OU empty count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Organizational units · All checks

Run this check

Invoke-Maester -TestId AD-OU-04

Overview

• Empty Organizational Units (OUs that contain no users, groups, or computers) represent directory clutter that can:
  • Create confusion: Administrators may wonder if the OU has a purpose or if it can be deleted
  • Complicate navigation: Empty OUs make the directory structure harder to browse and understand
  • Accumulate over time: OUs created for temporary purposes or abandoned projects often remain indefinitely
  • Impact Group Policy: Empty OUs with linked GPOs may still be processed during policy refresh
• While empty OUs don’t pose a direct security risk, they indicate opportunities for directory cleanup and maintenance. Regular cleanup of empty OUs helps maintain an organized, efficient directory structure.

Control Type

Detective

Security Recommendation

• Periodically review and clean up empty Organizational Units:

  • Identify OUs that serve no current purpose
  • Check if empty OUs have Group Policy links that should be removed
  • Verify that empty OUs aren’t placeholders for future use
  • Document any empty OUs that should be retained and why
  • Delete empty OUs that are no longer needed

• Consider establishing a regular cleanup schedule (quarterly or annually) to keep the directory organized.

How the Test Works

• This test retrieves all Organizational Units from Active Directory and:
  • Checks each OU for the presence of user objects
  • Checks each OU for the presence of group objects
  • Checks each OU for the presence of computer objects
  • Counts OUs that contain none of these object types
  • Reports the percentage of OUs that are empty

Related Tests

• Test-MtAdOuEmptyDetails - Provides detailed list of all empty OUs
• Test-MtAdOuStaleCount - Identifies OUs not modified since before 2020
• Test-MtAdGroupEmptyNonPrivilegedCount - Identifies empty non-privileged groups

Details

Every attribute of this check

Field	Value
Test ID	AD-OU-04
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Organizational units
Area	Infrastructure hardening
Resource type	OrganizationalUnit
MITRE ATT&CK	None
PowerShell test	Test-MtAdOuEmptyCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:computer:ReadProperty, ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:organizationalUnit:ReadProperty, ActiveDirectory:Ldap:user:ReadProperty

Source

• Test: tests/ad/ou/Test.AD-OU-04.ps1
• Documentation: tests/ad/ou/Test.AD-OU-04.md