OU stale count should be retrievable
AD-OU-03InfoActive DirectoryOrganizational units
Part of Active Directory · Active Directory · Organizational units · All checks
Invoke-Maester -TestId AD-OU-03Overview
Section titled “Overview”- Organizational Units that haven’t been modified since before 2020 may represent:
- Abandoned projects: OUs created for initiatives that were never completed or were abandoned
- Outdated structure: Organizational units that no longer reflect current business structure
- Directory clutter: Unused containers that make the directory harder to navigate
- Potential security gaps: Stale OUs may have outdated permissions or Group Policy links
- While stale OUs don’t pose a direct security threat, they contribute to directory sprawl and can make administration more complex. They may also retain old permissions or Group Policy settings that are no longer appropriate.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Regularly review OUs that haven’t been modified in several years:
- Verify whether the OU is still needed for its original purpose
- Check if the OU contains any objects (see
Test-MtAdOuEmptyCount) - Review permissions and Group Policy links on stale OUs
- Consider deleting or repurposing OUs that are no longer needed
- Document the purpose of OUs to help future cleanup efforts
How the Test Works
Section titled “How the Test Works”- This test retrieves all Organizational Units from Active Directory and:
- Examines the last modified timestamp of each OU
- Counts OUs that haven’t been modified since before January 1, 2020
- Lists stale OUs with their last modification date and distinguished name
Related Tests
Section titled “Related Tests”Test-MtAdOuEmptyCount- Identifies OUs with no objectsTest-MtAdOuEmptyDetails- Provides detailed list of empty OUsTest-MtAdGroupStaleCount- Identifies groups not modified since before 2020
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-OU-03 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Organizational units |
| Area | Infrastructure hardening |
| Resource type | OrganizationalUnit |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdOuStaleCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:organizationalUnit:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/ou/Test.AD-OU-03.ps1 - Documentation:
tests/ad/ou/Test.AD-OU-03.md