How to Create Organizational Units and Protect Them from Accidental Deletion
Applies to: Windows Server 2019, 2022 and 2025.
OUs should represent policy and delegation boundaries instead of duplicating every department chart.
Active Directory changes affect authentication across the environment. Use tested backups, separate privileged accounts and a maintenance plan. See networkmanager.info for managed Windows VPS services.
Prerequisites
- Design names and parent paths.
- Separate users, computers, servers and privileged objects.
- Use delegated credentials.
- Leave domain controllers in their dedicated OU.
Procedure
Step 1: Load the module
Use a controller or RSAT workstation.
Import-Module ActiveDirectoryStep 2: Read the domain DN
Capture the path.
Get-ADDomain | Select DistinguishedNameStep 3: Create the parent
Enable deletion protection.
New-ADOrganizationalUnit -Name 'Servers' -Path 'DC=corp,DC=example' -ProtectedFromAccidentalDeletion $trueStep 4: Create a child
Add a workload OU.
New-ADOrganizationalUnit -Name 'Application Servers' -Path 'OU=Servers,DC=corp,DC=example' -ProtectedFromAccidentalDeletion $trueStep 5: Review policy and delegation
Check inheritance before moving objects.
Verification
List the structure and protection state.
Get-ADOrganizationalUnit -Filter * -SearchBase 'OU=Servers,DC=corp,DC=example' -Properties ProtectedFromAccidentalDeletion | Select Name,DistinguishedName,ProtectedFromAccidentalDeletionRollback and recovery
Move dependent objects and unlink policies before approved deletion. Remove protection only during that change.
Operational notes
An OU is not a security boundary; combine it with permissions, groups and administrative tiering.
Official references
Explore managed Windows Server hosting from Netcloud24 Canada.
