v1.0.0

[1.0.0] - 2026-02-22

Added

9 Tools across 3 categories

OU Lifecycle (4):

• Create OU — Create a new Organizational Unit with optional description, managed-by, and accidental deletion protection (defaults to enabled)
• Delete OU — Delete an OU with explicit protection removal and recursive options. Shows child object count before deletion (dry-run by default)
• Rename OU — Rename an Organizational Unit with before/after preview (dry-run by default)
• Move OU — Move an OU to a different parent container with current/new parent display (dry-run by default)

OU Information (1):

• List OU Tree — Display OU hierarchy as an indented tree with ├─ connectors. Configurable max depth, optional per-OU object counts. Defaults to domain root. Capped at 200 OUs for performance

OU Management (4):

• Set OU Protection — Enable or disable accidental deletion protection on one or more OUs (skips already-matching)
• Set OU Description — Update description and/or managed-by on an OU. Supports clearing managed-by
• Delegate OU — Delegate 6 common permission sets to a user or group: FullControl, CreateDeleteUsers, CreateDeleteGroups, CreateDeleteComputers, ResetPasswords, ReadAll. Uses ActiveDirectoryAccessRule ACL entries (dry-run by default)
• Manage GPO Links — Link or unlink Group Policy Objects to/from an OU with optional enforcement and link order. Requires GroupPolicy module (dry-run by default)

Safety Features

• Dry-run mode defaults to true on all destructive operations
• Delete OU requires explicit removeProtection=true for protected OUs
• Delete OU requires recursive=true for non-empty OUs
• Per-item success/failure tracking with structured audit output

Shared Helpers

• Write-XY, Write-XYProgress, Write-XYSuccess, Write-XYError — xyOps I/O contract
• Read-JobFromStdin, Get-Param — Job input handling
• Assert-ActiveDirectoryModule — RSAT module check with installation instructions
• Format-ADValue — Human-readable value formatting
• Get-MultipleInputs — Parse comma/semicolon/newline-separated input
• Get-DryRunFlag, Get-DryRunLabel — Dry-run mode helpers

Technical Details

• Script Size: ~856 lines
• Tools: 9
• Functions: 18+ (helpers + tool functions + entry point)
• Dependencies: ActiveDirectory PowerShell module (RSAT), GroupPolicy module (optional, for GPO links)
• PowerShell Version: 7.0+
• Exit Codes: 0 (success), 1 (error)

Prerequisites

• Windows machine with RSAT ActiveDirectory PowerShell module installed
• GroupPolicy module for GPO link management (optional)
• Domain-joined machine or connectivity to a domain controller
• Account with appropriate AD permissions (Domain Admins for delegation/GPO)
• PowerShell 7.0 or later