Why does New-ADOrganizationalUnit return “Access is denied” or “Server unwilling”?

Double-check the distinguished name in `-Path`. For a domain named `Noiz.local`, the domain root is normally `DC=Noiz,DC=local`, not `DC=Noiz.local,DC=COM`. Each DNS component becomes its own `DC=` part. You can query the domain’s actual distinguished name first and reuse that value instead of typing it manually.

Being a domain administrator and running PowerShell as administrator are separate things. The directory account still needs AD permissions, while an elevated local session may be needed depending on how the tools and credentials are being used. If possible, test with the same account that can create the OU through the graphical management tools.

Check the account and PowerShell session you’re using. The account needs permission to create OUs in the target container, and in this case the command worked after running PowerShell in an elevated session. Also make sure there’s a space before `-ProtectedFromAccidentalDeletion`.

A “server unwilling” response often means the distinguished name is wrong or the command is contacting a domain controller that doesn’t serve that domain. Verify the target domain controller and the OU parent path. “Access is denied” points more directly to the account lacking the required directory permissions.