PowerShell script to recursively protect all OUs and Objects from Accidental Deletion

Question

I'm writing a PowerShell script to set the ProtectFromAccidentalDeletion flag to "true" recursively on all OUs, objects, sub-OUs and their objects.

I need every object and "container of objects" within an OU protected against accidental deletion (and all that entails).

The script has a separate line for each OU, each sub-OU, each OU's objects, etc. It is quite long and I feel like I'm defeating the purpose of saving time by writing the script at all.

I use the following command for OUs:

Get-ADOrganizationalUnit -Filter * -SearchBase “ou=OU,ou=rootOU,dc=domain,dc=com” | Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $true

and this for objects:

Get-ADobject -Filter * -SearchBase “ou=OU,ou=rootOU,dc=aemea,dc=kao,dc=com” | Set-ADobject -ProtectedFromAccidentalDeletion $true

Those work fine for the specific OU or objects I'm targeting, but how can I set this value for every object and OU underneath the OU I target?

Thanks in advance for the advice and help, folks!

Answer 1

1. Seems to be overkill; might have spent too much time on it already
2. I think its a bad idea
3. The AD Recycle Bin exists to quickly undelete objects.
4. I think there was probably some logic to not having this be the default on all objects -- and only on container objects.

Try an LDAP filter; include all of the other objectClasses you need.

Get-ADObject -LDAPFilter '(|(objectClass=organizationalUnit)(objectClass=User)(objectClass=Computer))' 

Or you can go hog wild:

Get-ADObject -LDAPFilter '(objectClass=*)' 

I really wouldn't do that - unknown consequences of modifying the ACL on every object in AD (which is essentially what the "protect from deletion is")

Answer 2

Documentation about Get-ADOrganizationalUnit states that it does not do full search over the nested OUs.The best it can do is to search 2 levels below

-SearchScope Specifies the scope of an Active Directory search. The acceptable values for this parameter are:

Base or 0 OneLevel or 1 Subtree or 2

A Base query searches only the current path or object.

A OneLevel query searches the immediate children of that path or object.

A Subtree query searches the current path or object and all children of that path or object.

So I would rely on recursion here:

function Set-ProtectedFromAccidentalDeletionRecursive { param ( [string]$SearchBase ) $ous = Get-ADOrganizationalUnit -Filter * -SearchBase $SearchBase foreach ($ou in $ous) { # Set protection on this OU Set-ADOrganizationalUnit -Identity $ou.DistinguishedName -ProtectedFromAccidentalDeletion $true -WhatIf # Recursively process child OUs Set-ProtectedFromAccidentalDeletionRecursive -SearchBase $ou.DistinguishedName } } $rootOU = "ou=OU,ou=rootOU,dc=domain,dc=com" Set-ProtectedFromAccidentalDeletionRecursive -SearchBase $rootOU 

P.S. I don't have where to test for now, so added -WhatIf to Set-ADOrganizationalUnit so you can see results without changing anything.