PIM Manager settings · Settings > AD OU placement
AD OU (High Priv Admins)
| Key | NamingConventions.PathAdminsL0T0 |
|---|---|
| Where | Settings > AD OU placement (admin accounts) |
| Type | Text |
| Default | Blank (no high-privilege AD admin accounts are created) |
| Feature | PIM for on-premises Active Directory · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
The on-premises AD OU where new high-privilege (L0 / Tier 0) admin accounts are created -- rows with Purpose = HighPriv, or with no Purpose and a user name that matches the high-privilege admin pattern.
When set
When set: on its next scheduled run the hybrid worker creates due high-privilege AD admin rows as AD users in this OU.
When blank or default
When blank: high-privilege AD admin accounts are skipped with the reason target OU empty; they are NOT placed in the day-to-day OU instead.
Risk and how to reverse it
Setting it lets PIM Manager create Tier 0 accounts in your AD. Existing accounts are never moved when you change it. Reversible: clear it and creation stops; accounts already created stay.
Requires
Pro (hybrid Active Directory) and a hybrid worker allowed to create users in this OU. SuperAdmin in PIM Manager. Uses AdminAccountPatternHighPriv to classify rows without a Purpose.
Recommended
Point it at your Tier 0 admin OU, protected like other Tier 0 objects, so high-privilege accounts never land with ordinary admins.
Related settings
- On-premises Active Directory (hybrid worker) FeatureGates.hybrid.ad
- AD OU (Day2Day Admins) NamingConventions.PathAdmins
- AD group marker HybridAdGroupMarker
- Pattern override HybridAdGroupPattern
- Cloud admin suffix HybridAdCloudSuffix
- AD admin suffix HybridAdAccountSuffix
- OU for new AD groups HybridAdGroupsOu
- Per-server group format HybridAdServerGroupFormat
- Shared server-admins group HybridAdServerAdminsGroup
- Never remove HybridAdProtectedMembers
- Groups per batch HybridAdSyncBatchSize
- Batches at once HybridAdSyncParallel
- Read activation end times as UTC HybridAdEndTimeAsUtc
- Server discovery: only these OUs HybridAdServerSearchOus
- Server discovery: OUs to leave out HybridAdServerExcludeOus
- Server discovery: last changed within (days) HybridAdServerActiveDays
- Server discovery: only names like HybridAdServerNameInclude
- Server discovery: never names like HybridAdServerNameExclude
- New servers in these OUs are offered for approval as one list HybridAdServerAutoGroupOus
- Server groups created per run HybridAdServerAutoGroupMaxPerRun
- Clean-up: also look for old PIM groups in these OUs HybridAdCleanupOus
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack