Unprotect OUs | Technologist.Services

UNPROTECT OUS

[ Active Directory OU Protection Management ]

About This Tool

Unprotect OUs is a PowerShell script that removes accidental deletion protection from multiple Active Directory Organizational Units (OUs) at once. It supports wildcard patterns for flexible bulk operations, making it ideal for cleanup tasks or reorganization projects.

Key Features

Bulk unprotect multiple OUs matching a pattern
Wildcard support for flexible OU name matching
Automatic validation of search base
Skip already unprotected OUs
Detailed summary reporting
Safe and reversible operation

Parameters

-SearchBase (Required) - The distinguished name of the parent OU to search within
-OUName (Required) - The name of the OU(s) to unprotect. Supports wildcards (e.g., 'Deploy*' or '*Printer*')

Usage Examples

Unprotect a specific OU

                .\\unprotectOUs.ps1 -SearchBase "OU=Workstations,OU=Computers,DC=domain,DC=local" -OUName "Deploy Printer Logic"
            

Unprotect all OUs starting with "Deploy"

                .\\unprotectOUs.ps1 -SearchBase "OU=Workstations,OU=Computers,DC=domain,DC=local" -OUName "Deploy*"
            

Unprotect all OUs containing "Printer"

                .\\unprotectOUs.ps1 -SearchBase "OU=Workstations,OU=Computers,DC=domain,DC=local" -OUName "*Printer*"
            

Unprotect ALL OUs under the search base

                .\\unprotectOUs.ps1 -SearchBase "OU=Workstations,OU=Computers,DC=domain,DC=local" -OUName "*"
            

IMPORTANT: This script requires:
- PowerShell with Active Directory module
- Domain Administrator or equivalent permissions
- Elevated PowerShell session (Run as Administrator)

How It Works

Validates the specified search base exists
Searches recursively for OUs matching the name pattern
Checks current protection status of each OU
Skips OUs that are already unprotected
Removes protection from protected OUs
Verifies the change was applied successfully
Provides detailed summary with counts

Output Example

                Searching in: OU=Workstations,OU=Computers,DC=domain,DC=local
Looking for OUs matching: Deploy*
----------------------------------------
Found 5 OU(s) matching 'Deploy*'
----------------------------------------

Processing: OU=Deploy Printers,OU=Workstations,OU=Computers,DC=domain,DC=local
Current Protection Status: True
New Protection Status: False

Processing: OU=Deploy Software,OU=Workstations,OU=Computers,DC=domain,DC=local
Current Protection Status: True
New Protection Status: False

----------------------------------------
Summary:
  Total OUs found: 5
  OUs unprotected: 4
  Already unprotected: 1
            

Common Use Cases

Preparing OUs for deletion during domain reorganization
Bulk removal of temporary deployment OUs
Cleaning up test or staging organizational structures
Preparing for AD migration or consolidation
Removing protection before automated OU management scripts

Safety Notes

This operation is reversible - protection can be re-enabled at any time
The script only removes protection, it does NOT delete OUs
Always test in a non-production environment first
Consider backing up your AD before bulk operations
Review the list of matching OUs before running with wildcard patterns

Download Script

Download unprotectOUs.ps1

← Back to Tools Index