Active Directory

Remove Protect Object setting from Organizational Unit via PowerShell

Sometimes when you want to clean up Active Directory by deleting or moving Organizational Units you get Access Denied error.

For a Domain Admin this is quite unusual message. This is related to security option Protect object from accidental deletion.

While you can simply uncheck it, press ok and move one OU it gets much harder if  you've lots and lots of OU's to clean.

Solution

Fortunately one can always look for powershell solution to fix this.

Import-Module activedirectory 

# Path to search in for OU's
$searchbase = "OU=Users,OU=Accounts,OU=Production,DC=test,DC=pl"

# Get all the OU's that are protected
$protectedOrganizationalUnits = Get-ADOrganizationalUnit -searchbase $searchbase -filter * -Properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $true}

# Display OU's that are protected
$protectedOrganizationalUnits | Select DistinguishedName, ProtectedFromAccidentalDeletion, Name

# Disable protection
#$protectedOrganizationalUnits | Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $false

And that's it. Keep in mind the last line of script is disabled so that if you copy paste you have to remove # to make sure it works as required. I usually tend to display things first and uncomment later just to make sure the output is what I expected.

Przemyslaw Klys

System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.

Share
Published by
Przemyslaw Klys

Recent Posts

Active Directory Replication Summary to your Email or Microsoft Teams

Active Directory replication is a critical process that ensures the consistent and up-to-date state of…

2 weeks ago

Syncing Global Address List (GAL) to personal contacts and between Office 365 tenants with PowerShell

Hey there! Today, I wanted to introduce you to one of the small but excellent…

5 months ago

Active Directory Health Check using Microsoft Entra Connect Health Service

Active Directory (AD) is crucial in managing identities and resources within an organization. Ensuring its…

7 months ago

Seamless HTML Report Creation: Harness the Power of Markdown with PSWriteHTML PowerShell Module

In today's digital age, the ability to create compelling and informative HTML reports and documents…

8 months ago

How to Efficiently Remove Comments from Your PowerShell Script

As part of my daily development, I create lots of code that I subsequently comment…

8 months ago

Unlocking PowerShell Magic: Different Approach to Creating ‘Empty’ PSCustomObjects

Today I saw an article from Christian Ritter, "PowerShell: Creating an "empty" PSCustomObject" on X…

9 months ago