# When to update AWS Control Tower OUs and accounts
When to update OUs and accounts

When you perform a landing zone update, you must update your enrolled accounts to apply new controls to those accounts.
+ You can perform an update to all accounts under an OU using the Re-Register or Reset option.
+ If you have more than one registered OU in your landing zone, re-register or reset all of your OUs to update all of your accounts.
+ To update a single account, you can update from the AWS Control Tower console, or you can select the **Update provisioned product** option in AWS Service Catalog if AWSControlTowerBaseline is enabled on the account. See [Update the account in the console](updating-account-factory-accounts.md#update-account-in-console).