Skip OU move for Domain Admin accounts

Update-StaffAD.ps1

@@ -186,10 +186,16 @@ foreach ($entry in $Deduped.Values) {
         if ($DryRun) { $disables++ }
     }
 
-    # Move user to correct OU
+    # Move user to correct OU (skip Domain Admins)
     if ($willMove) {
-        if ($DryRun) {
+        $isDomainAdmin = (Get-ADUser $samAccount -Properties MemberOf).MemberOf |
+                         Where-Object { $_ -match "^CN=Domain Admins," }
+
+        if ($isDomainAdmin) {
+            Write-Log "  OU Move : SKIPPED - user is a Domain Admin" "Yellow"
+        } elseif ($DryRun) {
             Write-Log "  OU Move : WOULD MOVE to $targetOU" "Magenta"
+            $moved++
         } else {
             try {
                 Move-ADObject -Identity $adUser.DistinguishedName -TargetPath $targetOU
@@ -199,7 +205,6 @@ foreach ($entry in $Deduped.Values) {
                 Write-Log "  OU Move : FAILED to move - $_" "Red"
             }
         }
-        if ($DryRun) { $moved++ }
     }
 }