def validate_ous(requested_ous, existing_ous):
    """
    Confirms that the specified organizational unit IDs exist. Also converts
    an asterisk to all known OUs. Raises an error on an unknown OU.
    """
    if not requested_ous:
        raise ValueError("No organizational units specified")
    requested = set(requested_ous)
    existing = set(existing_ous)
    if "*" in requested:
        return sorted(list(existing))
    missing_ous = requested - existing
    if missing_ous:
        raise ValueError(f"Unknown OUs: {missing_ous}")
    return sorted(list(requested))