You're not alone wondering if there's a better way to protect critical objects in AD. Native protections only get you so far - there's always the possibility of that "oops" moment when you make a mistake (delete a critical OU, remove the CEO's user account, or something simple like add the wrong guy to the domain admins group) and think maybe there's a better way to protect yourself.
Backups are a must-have, but in many cases a restore of your entire directory isn't an answer. It's something you can do if desperate, but the mistake is stil out there and you're still spending a lot of time and resources restoring and then re-implementing all of the changes since your last good backup.
There are some tools out there that solve this problem without having to resort to a full restore of your AD from some point in the past. Tools that pro-actively prevent critical changes from happening at all, locking down critical objects so that mistakes never happened. The company I work for has such a tool - StealthINTERCEPT for AD and GPOs - and a quick google search can probably turn up others. The approach with StealthINTERCEPT is to identify key objects within AD and lock them down. Locking htem down means preventing your admins (and yourself, if desired) from making certain critical mistakes by controlling when and if you can delete, move, rename, or otherwise modify objects within AD. The security that StealthINTERCEPT provides exists outside of AD native permissions, meaning that even the users with the highest level of priviledge within your organization can still rely on our tool to prevent them from doing truly destructive things.
If you'd like to see the tool in action, come by one of our demonstrations or contact us at http://www.stealthbits.com/contact-us-company.