Bulk modifications using Set-AdUser

 

The standard approach to the bulk modification of users is to create a CSV file with an identifier and the data you want to change. Here’s part of a CSV file that could be used to modify some AD attributes – Division, City and Office

SamAccountName,Division,Office,City
mgreen,Accounting,”Main Office”,”New York”
dgreen,Sales,”North East”,Boston
jgreen,Marketing,”North West”,Seattle
bkent,Manufacturing,”North”,Chicago

I always like to first test what is set

$users = Import-Csv -Path C:\Scripts\adtest.csv            
            
foreach ($user in $users) {            
 Get-ADUser -Identity $user.SamAccountName -Properties * |            
 select SamAccountName, Division, Office, City             
}

A simple loop through each user and display the data. I’ve used –Properties * to ensure that I get the data I want. I could have put the attribute names in to restrict the returned data – might be a good idea if you are working with lots if user accounts at once

SamAccountName      Division            Office              City              
————–      ——–            ——              —-              
mgreen                                                                        
dgreen                                                                        
jgreen                                  Test                                  
bkent               AD Admin            ADML House          Peterborough

With Set-ADUser you get two options – a named parameter or the Add, Replace, Clear, Remove parameters.  See the help file for more details. All of our attributes have named parameters  so we can use this code

# Import AD Module             
Import-Module ActiveDirectory            
            
# Import CSV into variable $userscsv            
#$userscsv = import-csv D:\areile\Desktop\adtest.csv            
$users = Import-Csv -Path C:\Scripts\adtest.csv            
# Loop through CSV and update users if the exist in CVS file            
            
foreach ($user in $users) {            
#Search in specified OU and Update existing attributes            
 Get-ADUser -Filter "SamAccountName -eq '$($user.samaccountname)'" -Properties * -SearchBase "cn=Users,DC=manticore,DC=org" |            
  Set-ADUser -City $($user.City) -Office $($user.Office) -Division $($user.Division)            
}

Import the CSV file and loop through the users. For each user get the user object and pipe to Set-ADUser. The new attribute values are set from the CSV file data

Alternatively if you know the LDAP name of the attribute OR there isn’t a parameter for that attribute use the –Replace parameter.

# Import AD Module             
Import-Module ActiveDirectory            
            
# Import CSV into variable $userscsv            
#$userscsv = import-csv D:\areile\Desktop\adtest.csv            
$users = Import-Csv -Path C:\Scripts\adtest.csv            
# Loop through CSV and update users if the exist in CVS file            
            
foreach ($user in $users) {            
#Search in specified OU and Update existing attributes            
 Get-ADUser -Filter "SamAccountName -eq '$($user.samaccountname)'" -Properties * -SearchBase "cn=Users,DC=manticore,DC=org" |            
  Set-ADUser -Replace @{l = "$($user.City)"; physicalDeliveryOfficeName = "$($user.Office)"; division = "$($user.Division)"}            
}

The thing to note here is that the LDAP attribute names don’t always match the GUI names which are used as parameters. Get-ADUser seems to translate OK though!  You can find the correct name using ADSIEdit.

Note also that the help file for Set-AdUser is incorrect in at least once place – the list of attribute name-value pairs must be separated by semi-colons NOT commas as the help file states

This entry was posted in PowerShell and Active Directory. Bookmark the permalink.

20 Responses to Bulk modifications using Set-AdUser

  1. cavallogolooso says:

    Reblogged this on Depresso Gioioso.

  2. Alan says:

    Would you please also include an example of the -clear property using the same code example as the other 2 shown above?

    Thanks!!!!!

  3. rkk says:

    Can you please show how I could change AD contact attributes. We have external contacts in ad but have not been able to modify attributes in bulk. Please advise, Thanks!

  4. Ramez says:

    Thanks really helpful

  5. robstelz says:

    Good day. Thank you for taking the time to share your knowledge. Is there a way of calling the identity of the users in the csv file by something other than samAccountName? My goal is to be able to get the ad account using givenName+surname and then be able to set-aduser. Thank you.

  6. tom says:

    Good Morning ….Would it be possible to know how to change POBox Attribute ? Thanks very much

  7. Tariq says:

    Thank you for a good, clear example

  8. Rodrigo says:

    Thank you, for share this, i have a Q… Would it be possible pass a value if this is empty or null?

  9. speedy says:

    when trying to run this script in SQL 2012 agent job, it fails on line starting with “Get-ADUser -Filter…” reporting a syntax error” or if the script is run in cmdexec mode it hangs indefinitely. Tried both with proxy user and sql agent user but not really getting past these errors…

    • Your problem is one of permissions. The account under which SQL Server agent jobs run normally don’t have permissions to other systems. Either change the account you’re using in SQL server or run the script another way. Are the AD cmdlets installed on the SQL server machine?

  10. Edgardo says:

    Please could you give and example of the import csv file

    thank you

  11. Rahul says:

    Hi Richard, could you help me with renaming the Samaccount name itself , rgupta1983@gmail.com

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s