OU deletion protection allows you to prevent the deletion of accidental move of an OU. This is a particular problem with using a laptop with a tiny mouse pad for administration. It is easy to accidently move an OU into another OU. With Group Policy, this can easily create problems. In Windows Server 2008, All OUs are created with the new OU Deletion Protection turned on by default. The question is, are OUs created on a Windows 2003 Domain protected after an upgrade to a Windows 2008 domain?
The answer is no.
I tested using a Windows 2003 domain created in a Hyper-V environment. I creaed an empty OU and another one with both a user account and a group. OU protection was not on by default for both of them after the upgrade. Also the objects inside the did not have deletion protection. To activate Deletion protection:
· Open AD Users and Computers
· Click View and select Advanced Features.
· Right click the OU and click Properties
· In the Object tab check Protect object from accidental deletion.
You will have to also do this for each object inside the OU that you want to protect.