How to Delete Protected OU in Active Directory?

6.2K

By default, AD protects new Organizational Units from accidental deletion. When you create a new Organizational Unit in Active Directory Users and Computers, the “Protect container from accidental deletion” option is enabled by default.

Before deleting an OU, you may encounter an “Access is denied” error in PowerShell:

Remove-ADOrganizationalUnit `
-Identity "OU=California,OU=US,DC=contoso,DC=com"

Remove-ADOrganizationalUnit : Access is denied
+ CategoryInfo : PermissionDenied: UnauthorizedAccessException

“Access is denied” error can be caused by several different factors, including:

• The Organizational Unit is protected from accidental deletion
• There are insufficient permissions on the OU (missing Active Directory rights)
• Explicit “Deny” permissions (Deny ACE in the security descriptor)
• Inherited permissions from a parent container that block deletion
• The administrative rights are missing or insufficient delegated
• The OU contains protected child objects

Note. The Domain Controllers container is an OU and is created with accidental-deletion protection enabled by default. Other default AD objects (such as Users, Computers, and Builtin) are containers rather than OUs and are handled differently in AD.

Disabling OU deletion protection through the ADUC console

You can disable OU deletion protection through the ADUC console:

1. Run the dsa.msc snap-in;
2. Enable View > Advanced Features in the top menu;
3. Find the OU in the Active Directory tree and open its properties;
4. Go to the Object tab and uncheck the option Protect object from accidental deletion;

   

5. Now you can delete or move this OU.

Remove Accidental Deletion Protection and Delete an OU Using PowerShell

You can also remove accidental deletion protection from an OU using PowerShell.

This protection works by adding explicit Deny permissions for Delete and Delete Subtree to the object’s security descriptor. These ACEs prevent accidental deletion even for users who normally have sufficient permissions. That’s why even delegated admins can’t delete the object until the protection flag is removed.

Before disabling the protection, you can check the current state of the ProtectedFromAccidentalDeletion attribute:

$ou = "OU=California,OU=US,DC=contoso,DC=com"

Get-ADOrganizationalUnit `
-Identity $ou `
-Properties ProtectedFromAccidentalDeletion |
Select-Object DistinguishedName,ProtectedFromAccidentalDeletion

If the value of ProtectedFromAccidentalDeletion is True, the OU is protected from accidental deletion and this protection must be removed before deleting the object.

The following commands remove the accidental deletion protection flag and delete the OU:

$ou = "OU=California,OU=US,DC=contoso,DC=com"

# Disable accidental deletion protection
Set-ADOrganizationalUnit `
-Identity $ou `
-ProtectedFromAccidentalDeletion $false

# Delete the OU
# Works only if the OU is empty
Remove-ADOrganizationalUnit `
-Identity $ou

Deleting an OU that contains objects

By default, Remove-ADOrganizationalUnit can only delete empty Organizational Units. If the OU contains users, computers, groups, or child OUs, the deletion will fail with an error:

The directory service can perform the requested operation only on a leaf object

This error means that the OU contains one or more child objects. AD only allows deletion of leaf objects. Before deleting a non-empty OU, you must remove or move all child objects first. AD does not allow deletion of Organizational Units that contain users, computers, groups, or child OUs.

Safe deletion script for Active Directory OUs

The following script example is an option in case you want to perform additional safety checks before deleting AD objects.

Our example below prevents accidental removal of critical containers and requires explicit confirmation:

$ou = "OU=California,OU=US,DC=contoso,DC=com"
$ouCompare = $ou.ToLower()

# Safety check: block critical Active Directory containers
# Extend this list according to your environment before using the script.

$protectedObjects = @(
    "ou=domain controllers,dc=contoso,dc=com",
    "cn=users,dc=contoso,dc=com",
    "cn=computers,dc=contoso,dc=com",
    "cn=system,dc=contoso,dc=com"
)

if ($protectedObjects -contains $ouCompare) {
    throw "This Active Directory container is protected and cannot be modified by this script."
}

# Step 1: explicit confirmation gate
$confirm = Read-Host "Type DELETE to remove OU"

if ($confirm -eq "DELETE") {

    # Step 2: remove accidental deletion protection
    Set-ADOrganizationalUnit `
        -Identity $ou `
        -ProtectedFromAccidentalDeletion $false

    # Step 3: verify protection state
    $protection = (Get-ADOrganizationalUnit `
        -Identity $ou `
        -Properties ProtectedFromAccidentalDeletion
    ).ProtectedFromAccidentalDeletion

    if ($protection -eq $false) {
        # Step 4: delete the OU
        # -Confirm:$false is safe here because the script already requires
        # explicit confirmation above.
        Remove-ADOrganizationalUnit `
            -Identity $ou `
            -Confirm:$false
    }
    else {
        throw "Accidental deletion protection is still enabled. The OU was not deleted."
    }
}
else {
    Write-Host "Deletion cancelled. The OU was not modified."
}

Note. This safety check only prevents accidental changes to objects listed in the script. It is not a complete protection mechanism for all AD system containers. You should avoid modifying/deleting objects in partitions such as Configuration and Schema unless you fully understand the impact.

Also note that the script works only if the target OU is empty. If the OU contains child objects, they must be removed/moved beforehand.

Find OUs without accidental deletion protection

Get-ADOrganizationalUnit `
-Filter 'ProtectedFromAccidentalDeletion -eq $false' |
Select-Object DistinguishedName

You can protect from accidental deletion not only OUs, but also other types of objects in Active Directory: users, computer accounts, and groups.

Find protected OUs in Active Directory

In order to find Organizational Units that are protected from accidental deletion, use the following command:

Get-ADOrganizationalUnit `
-Filter 'ProtectedFromAccidentalDeletion -eq $true' |
Select-Object DistinguishedName

This command returns all OUs where accidental deletion protection is enabled.

Enabling Accidental Deletion Protection Using PowerShell

To re-enable accidental deletion protection for an Organizational Unit, run the following command:

Set-ADOrganizationalUnit `
-Identity "OU=California,OU=US,DC=contoso,DC=com" `
-ProtectedFromAccidentalDeletion $true

Now the OU is protected from accidental deletion. Attempts to delete or move the Organizational Unit will fail until the protection flag is removed.