Hi I want to create an OU where i want to put all stored computers, servers and users with doubts. Idea is to restrict these objects (both Computer as well as user) in the domain.

When any floor engineer would take out the system from store, the group policy will not allow the system to be used in domain until he informs the Domain Admins. Once the admin moves the system to right OU, the system is then becomes usable.

Same way, if we have any doubt about any user id, we would move the user id to a restricted OU, where the group policy would restrict the user to get in to domain until domain admin moves the id to correct OU.

How do we do it? I want a group policy/ policies which will do this job for us.

closed as off-topic by kasperd, Ward, Jenny D, mdpc, quadruplebucky Jun 12 '17 at 17:58

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – Ward, mdpc, quadruplebucky
If this question can be reworded to fit the rules in the help center, please edit the question.


For users, why would you move the account when you can simply disable it? For systems, you should move it to a quarantine OU until it can be rebuilt (which is what you propose). If these systems are offline they will have to get re-added to the domain if they stay offline too long. For stored machines, wipe them, rebuild them, and don't add them to the domain until they are needed.


For both users and computers simply disable them.

You could move them to another OU for administrative purposes (disabled clients, disabled users) if you like.

As long as you keep them in Active Directory you will be able to reuse, while the objects keep the same ID.

Not the answer you're looking for? Browse other questions tagged or ask your own question.