user can have no OU