDeletion:$false -PassThru | Remove-ADOrganizationalUnit -Confirm:$false

After the command is run and we’ve made a refresh in ADUC, the ‘Member Computers’ OU is history!

Summary

We’ve just explained a few scenarios many IT pros can run into on a daily basis when trying to remove OUs from Active Directory. We’ve described the two most prevalent reasons you may run into when trying to delete protected OUs, and we described two different methods you can use to get the job done.

Please let me know if you have any questions or comments by leaving one below. Thank you for reading!