SERVER-007 · Script
Move Users Between Organizational Units
Moves directory user accounts to a new OU by name list, CSV file, or everyone in a source OU.
Version 1.0.0Language PowerShellUpdated November 2026
What it does
Three ways to pick accounts:
- CSV file: -CsvPath with columns Identity and TargetOU (each row can go somewhere different)
- Name list: -Identity with -TargetOU
- Source OU: -SourceOU with -TargetOU, optionally only one -Department, and -IncludeSubOUs
Preview mode (default) logs every move it would make. Apply moves the accounts and saves a rollback CSV (Identity, FromOU, ToOU). To undo, run the rollback file back through this script after renaming its FromOU column to TargetOU.
Requirements
Windows PowerShell 5.1 and the ActiveDirectory module (RSAT). Rights to move objects out of the source OUs and into the target OUs.
How to run it
- Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
- Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
- Script type: PowerShell 5.1, 64-bit
- User interaction: none; the script never prompts
- Timeout: 30 minutes for large directories or many servers
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| Mode | Preview (default) or Apply. | Preview, Apply | Preview |
| CsvPath | CSV file with Identity and TargetOU columns. | ||
| Identity | Sign-in names to move to -TargetOU. | (none) | |
| SourceOU | Move every user in this OU (distinguished name) to -TargetOU. | ||
| TargetOU | Destination OU, as a distinguished name. | ||
| Department | With -SourceOU, only move users whose Department matches exactly. | ||
| IncludeSubOUs | With -SourceOU, also move users in OUs below it. | False | |
| Server | Optional domain controller to use for every change. |
Exit codes
- 0 = All moves done (or would be, in Preview)
- 1 = Some accounts were not found or could not be moved
- 2 = Script error (see log)
Testing steps
- Run it first with the mode set to Preview on one test OU, test account or test server. Nothing is changed in that mode.
- Read the log and confirm the planned changes are what you expect.
- Run your chosen settings on the same test target and confirm the result.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Preview mode changes nothing. The report's FromOU column shows where each account was. To undo, rename FromOU to TargetOU in that file and run it back through this script with Mode set to Apply.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |