How to delete an OU protected from accidental deletion

Applies to: Active Directory on Windows Server 2008 and later, managed from a domain controller or a PC with RSAT. You need Domain Admins rights or delegated permission to delete objects in that part of the directory.

Why the OU won’t delete

Since Windows Server 2008, OUs created in Active Directory Users and Computers (ADUC) are protected by default. The checkbox isn’t a separate setting; it writes explicit Deny entries for Everyone into the OU’s permissions: Deny Delete and Delete subtree on the OU itself, and Deny Delete all child objects on its parent. Because Deny beats Allow, even Domain Admins get an error until the protection is removed. In ADUC the message says you don’t have sufficient privileges or the object is protected from accidental deletion; PowerShell reports Access is denied.

That is also why the fix is always the same: remove the protection, delete, and (if you are keeping the parent) leave the parent’s own protection in place.

Before you delete: three checks

1. What’s inside. List everything in the OU: Get-ADObject -SearchBase "OU=Sales,DC=contoso,DC=com" -Filter * | Select-Object Name, ObjectClass. Move users, computers and groups you still need to another OU first; deleting an object also deletes its group memberships and SID, and recreating it doesn’t bring those back.
2. Linked GPOs. In the Group Policy Management Console, select the OU and look at Linked Group Policy Objects. Deleting the OU removes the links, not the GPOs, so note them if you plan to link them elsewhere.
3. A way back. Check whether the AD Recycle Bin is on: Get-ADOptionalFeature -Filter 'Name -like "Recycle Bin Feature"'. If EnabledScopes is empty, it is off and a deleted OU can only come back from a backup. Turning it on can’t be undone, so that’s a decision for the domain owner, not something to do in a hurry.

Delete it in Active Directory Users and Computers

1. Open ADUC (dsa.msc).
2. Click View > Advanced Features. Without this, the Object tab is hidden.
3. Right-click the OU and choose Properties.
4. On the Object tab, clear Protect object from accidental deletion and click OK.
5. Right-click the OU, choose Delete and confirm. If it contains objects, ADUC asks whether to delete the OU and everything in it; read that prompt carefully.

If a child OU inside it is also protected, ADUC can stop partway with the same error. Clear the checkbox on that child OU too, or use the PowerShell method below for the whole tree.

Delete it with PowerShell

Run these in PowerShell on a machine with the Active Directory module (a domain controller or a PC with RSAT). Replace the distinguished name with your own.

$ou = "OU=Sales,DC=contoso,DC=com"
Get-ADOrganizationalUnit -Identity $ou -Properties ProtectedFromAccidentalDeletion |
  Select-Object Name, ProtectedFromAccidentalDeletion
Set-ADOrganizationalUnit -Identity $ou -ProtectedFromAccidentalDeletion $false
Remove-ADOrganizationalUnit -Identity $ou

Remove-ADOrganizationalUnit asks for confirmation by default; type Y. Add -WhatIf first if you want to see what it would do without deleting anything. If the OU still contains objects, the command fails with an error that the operation can only be performed on a leaf object.

Deleting an OU that still has objects or child OUs

To delete an OU and everything below it in one step, add -Recursive:

Remove-ADOrganizationalUnit -Identity $ou -Recursive

Be careful with this switch. Microsoft’s documentation says -Recursive also removes child objects marked as protected from accidental deletion. Only the top OU’s protection is checked. So a sub-OU someone protected on purpose is deleted along with its users and computers, with no extra warning. Run the content check from the three checks first and move anything you need.

If you prefer to clear protection on the whole tree and delete it from ADUC instead, this unprotects every OU under (and including) the target:

Get-ADOrganizationalUnit -SearchBase $ou -Filter * |
  Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $false

If you deleted the wrong OU

With the AD Recycle Bin on, deleted objects can be restored with their attributes and group memberships during the deleted-object lifetime (180 days by default in newer forests). Restore the OU first, then its contents, because a child can’t come back before its parent. For example, Get-ADObject -Filter 'Name -eq "Sales"' -IncludeDeletedObjects | Restore-ADObject restores the OU itself. Without the Recycle Bin, you need an authoritative restore from a system state backup, which is a bigger job; plan it before deleting large OUs.

After cleaning up, if a PC that was in the deleted OU can no longer sign in to the domain, see the trust relationship between this workstation and the primary domain failed. A user who gets locked out after being moved may need the account lockout fix.

Related guides

• How to install the Group Policy Management Console on Windows 11
• The trust relationship between this workstation and the primary domain failed
• The referenced account is currently locked out: how to fix it
• How to fix error 0x801c001d (Microsoft Entra hybrid join)

Official sources:

• Microsoft Learn: Set-ADOrganizationalUnit (ProtectedFromAccidentalDeletion)
• Microsoft Learn: Remove-ADOrganizationalUnit (Recursive and protected objects)