AD-OU-02: OU at domain root count should be retrievable


ID	`AD-OU-02`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Organizational units
Security area	Infrastructure hardening
Resource type	OrganizationalUnit
Reads from	On-premises Active Directory

What this checks and how to fix it

The structure of Organizational Units at the domain root level reveals important information about your Active Directory organization and management approach.
Directory hierarchy: A large number of root-level OUs may indicate a flat structure that lacks organizational depth
Management complexity: Many root-level OUs can make the directory harder to navigate and manage
Delegation planning: Understanding root-level OUs helps with planning administrative delegation boundaries
Organizational alignment: The OU structure should reflect your organization’s logical structure
A well-designed OU hierarchy typically has fewer root-level OUs with meaningful nested structures beneath them, rather than many OUs all at the root level.

Operational

Consider implementing a hierarchical OU structure that:
- Minimizes the number of OUs at the domain root (typically 5-10 major containers)
- Groups related OUs under parent containers (e.g., by geography, department, or function)
- Makes the directory easier to navigate and manage
- Supports your Group Policy and delegation strategy

This test retrieves all Organizational Units from Active Directory and:
- Identifies the domain’s distinguished name
- Counts OUs that are direct children of the domain root
- Lists all root-level OUs with their distinguished names

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).