After 26 years across Fortune 500 forests, the same five mistakes recur. Not because engineers are careless — because forests outlive the architects who built them. By the time today's team owns the environment, decisions made by people who left a decade ago are still shaping the threat surface.

Here are the five we keep finding, and what remediation actually involves.

1. OU sprawl

The OU tree starts clean. Three years later it has eight levels of nesting, six dead branches from re-orgs that never finished, and one OU per project that nobody can delete because there is a service account inside it. The symptoms are familiar: brittle GPO inheritance, slow PowerShell queries, helpdesk tickets that come down to "object can't be found" because nobody knows which OU it lives in.

Remediation is harder than it looks. You can't just consolidate OUs — everything attached to them has to move first. That means: catalog every GPO link, every delegation entry, every script that queries by DN, every service-account containment policy. Then design the target OU structure, move the policies first, validate, and only then move the objects. Expect six to twelve weeks for a real cleanup in a Fortune 500 environment, and budget for the WMI filters and security filtering you will find buried inside policies during the audit.

The OUs that resist consolidation hardest are usually the ones with delegation. Department admins given controlled access to specific OUs end up depending on the path. Move the OU and you break the delegation. Document who has delegated rights to what — that is the change-management dependency, not the org chart.

2. Undocumented trusts

Forest trusts to vendors no longer in business. External trusts to NT 4.0 domains that were deprecated in the early 2000s but never severed. Transitive trusts that quietly extend the authentication boundary far past what the architecture diagram shows. Most environments have at least one trust they cannot fully explain.

The remediation pattern is standard but rarely run cleanly. nltest /domain_trusts and netdom trust enumerate what exists. For each trust, document: who created it, what business relationship justifies it, whether SID filtering is enabled, whether selective authentication is in place. Build a kill list, find a stakeholder for each trust, set deadlines. The trusts no stakeholder claims are the dangerous ones — and they are the easiest to retire.

The trickier category is one-way trusts that look outbound but enable inbound auth via transitivity. Map the trust graph as a directed graph, then trace which forest can ultimately authenticate against which other forest. The answer often surprises the security team.

3. GPOs no one will touch

Every Fortune 500 forest has them. The legacy GPO with hundreds of settings, attached to login scripts that reference UNC paths to servers decommissioned years ago, last modified by an engineer who left in 2014. Nobody can audit what is actually inside it. Nobody will be the person who broke production by retiring it.

The pattern that works: Get-GPOReport -All -ReportType Xml as a baseline. Identify the unowned policies (we cover the inventory work in Modernizing 20 years of Group Policy). For each candidate, "linked but disabled" for ninety days creates a rollback window without changing anything. If nothing breaks in ninety days, unlink. Wait thirty more. Then delete. The slow path is the safe path.

The hardest GPOs in this category are the ones with WMI filters that have not applied to anything in years. They sit in the GPO list, contribute nothing, but registry-reading tools and audit scans still flag them as "active." Treat the WMI filter inventory separately from the GPO inventory; many filters were written for systems retired five years ago.

4. Replication topologies designed in 2008

Site links that pre-date the MPLS rollout. Hub-and-spoke topologies where the network is now a mesh. Manual exceptions to ISTG-managed connections that nobody documented. The KCC will mostly do the right thing if it has accurate information — but most enterprises starve it.

The remediation isn't a redesign. It's a re-grounding. Audit the current network reality: which sites have which bandwidth, which links are sized for replication versus user traffic, which sites are now in cloud regions instead of physical data centers. Update the site link costs to match. Remove manual connection objects unless there is a documented reason to keep them. Then let the KCC recompute. Most of what was "broken" was the topology lying about the network.

The other recurring pattern: read-only DCs deployed in branch sites in 2010, never re-evaluated when the branch went WAN-less and connected via VPN. RODCs in those sites accumulate replication debt and provide no real branch-isolation benefit anymore. Audit each one.

5. The one ESAE shortcut that breaks every audit

Tier-0 admin accounts logging into tier-1 workstations. Always for a "good reason": the engineer needs to check email, the helpdesk tool runs better on the engineer's regular laptop, the PAW workflow is too slow. Whatever the justification, the result is the same: privileged credentials end up cached in browser history, in memory of helpdesk tools, in Outlook offline storage. Auditors find them every time.

Remediation isn't technical. It's discipline. Separate accounts. Separate workstations. No exceptions for senior engineers, no shortcuts for emergencies. The dual-account model is the architecture — the moment one engineer logs into a regular workstation as a tier-0 admin, the boundary is gone, and reconstituting it requires credential rotation across the entire tier-0 boundary. Audit findings on this category are the most expensive to remediate, and the easiest to prevent.

The systemic fix is not more training. It is making the PAW workflow fast enough that the shortcut is not tempting. If your tier-0 admins cannot get to a PAW in under thirty seconds, they will find a shortcut, and the shortcut will eventually get logged.

The pattern

These are five mistakes, not five surprises. The reason they recur is not ignorance — every one of them is "fix it later" cheaper than fixing it now. The job of senior architecture work is to make the now-cost visible, before the audit findings make it visible for you.