# OU overlapping name count should be retrievable

This test identifies OUs that share the same name but exist in different locations within the directory.

Source: https://maester.dev/docs/tests/AD-OU-01

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Organizational units · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-OU-01
```

## Overview

- Organizational Units with overlapping (duplicate) names can create administrative confusion and operational risks in Active Directory:
- Administrative errors: Administrators may inadvertently apply Group Policies, permissions, or settings to the wrong OU when multiple OUs share the same name
- Scripting complications: Automation scripts that reference OUs by name may target incorrect containers
- Policy application issues: Group Policy links may be applied to unintended OUs
- Audit confusion: Security audits and compliance reports become harder to interpret when OU names are ambiguous
- While Active Directory technically allows duplicate OU names (as long as they're in different locations), this practice should be minimized to reduce operational risk.

#### Control Type

**Operational**

#### Security Recommendation
- Review OUs with duplicate names and consider renaming them to be more descriptive and unique. Use naming conventions that incorporate location, function, or department to make OU names unambiguous. For example:

- Instead of multiple "Users" OUs, use "NYC-Users", "LA-Users", "London-Users"
- Instead of multiple "Servers" OUs, use "Production-Servers", "Test-Servers", "Dev-Servers"

#### How the Test Works

- This test retrieves all Organizational Units from Active Directory and:
- Groups OUs by their Name property
- Identifies names that appear more than once
- Counts the number of duplicate name groups
- Lists all OUs that share names with other OUs

#### Related Tests
- `Test-MtAdOuAtDomainRootCount` - Analyzes OU structure at the domain root level
- `Test-MtAdOuEmptyCount` - Identifies OUs that contain no objects

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-OU-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Organizational units |
| Area | Infrastructure hardening |
| Resource type | OrganizationalUnit |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdOuOverlappingNameCount](https://github.com/maester365/maester/blob/main/tests/ad/ou/Test.AD-OU-01.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:organizationalUnit:ReadProperty |

</details>

## Source

- Test: [`tests/ad/ou/Test.AD-OU-01.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/ou/Test.AD-OU-01.ps1)
- Documentation: [`tests/ad/ou/Test.AD-OU-01.md`](https://github.com/maester365/maester/blob/main/tests/ad/ou/Test.AD-OU-01.md)