Is it safe to rename and remove an OU?

Hello @Grace Yin ,

If you rename an OU , things will remain same apart from the fact that the inherited group policies that you have in the OU hierarchy will not apply to the computer accounts. It seems that you may have an extensive OU structure. If you would like to delete the Workstation OU or rename it you will need to make sure that any GPOs which were applying at the Workstation OU level are linked to the Computer OU becasue you would not want your applied group policies to break for the users computer devices in those OUs. Let me explain you with details.

Lets say we have a directory called MS.LOCAL and have a Computer OU at the root level and then we have Workstation and DEP01 and DEP02 OUs within workstation OUs as per the below structure.

And we want to move DEP01 to Computer OU . There are several group policies applied on these OUs as per the below structure. You can check this in the Group policy management console.

If you go to the Group policy inheritance tab for the OU you want to move (in this case DEP01 ) in Group policy management (command - gpmc.msc) then you can see all the 4 policies being applied on the OU . You can see that GPO-EST-Computer is the policy which applies directly on the DEP01 OU and Default domain policy inherits from Computer OU and Citrix and Global GPO are inherited from Workstation. Let me move DEP01 directly under Computer OU.

When I moved DEP01 to Computer , it will change the list of policies applied to the OUs and this will change the end user experience. AS you can see earlier the policies that were applying on the workstation OU are not being inherited anymore due to change in the OU structure and so the policies associated will also not apply. So As long as you understand what kind of policies you have setup , and if it will affect your users experience or not , you can surely go ahead with the movement.

3

I would suggest you need to check what all policies are setup at the Workstation level and how they affect the user experience. I do not have insights in your environment but I can safely say that you can unlink the policies from Workstation and link it to computer OU and that should be fine. But again there are many types of settings in Group policies and I would suggest you to get in touch with someone who had designed this or review the GPO design document for your AD domain to understand more before making any GPO level change.

Hope the detailed explanation helps. Should you have any further queries , please let us know and we will be happy to help . If the information in the post is helpful , please do accept the post as answer so that it can help other community members searching for similar issues.