List all empty OUs

Here’s a one-liner you can use to quickly find empty organizational units in your Active Directory:

Get-QADObject -Type organizationalUnit -DontUseDefaultIncludedProperties | 
  where { 
    -not ( Get-QADObject -SearchRoot $_.DN -DontUseDefaultIncludedProperties `
    -SearchScope OneLevel -SizeLimit 1 -WarningAction SilentlyContinue ) 

A quick explanation of what I am doing here:

  1. I am retrieving all organizationalUnit objects from my domain (and use the -DontUseDefaultIncludedProperties switch to save a few milliseconds ;))
  2. Then for each of the OUs I am retrieving all AD objects that are in that OU by doing a Get-QADObject and limiting the search scope to the DN of the current OU.
  3. Note that (like we did when looking for large groups) I am using the -SizeLimit parameter to see if I can get 1 item in the call (all I need is to learn whether there is anything in the OU – I don’t need the whole list) – which obviously makes the whole script magnitudes of time faster. I use -SearchScope
  4. Based on Kirk’s recommendation I am using -SearchScope OneLevel to exclude the OU itself.
  5. I am using -not operator so I get only the OUs for which this Get-QADObject evaluates to $null (nothing found) and thus -not $null evaluates to $true.

P.S. This is the code I was using initially, which I then corrected based on Kirk’s comments below:

$emptyOUs = Get-QADObject -Type organizationalUnit -DontUseDefaultIncludedProperties | where {(Get-QADObject -SearchRoot $_.DN -SizeLimit 2 -DontUseDefaultIncludedProperties).Count -lt 2}

Tags: , , , , , ,


4 Responses to “List all empty OUs”

  1. 1 Poshoholic October 2, 2009 at 1:08 pm

    I think it’s cleaner if you set SizeLimit to 1 and set the -SearchScope parameter to OneLevel. That makes Get-QADObject return only children, not the object itself. Searching for 2 objects in the Where-Object clause seems just odd to me for some reason.

  2. 2 Poshoholic October 2, 2009 at 1:10 pm

    Plus, if you take that approach, you can dump your -gt 2 and have Where-Object simply test for the presence of children.

  3. 3 Dmitry Sotnikov October 2, 2009 at 3:13 pm

    Awesome! Thanks Kirk. I’ll update the post right away!

  1. 1 Dew Drop – October 1, 2009 | Alvin Ashcraft's Morning Dew Trackback on October 1, 2009 at 12:03 pm

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

My Recent Tweets


The posts on this blog are provided “as is” with no warranties and confer no rights. The opinions expressed on this site are mine and mine alone, and do not necessarily represent those of my employer - WSO2 or anyone else for that matter. All trademarks acknowledged.

© 2007-2014 Dmitry Sotnikov

October 2009

%d bloggers like this: