"We can join any OU in the domain, as long as the user specifies which OU." (There's more detail, but that's the gist of it.)
We were working on the acceptance criteria for the story, and worked our way through the usual suspects: join OUs with various characters in their names, attempt to join a non-existent OU, attempt to join an OU that the user doesn't have permission to join, etc. There's whole class of tests we're missing, though.
We also need to test things that should have no effect on the system.
For example, moving the computer object from one OU to another after the join is complete should have no effect. Renaming the OU after join should have no effect. Removing the original joiner's permissions to join to the OU should have no effect, as long as the join is complete. (There are several more in this vein.) Until we actually try this, though, we can't say for sure that there is no effect. I'd rather not find out in the field that we do have a dependency there that we simply didn't think of.
And that's the moral of today's story: Don't forget to test things that should have no effect.