AD-OU-01: OU overlapping name count should be retrievable
| ID | AD-OU-01 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Organizational units |
| Security area | Infrastructure hardening |
| Resource type | OrganizationalUnit |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”- Organizational Units with overlapping (duplicate) names can create administrative confusion and operational risks in Active Directory:
- Administrative errors: Administrators may inadvertently apply Group Policies, permissions, or settings to the wrong OU when multiple OUs share the same name
- Scripting complications: Automation scripts that reference OUs by name may target incorrect containers
- Policy application issues: Group Policy links may be applied to unintended OUs
- Audit confusion: Security audits and compliance reports become harder to interpret when OU names are ambiguous
- While Active Directory technically allows duplicate OU names (as long as they’re in different locations), this practice should be minimized to reduce operational risk.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”-
Review OUs with duplicate names and consider renaming them to be more descriptive and unique. Use naming conventions that incorporate location, function, or department to make OU names unambiguous. For example:
-
Instead of multiple “Users” OUs, use “NYC-Users”, “LA-Users”, “London-Users”
-
Instead of multiple “Servers” OUs, use “Production-Servers”, “Test-Servers”, “Dev-Servers”
How the Test Works
Section titled “How the Test Works”- This test retrieves all Organizational Units from Active Directory and:
- Groups OUs by their Name property
- Identifies names that appear more than once
- Counts the number of duplicate name groups
- Lists all OUs that share names with other OUs
Related Tests
Section titled “Related Tests”Test-MtAdOuAtDomainRootCount- Analyzes OU structure at the domain root levelTest-MtAdOuEmptyCount- Identifies OUs that contain no objects
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.