Organizational units (OUs) are the containers that give Active Directory (AD) its shape. Administrators create OUs to organize departments, accommodate new devices, and reflect organizational changes. The reason OUs matter is because Group Policy and delegated permissions both attach at the OU level, so where an object lives decides what policy it receives and who can manage it.

This guide shows three ways to create an OU: Using Active Directory Users and Computers (ADUC), with the New-ADOrganizationalUnit cmdlet, and with ADManager Plus. It also covers the prerequisites, bulk creation from a CSV, and what to do once the OU exists.

What is an OU, and why create one?

An OU is a container in AD that holds users, computers, groups, and other OUs. Unlike the default containers such as Users and Computers, an OU can have Group Policy Objects (GPOs) linked directly to it and can have administrative control delegated over it. This makes OUs the primary building block for structuring a domain.

In practice, admins create OUs to:

• Organize objects: Arrange objects by department, location, or function so the directory reflects the organization's structure.
• Apply Group Policy precisely: Link GPOs to an OU so settings reach the appropriate users and computers.
• Delegate administration: Delegate management of objects within an OU to specific administrators or help desk technicians.
• Simplify management: Apply bulk actions, scripts, and reports to all relevant objects within an OU.

Prerequisites

Before creating an OU, make sure you have the right access and tools:

• Permissions: You need membership in Domain Admins, or delegated rights to create OU objects in the target location. In a Microsoft Entra Domain Services managed domain, OU creation instead requires membership in the AAD DC Administrators group.
• Tools: For the graphical method, use Active Directory Users and Computers or Active Directory Administrative Center. These tools are included with Remote Server Administration Tools (RSAT) on Windows 10 and 11 and are available by default on domain controllers (DCs). You can also open them from Server Manager > Tools. Ensure the device can connect to a writable DC.
• PowerShell module: For the scripted route, the ActiveDirectory module must be installed—part of RSAT, or of the AD DS role on a DC.

For the PowerShell method, import the module first by running the following command:

How to create an OU in AD using Active Directory Users and Computers

For single OU creation, ADUC offers a quick way:

1. Open Active Directory Users and Computers: press Win + R, type dsa.msc, and press Enter (or open it from Server Manager > Tools).
2. In the console tree, right-click the domain or the parent OU where the new OU should sit.
3. Choose New > Organizational Unit.
4. Give it a name. Leave Protect container from accidental deletion checked.
5. Click OK. The OU shows up in the console tree.

Note: Nesting works the same way. Right-click the parent OU instead of the domain and repeat. If you prefer a newer interface, the Active Directory Administrative Center (dsac.exe) does the same job.

How to create an OU in AD using PowerShell

When you want something repeatable or scriptable, New-ADOrganizationalUnit creates an OU in a single line. Give it a name and add -Path, which is the distinguished name of the parent that will hold it:

That puts a top-level Sales OU directly under corp.com. For a nested OU, point -Path at the parent OU's distinguished name:

You can fill in attributes in the same call, provide a description and the ManagedBy owner:

Note: New-ADOrganizationalUnit sets ProtectedFromAccidentalDeletion to $true by default. However, this means you can't move or delete the OU until you turn the flag off.
If you don't want it, add -ProtectedFromAccidentalDeletion $false.

Verifying the OU and getting its path

Check that the OU is there, and grab its distinguished name (you'll need it for anything you create inside), with Get-ADOrganizationalUnit:

Creating multiple OUs in bulk from a CSV file

Add the OUs in a CSV with Name and Path columns, one row each, and run them through New-ADOrganizationalUnit:

Note that a parent OU has to exist before its children, so order the CSV top-down (or sort by path depth) before the loop runs, otherwise the child rows will fail.

Creating an OU in Microsoft Entra Domain Services

A Microsoft Entra Domain Services (formerly Azure AD Domain Services) managed domain doesn't give you a DC to log into. Instead, you create custom OUs from a domain-joined management VM, using the same tools, ADUC or New-ADOrganizationalUnit, while signed in as a member of the AAD DC Administrators group. Microsoft owns the built-in AADDC Users and AADDC Computers OUs, but any custom OUs you create for your own objects are yours to manage.

Supported parameters

The following parameters can be used while creating OUs in AD.

Linking a GPO and adding objects to the created OU

An empty OU doesn't do anything yet. Two things usually come next. First, link a Group Policy Object to it, which is how the OU's settings actually reach the users and computers inside. Second, put objects in it. To create a user straight into the new OU, pass the OU's distinguished name as -Path:

Objects that already exist can be moved in with Move-ADObject, or just dragged into place in ADUC.

Limitations of using native tools to create OUs

ADUC and PowerShell both create OUs reliably, but each shows its limits as the directory and the team grow:

• ADUC creates one OU at a time, with no bulk option and no way to apply a standard set of attributes across many OUs.
• PowerShell scripts run only from machines that have the ActiveDirectory module (or the AD DS role) installed, and a script has to be extended or rewritten to add attributes or to handle bulk creation.
• A mistyped -Path silently creates the OU in the wrong place rather than failing, and such errors are hard to spot in a long script.
• Neither native option offers reusable templates for a standardized OU structure, so consistency depends on getting every command right.
• There's no built-in audit trail of who created which OU and when, and no approval step before a bulk creation runs—both common gaps for compliance.

Frequently asked questions