Active Directory - Viewing and protecting unprotected organizational units with Powershell

To support me, you can subscribe to the channel, share and like the videos, disable your ad blocker or make a donation. Thank you!

Hello,

I presented, in a previous article the Best Practice Analyzer which contains for the Active Directory role a rule that checks if all organisation units are protected against accidental deletion (and moving) but without telling us which ones if it detects any.

Fortunately PowerShell is there to help us quickly list and protect them.

# Show unprotected OUs against accidental deletion.
$OuNotProtected = Get-ADOrganizationalUnit -Filter * -Properties ProtectedFromAccidentalDeletion |
    Where-Object ProtectedFromAccidentalDeletion -eq $false
# Or
$OuNotProtected = Get-ADOrganizationalUnit -Filter * -Properties ProtectedFromAccidentalDeletion |
    Where-Object -FilterScript { $_.ProtectedFromAccidentalDeletion -eq $false }
# Or
$OuNotProtected = Get-ADOrganizationalUnit -Filter * -Properties ProtectedFromAccidentalDeletion |
    Where-Object -FilterScript { !$_.ProtectedFromAccidentalDeletion }

# Display the result in an interactive table
$OuNotProtected | Select-Object -Property Name, DistinguishedName |
    Out-GridView

# Display the result in a CSV
$OuNotProtected | Select-Object -Property Name, DistinguishedName | Out-GridView
    Export-Csv -Path c:\OuNotProtected.csv

# Protect all unprotected OUs
$OuNotProtected | Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $true