When troubleshooting permissions or group policy application in Windows Active Directory environments, knowing your current Organizational Unit (OU) is crucial. While GUI tools like Active Directory Users and Computers (ADUC) can show this information, command-line methods are often more efficient for automation and scripting scenarios.

The simplest way to check your OU path is using the built-in whoami command:

whoami /fqdn

This will output your full distinguished name including the OU path. For example:

CN=John.Doe,OU=Development,OU=Users,DC=contoso,DC=com

For more detailed information and scripting capabilities, use PowerShell with the ActiveDirectory module:

Import-Module ActiveDirectory
$user = Get-ADUser $env:USERNAME -Properties DistinguishedName
$user.DistinguishedName

This returns the complete DN including all OUs in the hierarchy.

The legacy directory services query tool provides another option:

dsquery user -name %username% | dsget user -dn

When you need to extract just the OU portion for scripts:

$dn = (Get-ADUser $env:USERNAME -Properties DistinguishedName).DistinguishedName
$ouPath = $dn -replace '^CN=[^,]+,(.*),DC=.*$','$1'
Write-Output $ouPath

When the AD module isn't available, use ADSI:

$searcher = [ADSISearcher]"(samAccountName=$env:USERNAME)"
$result = $searcher.FindOne()
$result.Properties["distinguishedName"][0]

To verify which OUs affect your account for GPO processing:

gpresult /r /scope:user

This shows all applied GPOs and their originating OUs.

When working in a Windows domain environment, you can quickly identify your current Organizational Unit (OU) using these methods:

For modern Windows systems, PowerShell provides the most comprehensive solution:

# Basic user OU query
$user = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
$searcher = [adsisearcher]"(samaccountname=$($user.Split('\')[1]))"
$searcher.FindOne().Properties.distinguishedname -replace '^CN=.*?,(.*)', '$1'

# Alternative method showing full path
(Get-ADUser -Identity $env:USERNAME -Properties *).DistinguishedName -replace '^CN=.*?,(OU=.*)', '$1'

For environments where PowerShell isn't available:

:: Using dsquery
dsquery user -name %username% | dsget user -dn

:: For the OU path only
for /f "tokens=2 delims=," %a in ('dsquery user -name %username% ^| dsget user -dn') do @echo %a

Legacy systems might require this approach:

Set objSysInfo = CreateObject("ADSystemInfo")
Set objUser = GetObject("LDAP://" & objSysInfo.UserName)
arrDN = Split(objUser.distinguishedName, ",")
For i = 1 To UBound(arrDN)
    If Left(arrDN(i), 3) = "OU=" Then
        WScript.Echo arrDN(i)
    End If
Next

If you encounter "access denied" errors, try running as administrator. For missing cmdlets, ensure you have RSAT tools installed. The ActiveDirectory module requires:

Import-Module ActiveDirectory

For system administrators needing batch processing:

# Get OU for all logged in users on multiple machines
$computers = Get-ADComputer -Filter * | Select -ExpandProperty Name
$results = @()
foreach ($computer in $computers) {
    $session = New-PSSession -ComputerName $computer
    $ou = Invoke-Command -Session $session -ScriptBlock {
        (Get-ADUser -Identity $env:USERNAME).DistinguishedName -replace '^CN=.*?,(OU=.*)', '$1'
    }
    $results += [PSCustomObject]@{
        Computer = $computer
        OU = $ou
    }
    Remove-PSSession $session
}
$results | Export-Csv -Path "UserOUs.csv" -NoTypeInformation

The distinguished name format returns the complete path from your user object to the domain root. For example:

OU=Marketing,OU=Departments,DC=contoso,DC=com

This shows the user is in the Marketing OU, which is nested within the Departments OU.