The standard approach to the bulk modification of users is to create a CSV file with an identifier and the data you want to change. Here’s part of a CSV file that could be used to modify some AD attributes – Division, City and Office
SamAccountName,Division,Office,City
mgreen,Accounting,"Main Office","New York"
dgreen,Sales,"North East",Boston
jgreen,Marketing,"North West",Seattle
bkent,Manufacturing,"North",Chicago
I always like to first test what is set
$users = Import-Csv -Path C:\Scripts\adtest.csv
foreach ($user in $users) {
Get-ADUser -Identity $user.SamAccountName -Properties * |
select SamAccountName, Division, Office, City
}
A simple loop through each user and display the data. I’ve used –Properties * to ensure that I get the data I want. I could have put the attribute names in to restrict the returned data – might be a good idea if you are working with lots if user accounts at once
SamAccountName Division Office City
-------------- -------- ------ ----
mgreen
dgreen
jgreen Test
bkent AD Admin ADML House Peterborough
With Set-ADUser you get two options – a named parameter or the Add, Replace, Clear, Remove parameters. See the help file for more details. All of our attributes have named parameters so we can use this code
# Import AD Module
Import-Module ActiveDirectory
# Import CSV into variable $userscsv
#$userscsv = import-csv D:\areile\Desktop\adtest.csv
$users = Import-Csv -Path C:\Scripts\adtest.csv
# Loop through CSV and update users if the exist in CVS file
foreach ($user in $users) {
#Search in specified OU and Update existing attributes
Get-ADUser -Filter "SamAccountName -eq '$($user.samaccountname)'" -Properties * -SearchBase "cn=Users,DC=manticore,DC=org" |
Set-ADUser -City $($user.City) -Office $($user.Office) -Division $($user.Division)
}
Import the CSV file and loop through the users. For each user get the user object and pipe to Set-ADUser. The new attribute values are set from the CSV file data
Alternatively if you know the LDAP name of the attribute OR there isn’t a parameter for that attribute use the –Replace parameter.
# Import AD Module
Import-Module ActiveDirectory
# Import CSV into variable $userscsv
#$userscsv = import-csv D:\areile\Desktop\adtest.csv
$users = Import-Csv -Path C:\Scripts\adtest.csv
# Loop through CSV and update users if the exist in CVS file
foreach ($user in $users) {
#Search in specified OU and Update existing attributes
Get-ADUser -Filter "SamAccountName -eq '$($user.samaccountname)'" -Properties * -SearchBase "cn=Users,DC=manticore,DC=org" |
Set-ADUser -Replace @{l = "$($user.City)"; physicalDeliveryOfficeName = "$($user.Office)"; division = "$($user.Division)"}
}
The thing to note here is that the LDAP attribute names don’t always match the GUI names which are used as parameters. Get-ADUser seems to translate OK though! You can find the correct name using ADSIEdit.
Note also that the help file for Set-AdUser is incorrect in at least once place – the list of attribute name-value pairs must be separated by semi-colons NOT commas as the help file states