{"id":16821,"date":"2010-10-14T00:01:00","date_gmt":"2010-10-14T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2010\/10\/14\/use-powershell-and-active-directory-cmdlets-to-update-users-in-active-directory\/"},"modified":"2010-10-14T00:01:00","modified_gmt":"2010-10-14T00:01:00","slug":"use-powershell-and-active-directory-cmdlets-to-update-users-in-active-directory","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/use-powershell-and-active-directory-cmdlets-to-update-users-in-active-directory\/","title":{"rendered":"Use PowerShell and Active Directory Cmdlets to Update Users in Active Directory"},"content":{"rendered":"

<\/strong><\/span><\/span><\/span><\/p>\n

<\/strong><\/span><\/span><\/span><\/p>\n

Summary<\/strong>: Learn how to use Windows PowerShell and the Active Directory cmdlets to update user objects in Active Directory.<\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/span><\/p>\n

\"Hey,Hey, Scripting Guy! Watching you write a custom function to search Active Directory is about as much fun as watching paint dry. One reason we upgraded to Windows Server 2008 R2 was to gain access to the <\/span><\/span>Active Directory cmdlets<\/span><\/span><\/a><\/span>. I am not really good at using them, but I think I should be able to use them to find users that are missing a value for a particular attribute, and then supply a default value for it. Is this possible?<\/span><\/span><\/span><\/p>\n

— MW<\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/span><\/p>\n

\"Hey, Hello MW, <\/span><\/span><\/span><\/p>\n

Microsoft Scripting Guy Ed Wilson here. Watching paint dry could be fun if I had a bag of <\/span><\/span>ANZAC biscuits<\/span><\/span><\/a> and a pot of <\/span>Darjeeling tea<\/span><\/span><\/a>. I would also want my <\/span>Zune HD<\/span><\/span><\/a><\/span> so that I could play some nice jazz. If I had a nice recliner chair, I could get into some paint-drying time. Still, I do not think it would be as much fun as writing Windows PowerShell scripts. The complete SetADPropertyADCmdlets.ps1 script is shown here. <\/span><\/span><\/span><\/p>\n

\n

SetADPropertyADCmdlets.ps1<\/strong><\/span><\/span><\/p>\n

Import-Module<\/span> <\/span>ActiveDirectory<\/span> 
 <\/span>$users<\/span> <\/span>=<\/span> <\/span>$i<\/span> <\/span>=<\/span> <\/span>$null<\/span> 
 <\/span>$users<\/span> <\/span>=<\/span> <\/span>Get-ADUser<\/span> <\/span>-SearchBase<\/span> “ou=testou,dc=nwtraders,dc=com” <\/span>-filter<\/span> <\/span>*<\/span> <\/span>`<\/span> 
  <\/span>-property<\/span> <\/span>description<\/span> 
 <\/span>ForEach<\/span>(<\/span>$user<\/span> <\/span>in<\/span> <\/span>$users<\/span>)<\/span> 
  <\/span>{<\/span> 
   <\/span>if<\/span>([string]::isNullOrEmpty(<\/span>$user<\/span>.description))<\/span> 
    <\/span>{<\/span> 
      “modifying $($user.name)” 
      <\/span>Set-ADUser<\/span> <\/span>-Identity<\/span> <\/span>$user<\/span>.distinguishedName<\/span> <\/span>-Description<\/span> “added via script” 
      <\/span>$i++<\/span> 
    <\/span>}<\/span> 
 <\/span>}<\/span> 
“modified $i users”<\/span> <\/p>\n<\/blockquote>\n

Before we dive into the script, l like to take a look at my target. I seldom write a script that works with Active Directory without having ADSI Edit and Active Directory Users and Computers open. In fact, I have a custom MMC that contains both of those snap-ins as well as several other tools. The contents of the testou<\/strong> in the Nwtraders.com domain is shown in the following image.<\/span><\/span><\/span><\/p>\n

