I have recently encountered an Azure AD Connect sync engine that refuses to respect the recent changes to exclude an OU that was previously included.
Azure AD Connect version in question is 18.104.22.168 - April 2016
If you are wondering how to exclude OUs, go to Synchronization Service > Connectors > pick your Active Directory connector > Properties > Configure Directory Partitions > Containers button > enter your Azure AD Connect service account password:
You then wait for the next sync cycle or manually force the sync cycle, and yet you noticed that the objects are not being disconnected from the metaverse, and continue to sync to Azure AD.
To fix this, simply restart the "Microsoft Azure AD Sync" service and wait for the next sync cycle.
A grey box with a tick = objects in that OU (not the sub OU) will be synced:
A grey box (without a tick) = objects in that OU will not be synced, but some sub-OUs are selected for sync.