How to Get a List of Active Directory Users from a Specific OU

Administrators assign users to specific organizational units in Active Directory to ensure proper management of user accounts. Placing users directly into the appropriate OU during creation guarantees that Group Policies and access permissions are applied correctly. This structured approach helps create a secure and well-organized Active Directory environment that aligns with the organization’s hierarchy and operational goals.

Create an Active Directory user in a specific OU using ADUC

• Open the Active Directory Users and Computers console.
• In the left pane, navigate to the OU where you want to add the user. Then, right-click the OU and click New»User.
• Fill in the user’s details and click Next.
• Enter and confirm the password, choose the required account options, and click Next.
• Review the user details and click Finish to create the user in the specific OU.

Create multiple AD users in a specific OU using PowerShell

Then, run the cmdlet below to add multiple users to a specific organizational unit in bulk. Replace <CsvFilePath> with the location of the CSV file containing user details, and <Yourdomain> with your Active Directory domain name.

$CsvPath = "<CsvFilePath>"; $Domain = "<Yourdomain>" 
Import-Csv $CsvPath | ForEach-Object { 
$UserParams = @{ Name = $_.Name; GivenName = $_.FirstName; Surname = $_.LastName; DisplayName = $_.Name; SamAccountName = $_.Username; UserPrincipalName = "$($_.Username)@$Domain"; Path = $_.OUpath; AccountPassword = (ConvertTo-SecureString $_.Password -AsPlainText -Force); Enabled = $true; ChangePasswordAtLogon = $true }; 
New-ADUser @UserParams 
}

• In the Onboarding Active Directory User agent, provide the required details through a form or CSV file to automatically create the account, enforce password change at next logon, and assign a manager.
• With flexible capabilities, you can pause the workflow, verify changes, instantly roll back specific actions, and fix errors without disrupting the process.

Each organizational unit in Active Directory can have its own set of policies, permissions, and administrative controls tailored to the needs of a particular department or role. As employees transfer to new departments or take on different roles, administrators must move them to the appropriate OU. This ensures they inherit the correct organizational permissions and policies.

Move an Active Directory user from one OU to another in ADUC

• Open the Active Directory Users and Computers console.
• In the left pane, locate the OU you want to move users from.
• Then, right-click the respective user account and click Move.
• In the dialog box, select the destination OU and click OK to move the user.

Move all users from one OU to another using PowerShell

PowerShell provides a faster and more efficient way to move all users from one OU to another than the ADUC console, which can be time-consuming. Run the following cmdlet to transfer all users from one OU to another in a single step.

$SourceOU="<SourceOUName>"
$TargetOU="<TargetOUName>"
Get-ADUser -SearchBase $SourceOU -Filter * | ForEach-Object {
    Move-ADObject -Identity $_.DistinguishedName -TargetPath $TargetOU
}

Replace <SourceOUName> and <TargetOUName> with the distinguished names of the source and target OUs, respectively.

• In addition to robust reporting, AdminDroid’s management capabilities allow you to move users between OUs directly from the report.
• Simply select the users you want to move, click Show Actions, and then choose Move Users. 
• Finally, select the OU where you want to move them and click Update.
• For example, in the never-logged-in users report, you can easily filter and select disabled accounts and move them to the appropriate OU for quarantining.

Inactive user accounts within an organization unit can create security vulnerabilities if left unmanaged, potentially leading to unauthorized access or compliance violations. By identifying these accounts, administrators can take appropriate actions, such as disabling or removing them. This helps enforce proper organizational policies and maintain a clean, well-governed Active Directory environment.

Identify inactive users by last logon date in a designated OU

• Open the Active Directory Users and Computers console.
• Right-click the specific OU in the left pane and select Find.
• Choose Common Queries from the Find drop-down.
• In the Days since last logon field, select the number of inactive days (30, 60, 90, 120, or 180).
• Click Find Now to display the list of inactive users in that OU within the specified period.

Retrieve a list of inactive users from a particular OU using PowerShell

Run the following PowerShell cmdlet to find inactive users from a specific organizational unit. Replace <DistinguishedOUName> with the OU’s distinguished name, <InactiveDays> with the number of inactivity days, and <OutputFilePath> with the path to save the report file.

$OU="<DistinguishedOUname>"
$DaysInactive="<InactiveDays>"
$OutputFile="<OutputFilePath>"
$DateThreshold=(Get-Date).AddDays(-$DaysInactive)
Search-ADAccount -AccountInactive -UsersOnly -SearchBase $OU |
    Where-Object { $_.LastLogonDate -lt $DateThreshold } |
    Select-Object Name,SamAccountName,UserPrincipalName,Enabled,LastLogonDate |
    Export-Csv -Path $OutputFile -NoTypeInformation

The exported CSV file contains details such as user name, SAM account name, user principal name, enabled status, and last logon date.

Note: Users who have never-logged-in will not show a last activity date, as no sign-in activity has been recorded.

• With AdminDroid’s inactive user report, you can easily identify inactive users in each OU.
• It also provides details such as display name, SAM account name, logon name, account status, and more.
• Utilize the hierarchy in the left pane to navigate through each organizational unit and its sub-OUs to view detailed inactive user information.

While it’s important to find users in a specific OU, it’s equally important to obtain a complete list of all users along with their corresponding OUs. With this report, administrators can quickly understand user distribution and identify misplaced or redundant accounts throughout the directory OU structure. It also ensures that users reside in the correct OUs and receive the appropriate permissions.

List all users with their respective organizational unit using PowerShell

Run the cmdlet below to retrieve a list of all users and their respective organizational units.

$Output=@()
$OUs=Get-ADOrganizationalUnit -Filter *
foreach ($OU in $OUs) {
    $Users=Get-ADUser -Filter * -SearchBase $OU.DistinguishedName -SearchScope OneLevel | Select-Object Name,SamAccountName
    foreach ($User in $Users) {
        $Output+=[PSCustomObject]@{
            UserName=$User.Name
            OrganizationalUnit=$OU.Name
            SamAccountName=$User.SamAccountName
            OUPath=$OU.DistinguishedName
        }}}  
$Output | Format-Table -AutoSize

The exported CSV file contains details such as the user name, organizational unit, SAM account name, and OU path.

In Active Directory, administrators often need to grant someone the ability to manage user accounts without giving them full domain-wide privileges. By delegating access for a specific organizational unit, you can allow selected users or groups to manage all user accounts in it. Here are some common scenarios where delegation can be helpful.

Delegate permission for users in a specific OU