OU at domain root count should be retrievable

AD-OU-02InfoActive DirectoryOrganizational units

Part of Active Directory · Active Directory · Organizational units · All checks

Invoke-Maester -TestId AD-OU-02

Overview

The structure of Organizational Units at the domain root level reveals important information about your Active Directory organization and management approach.
Directory hierarchy: A large number of root-level OUs may indicate a flat structure that lacks organizational depth
Management complexity: Many root-level OUs can make the directory harder to navigate and manage
Delegation planning: Understanding root-level OUs helps with planning administrative delegation boundaries
Organizational alignment: The OU structure should reflect your organization’s logical structure
A well-designed OU hierarchy typically has fewer root-level OUs with meaningful nested structures beneath them, rather than many OUs all at the root level.

Operational

Consider implementing a hierarchical OU structure that:
- Minimizes the number of OUs at the domain root (typically 5-10 major containers)
- Groups related OUs under parent containers (e.g., by geography, department, or function)
- Makes the directory easier to navigate and manage
- Supports your Group Policy and delegation strategy

This test retrieves all Organizational Units from Active Directory and:
- Identifies the domain’s distinguished name
- Counts OUs that are direct children of the domain root
- Lists all root-level OUs with their distinguished names

Every attribute of this check

Field	Value
Test ID	AD-OU-02
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Organizational units
Area	Infrastructure hardening
Resource type	OrganizationalUnit
MITRE ATT&CK	None
PowerShell test	Test-MtAdOuAtDomainRootCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:domainDNS.distinguishedName:ReadProperty, ActiveDirectory:Ldap:organizationalUnit:ReadProperty