Can I move all the computers in their AD container to an OU?

Question

1. Group Policies: Moving computers to an OU allows you to apply Group Policies (GPOs) specifically to that OU. This is beneficial for managing settings and configurations for the computers.
2. Protected Objects: The default CN=Computers container is a system-protected object. If you redirect the CN=Computers container to an OU, it will no longer be protected, meaning it can be moved, deleted, or renamed.
3. Dependencies: Ensure that no applications or services rely on the computers being in the default CN=Computers container. Some applications may have dependencies on specific security principals being located in default containers.
4. Accidental Deletion: Be cautious, as moving objects to an OU makes them subject to accidental deletions by privileged users, including administrators.

Answer 1

Hello,

I think you have listed the essential steps to do the move. So to answer the question yes you can move computer objects out of the Computer containers

Answer 2

Hi,

Yes, you can move all the computers from an AD container to an OU, however there are several drawbacks to this.

Loss of Granular Control: You lose the ability to apply specific GPOs to different groups of computers, which can limit your ability to manage settings and configurations effectively.

Security Concerns: Moving computers to a less secure container can expose them to broader security risks if the default container is not as tightly controlled as the OU.

Potential Disruptions: There might be disruptions in service or policy application during the move, so careful planning and execution are required.

Best Regards,

Ian Xue

---

If the Answer is helpful, please click "Accept Answer" and upvote it.