Skip to content
MitoMito Docs

AD-OU-04: OU empty count should be retrievable
ID AD-OU-04
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Organizational units
Security area Infrastructure hardening
Resource type OrganizationalUnit
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”
  • Empty Organizational Units (OUs that contain no users, groups, or computers) represent directory clutter that can:
    • Create confusion: Administrators may wonder if the OU has a purpose or if it can be deleted
    • Complicate navigation: Empty OUs make the directory structure harder to browse and understand
    • Accumulate over time: OUs created for temporary purposes or abandoned projects often remain indefinitely
    • Impact Group Policy: Empty OUs with linked GPOs may still be processed during policy refresh
  • While empty OUs don’t pose a direct security risk, they indicate opportunities for directory cleanup and maintenance. Regular cleanup of empty OUs helps maintain an organized, efficient directory structure.

Control Type

Section titled “Control Type”

Detective

Security Recommendation

Section titled “Security Recommendation”

  • Periodically review and clean up empty Organizational Units:

    • Identify OUs that serve no current purpose
    • Check if empty OUs have Group Policy links that should be removed
    • Verify that empty OUs aren’t placeholders for future use
    • Document any empty OUs that should be retained and why
    • Delete empty OUs that are no longer needed

  • Consider establishing a regular cleanup schedule (quarterly or annually) to keep the directory organized.

How the Test Works

Section titled “How the Test Works”
  • This test retrieves all Organizational Units from Active Directory and:
    • Checks each OU for the presence of user objects
    • Checks each OU for the presence of group objects
    • Checks each OU for the presence of computer objects
    • Counts OUs that contain none of these object types
    • Reports the percentage of OUs that are empty
Section titled “Related Tests”
  • Test-MtAdOuEmptyDetails - Provides detailed list of all empty OUs
  • Test-MtAdOuStaleCount - Identifies OUs not modified since before 2020
  • Test-MtAdGroupEmptyNonPrivilegedCount - Identifies empty non-privileged groups

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.