OU overlapping name count should be retrievable
AD-OU-01InfoActive DirectoryOrganizational units
Part of Active Directory · Active Directory · Organizational units · All checks
Invoke-Maester -TestId AD-OU-01Overview
Section titled “Overview”- Organizational Units with overlapping (duplicate) names can create administrative confusion and operational risks in Active Directory:
- Administrative errors: Administrators may inadvertently apply Group Policies, permissions, or settings to the wrong OU when multiple OUs share the same name
- Scripting complications: Automation scripts that reference OUs by name may target incorrect containers
- Policy application issues: Group Policy links may be applied to unintended OUs
- Audit confusion: Security audits and compliance reports become harder to interpret when OU names are ambiguous
- While Active Directory technically allows duplicate OU names (as long as they’re in different locations), this practice should be minimized to reduce operational risk.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”-
Review OUs with duplicate names and consider renaming them to be more descriptive and unique. Use naming conventions that incorporate location, function, or department to make OU names unambiguous. For example:
-
Instead of multiple “Users” OUs, use “NYC-Users”, “LA-Users”, “London-Users”
-
Instead of multiple “Servers” OUs, use “Production-Servers”, “Test-Servers”, “Dev-Servers”
How the Test Works
Section titled “How the Test Works”- This test retrieves all Organizational Units from Active Directory and:
- Groups OUs by their Name property
- Identifies names that appear more than once
- Counts the number of duplicate name groups
- Lists all OUs that share names with other OUs
Related Tests
Section titled “Related Tests”Test-MtAdOuAtDomainRootCount- Analyzes OU structure at the domain root levelTest-MtAdOuEmptyCount- Identifies OUs that contain no objects
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-OU-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Organizational units |
| Area | Infrastructure hardening |
| Resource type | OrganizationalUnit |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdOuOverlappingNameCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:organizationalUnit:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/ou/Test.AD-OU-01.ps1 - Documentation:
tests/ad/ou/Test.AD-OU-01.md