<\/span><\/span><\/p>\n

<\/span>\"Image<\/a><\/span><\/span><\/p>\n

As you can see in the previous image, the testou<\/strong> organizational unit contains both users and computers. In addition, one of the user objects contains a value for the description<\/strong> property; the other objects do not have a value for the description<\/strong> property. I only wish to add a description<\/strong> property value for the users that do not currently have a description; I do not wish to overwrite any existing values. In addition, the description I am going to add is not appropriate for computer objects. Sounds complicated, but it is a very common scenario. The script will need the ability to perform the following actions.<\/span><\/span><\/span><\/p>\n

·<\/span><\/span>         <\/span><\/span><\/span><\/span><\/span>Search a specific organizational unit for user objects.<\/span><\/span><\/span><\/span><\/p>\n

·<\/span><\/span>         <\/span><\/span><\/span><\/span><\/span>Find user objects that are missing a value for a specific attribute.<\/span><\/span><\/span><\/span><\/p>\n

·<\/span><\/span>         <\/span><\/span><\/span><\/span><\/span>Write a default value for user objects that are missing a value for the specific attribute.<\/span><\/span><\/span><\/span><\/p>\n

The first thing to do when using the Microsoft Active Directory cmdlets is to use the Import-Module<\/strong> cmdlet to import the ActiveDirectory<\/strong> module. <\/span><\/span><\/span><\/p>\n

For information about how to obtain and use the Microsoft Active Directory cmdlets, see <\/span><\/span>What’s up with Active Directory Domain Services Cmdlets?<\/span><\/span><\/a><\/span><\/span><\/p>\n

After the ActiveDirectory<\/strong> module has been imported, I set the $users<\/strong> and the $i<\/strong> variables to $null<\/strong>. This portion of the SetADPropertyADCmdlets.ps1 script is shown here:<\/span><\/span><\/span><\/p>\n

\n
Import-Module<\/span> <\/span>ActiveDirectory<\/span> <\/p>\n

<\/span>$users<\/span> <\/span>=<\/span> <\/span>$i<\/span> <\/span>=<\/span> <\/span>$null<\/span><\/span><\/div>\n<\/blockquote>\n

I now use the Get-ADUser<\/strong> cmdlet to retrieve users from the testou<\/strong> in my nwtraders.com domain. The filter<\/strong> property is required, so I give it the wildcard character *<\/strong> to tell it I want everything returned. In addition, I specify that I want the description<\/strong> property returned in the search results. For performance reasons, the Get-ADUser<\/strong> cmdlet returns only a subset of the available properties from Active Directory Domain Services (AD DS). The search results are stored in the $users<\/strong> variable. The command is a little long, so I use line continuation backtick character (`<\/strong>) to move the –property<\/strong> description portion of the command to the second line. This is a requirement for publishing the script to the blog. In my original script, the command fit nicely on a single line; it is therefore a single logical line command. The command is shown here:<\/span><\/span><\/span><\/p>\n

\n
$users<\/span> <\/span>=<\/span> <\/span>Get-ADUser<\/span> <\/span>-SearchBase<\/span> “ou=testou,dc=nwtraders,dc=com” <\/span>-filter<\/span> <\/span>*<\/span> <\/span>`<\/span> <\/p>\n

   <\/span>-property<\/span> <\/span>description<\/span><\/span><\/div>\n<\/blockquote>\n

A collection is returned via the Get-ADUser<\/strong> cmdlet. Therefore, I use the ForEach<\/strong> statement to walk through the collection. Unfortunately, I cannot <\/span><\/span>pipe<\/span><\/span><\/a><\/span> the results of the Get-ADUser<\/strong> cmdlet directly to Set-ADUser<\/strong>. When inside the collection, I use the static isNullOrEmpty<\/strong> method from the system.string<\/strong> .NET Framework class. I have it check the description<\/strong> property on the user<\/strong> object. If the property is empty or null, I then display a string that states I am modifying the user<\/strong> object. This portion of the script is shown here:<\/span><\/span><\/span><\/p>\n

