How to Delete a Protected OU in Active Directory
As your organization’s logical layout changes, you may need to delete OUs in Active Directory (AD) from your domain controllers. In this post, we’ll show you two different ways to delete protected OUs (Organizational Units) and what minor roadblocks you may come across while doing so.
Table of Contents
Why you cannot delete protected OU in Active Directory
There are two main situations where the deletion of an organizational unit in just one step isn’t possible.
Protection from accidental deletion is enabled
When you try to delete an OU in Active Directory Users and Computers (ADUC), you may run into the following error message telling you that you don’t have sufficient privileges to delete Domain Windows Computers, or that the object is protected from accidental deletion. I’ll explain how to circumvent this limitation later.
An OU is referred to as a ‘default’ OU
The second situation that may prevent you from deleting an OU/ is when you’re trying to delete is what’s referred to as a ‘default’ OU. These are OUs that were either installed as default when Active Directory Domain Services (AD DS) was installed and configured (Computers, Users), or were modified to carry the ‘default’ attribute post-installation.
You should also make sure that you’re seeing ‘all’ the objects in your directory – Click View in ADUC and make sure Advanced Features is checked.
Delete a protected OU in Active Directory in 3 easy steps
The process to delete a protected OU in Active Directory is straightforward. Here are the steps you need to follow.
- Open Active Directory Users and Computers, right-click on the OU you wish to delete and click Properties.
- Click the Object tab and clear the ‘Protect object from accidental deletion,’ then click OK.
- Right-click on the OU, click Delete, and click Yes. Voila! The protected OU is no more.
Delete a protected OU in Active Directory using PowerShell
I’m always looking for ways to boost my efficiency as an IT Pro, especially with PowerShell. We previously covered how to move and delete Active Directory OUs with PowerShell on Petri, but let me show you how to use PowerShell to remove a protected OUs in one fell swoop.
For this example, we’ll be removing our protected ‘Member Computers’ OU with three PowerShell commands:
- The first cmdlet we’ll use, Get-ADOrganizationlUnit, identifies the specific OU and holds it in memory, so to speak.
- The second cmdlet, Set-ADObject, removes the flag for ‘Protect object from accidental deletion.’
- The final cmdlet, Remove-ADOrganizationalUnit, deletes the OU and suppresses any confirmation prompts. Incidentally, the ‘-PassThru‘ switch tells the final cmdlet to reference the object already specified (our OU).
Get-ADOrganizationalUnit -identity "OU=Member Computers,DC=Reinders,DC=local" | Set-ADObject -ProtectedFromAccidentalDeletion:$false -PassThru | Remove-ADOrganizationalUnit -Confirm:$false
After the command is run and we’ve made a refresh in ADUC, the ‘Member Computers’ OU is history!
We’ve just explained a few scenarios many IT pros can run into on a daily basis when trying to remove OUs from Active Directory. We’ve described the two most prevalent reasons you may run into when trying to delete protected OUs, and we described two different methods you can use to get the job done.
Please let me know if you have any questions or comments by leaving one below. Thank you for reading!
More in Active Directory
How to Enable and Use the Active Directory Recycle Bin
Nov 21, 2022 | Michael Reinders
How to Use LAPS to Manage Local Admin Account Passwords in Active Directory and Azure AD
Nov 14, 2022 | Michael Reinders
Zoom Adds New Email and Calendar Products to Improve Collaboration
Nov 9, 2022 | Rabia Noureen
How to List All Users in Active Directory
Nov 7, 2022 | Michael Reinders
Budget for Operational Resilience in 2023
Oct 20, 2022 | Russell Smith
Choosing between 2.4 GHz and 5 GHz Wi-Fi
Oct 17, 2022 | Sukesh Mudrakola
Most popular on petri