Deleting OUs in Active Directory Users and Computers

active-directoryou

I need to delete few Organizational units in Active Directory users and computers that were created for testing purposes.

When I try to delete them, following error occurred:
“You don’t have sufficient privileges to delete TestDevs, or this object is protected from accidental deletion.”
I am logged on as domain admin and I guess I do have sufficient privileges to delete OU.

I tried to change properties of OU, but I don’t see anything except “General”, “Managed by” and “COM+” tab in OU properties – no options for un-protecting object from deletion.

Do you have any suggestions?

Best Answer

To un-protect object from accidental deletion, you need to un-check proper box in “Object” tab in OU properties. In order to see this tab, you need to configure the ADUC by going to the View option on the toolbar, and then check “Advanced Features”.

This will add some new containers and tabs in OU properties. In “Object” tab in OU properties you will see check box “Protect object from accidental deletion” – un-check the box and you should be able to delete OU.

Related Solutions

C# – Validate a username and password against Active Directory

If you work on .NET 3.5 or newer, you can use the System.DirectoryServices.AccountManagement namespace and easily verify your credentials:

// create a "principal context" - e.g. your domain (could be machine, too)
using(PrincipalContext pc = new PrincipalContext(ContextType.Domain, "YOURDOMAIN"))
{
    // validate the credentials
    bool isValid = pc.ValidateCredentials("myuser", "mypassword");
}

It's simple, it's reliable, it's 100% C# managed code on your end - what more can you ask for? :-)

Read all about it here:

Update:

As outlined in this other SO question (and its answers), there is an issue with this call possibly returning True for old passwords of a user. Just be aware of this behavior and don't be too surprised if this happens :-) (thanks to @MikeGledhill for pointing this out!)

What are the differences between LDAP and Active Directory

Active Directory is a database based system that provides authentication, directory, policy, and other services in a Windows environment

LDAP (Lightweight Directory Access Protocol) is an application protocol for querying and modifying items in directory service providers like Active Directory, which supports a form of LDAP.

Short answer: AD is a directory services database, and LDAP is one of the protocols you can use to talk to it.

Best Answer

Related Solutions

C# – Validate a username and password against Active Directory

What are the differences between LDAP and Active Directory

Related Topic