\n
ForEach<\/span>(<\/span>$user<\/span> <\/span>in<\/span> <\/span>$users<\/span>)<\/span> <\/p>\n

  <\/span>{<\/span> <\/p>\n

   <\/span>if<\/span>([string]::isNullOrEmpty(<\/span>$user<\/span>.description))<\/span>  <\/p>\n

    <\/span>{<\/span>  <\/p>\n

      “modifying $($user.name)”<\/span><\/span><\/div>\n<\/blockquote>\n

To modify the user object, use the Set-ADUser<\/strong> cmdlet. The identity<\/strong> parameter is used to specify which b object to modify; this parameter will accept a distinguished name, the object GUID, the security identifier (SID), the SAM account name, or the name of the object. Here, I chose the distinguishedname<\/strong> property from the user<\/strong> object. The description<\/strong> parameter holds the value to add to the description<\/strong> attribute on the object. This command is shown here:<\/span><\/span><\/span><\/p>\n

\n
Set-ADUser<\/span> <\/span>-Identity<\/span> <\/span>$user<\/span>.distinguishedName<\/span> <\/span>-Description<\/span> “added via script”<\/span> <\/div>\n<\/blockquote>\n

The last two things to do are to increment the $i<\/strong> counter variable and display a summary string. This portion of the script is shown here:<\/span><\/span><\/span><\/p>\n

\n
$i++<\/span> <\/p>\n

    <\/span>}<\/span> <\/p>\n

 <\/span>}<\/span> <\/p>\n

“modified $i users”
<\/span><\/div>\n<\/blockquote>\n

<\/span><\/span><\/span><\/p>\n

When the script runs in the Windows PowerShell ISE, the output appears that is shown in the following image.<\/span><\/span><\/span><\/p>\n

\"Image<\/a><\/span><\/p>\n

<\/span>Active Directory Users and Computers is used to verify that the changes were completed. Keep in mind that you might need to hit refresh (F5) a few times before the changes appear. In addition, depending on your network topology, it might actually take a minute or two. On my system, the changes shown in the following image took a few seconds of pressing refresh before they appeared.<\/span><\/span><\/span><\/p>\n

\"Image<\/a><\/span><\/p>\n

MW, that is all there is to using the Microsoft Active Directory cmdlets to find objects with missing values and then assign default values to those objects. Active Directory Week draws to an end. Join us tomorrow when we will have a guest blogger talk about the Windows PowerShell Scripting Community. You should not miss this excellent article. <\/span> <\/span><\/span><\/span><\/span><\/span><\/p>\n

We invite you to follow us on <\/span><\/span>Twitter<\/span><\/span><\/a> and <\/span>Facebook<\/span><\/span><\/a>. If you have any questions, send email to us at <\/span>scripter@microsoft.com<\/span><\/span><\/a>, or post them on the <\/span>Official Scripting Guys Forum<\/span><\/span><\/a><\/span>. See you tomorrow. Until then, peace.<\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/span><\/p>\n

Ed Wilson and Craig Liebendorfer, Scripting Guys<\/span><\/span><\/span><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Learn how to use Windows PowerShell and the Active Directory cmdlets to update user objects in Active Directory.   Hey, Scripting Guy! Watching you write a custom function to search Active Directory is about as much fun as watching paint dry. One reason we upgraded to Windows Server 2008 R2 was to gain access […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,3,8,20,45],"class_list":["post-16821","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-scripting-guy","tag-searching-active-directory","tag-user-accounts","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Summary: Learn how to use Windows PowerShell and the Active Directory cmdlets to update user objects in Active Directory.   Hey, Scripting Guy! Watching you write a custom function to search Active Directory is about as much fun as watching paint dry. One reason we upgraded to Windows Server 2008 R2 was to gain access […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/16821","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=16821"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/16821\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=16821"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=16821"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=16821"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}