Skip to main content

Organizational Units

Synopsis​

Define and manage Organizational Units (OUs) in your Active Directory domain structure.

Description​

This Component allows defining Organizational Units in configuration.

One of the most straightforward Components, there is one thing to note:

It will refuse to delete Organizational Units that should be deleted, so long as they have any content. Instead it will write a warning telling you to clean up.

Example Configuration​

Default definition for the Domain Controllers OU:

[
    {
        "Name":  "Domain Controllers",
        "Description":  "Default container for domain controllers",
        "Path":  "%DomainDN%"
    }
]

The same configuration in psd1 format:

@(
    @{
        Name        = 'Domain Controllers'
        Description = 'Default container for domain controllers'
        Path        = '%DomainDN%'
    }
)

Tools​

Convert all Organizational Units into Json configuration:

Get-ADOrganizationalUnit -Filter * -Properties Description |
    Select-PSFObject @(
        'Name'
        'Description to string'
        @{
            Name = 'Path'
            Expression = {
                $_.DistinguishedName.Split(",",2)[1] -replace 'DC=.+$','%DomainDN%'
            }
        }
    ) | ConvertTo-Json

Properties​

Name​

This parameter uses name resolution.

Name of the OU to register.

Description​

This parameter uses name resolution.

Description for the OU to register.

Path​

This parameter uses name resolution.

The path to where the OU should be.

OldNames​

This parameter uses name resolution.

Previous names the OU had. During invocation, if it is not found but an OU in the same path with a listed old name IS, it will be renamed.

Present​

Optional: Yes | Default: $true

Whether the OU should be present.

Optional​

Optional: Yes | Default: $false

By default, organizational units defined in configuration must exist. Set this to $true to mark the OU as optional — it will not be created if missing, but is tolerated if it exists.

Use this for OUs that may or may not be deployed depending on the environment or context.

BlockGPInheritance​

Optional: Yes | Default: $false

Whether Group Policy inheritance should be blocked on this OU. When $true, GPOs linked to parent OUs will not apply to objects in this OU unless explicitly linked. When $false (default), normal Group Policy inheritance is enabled.