logo

Using the Set-ADUser Cmdlet to Modify Properties of Active Directory Users

Introduction

Administrators have several options for managing the properties of Active Directory users. The Active Directory Users and Computers (ADUC) console is convenient for making a few basic changes, such as modifying a user’s description or office location.

For more functionality, however, consider using PowerShell. This article illustrates how you can address many common use cases with the PowerShell cmdlet Set-ADUser.

Introduction
Introduction

Set-ADUser Cmdlet

Using the Set-ADUser cmdlet, you can modify many properties of Active Directory users.

Note that in order to run PowerShell cmdlets from a Windows computer that is not a domain controller, you need to first import the Active Directory module for Windows PowerShell.

Set-ADUser Parameters

The following table describes the parameters of the Set-ADUser cmdlet that you can use to change a user’s properties.

To see the full list of parameters for the Set-ADUser cmdlet, run the following cmdlet:

Get-help Set-ADUser
ParameterDescription
(A)
-AccountExpirationDateSets the account expiration date of the user object.
-AccountNotDelegatedSpecifies whether the user’s security context is delegated to a service.
-AddAdds one or more values to a property that cannot be changed using a cmdlet parameter (i.e., properties for which no parameter is available).
-AllowReversiblePasswordEncryptionSpecifies whether the account is allowed to use reversible password encryption.
-AuthenticationPolicySpecifies an authentication policy object for Active Directory Domain Services.
-AuthenticationPolicySiloSets the authentication policy silo object for Active Directory Domain Services.
-AuthTypeSpecifies the authentication method to use: Negotiate (or 0) or Basic (or 1).
(C)
-CannotChangePasswordSpecifies whether the user can change the account’s password.
-CertificatesSpecifies the account’s DER-encoded X.509v3 certificates, such as the public-key certificates issued to this account by the Microsoft Certificate Service.
-ChangePasswordAtLogonSpecifies whether the user must change their password at the next login.
-CitySpecifies the city or town of the user.
-ClearClears one or more values of an attribute that cannot be changed using a cmdlet parameter (i.e., attributes for which no parameter is available).
-CompanySets the company attribute of the user account.
-CompoundIdentitySupportedSpecifies whether a user’s account supports Kerberos service tickets, which include the user’s device’s authorization data.
-ConfirmPrompts you for confirmation before running the cmdlet.
-CountrySets the country or region code for the user account.
-CredentialSpecifies the user account credentials to use to run the cmdlet. Unless the cmdlet is launched from an Active Directory PowerShell provider drive, the default credentials are those of the logged-on user.
(D)
-DepartmentSpecifies the department of the user.
-DescriptionSpecifies the description of the user account.
-DisplayNameSpecifies the display name of the user.
-DivisionSpecifies the division of the user.
(E)
-EmailAddressSpecifies the email address of the user.
-EmployeeIDSpecifies the employee ID of the user.
-EmployeeNumberSpecifies the employee number of the user.
-EnabledSpecifies whether the user account is enabled or disabled.
(F)
–FaxSpecifies the fax number of the user.
(G)
-GivenNameSpecifies the first name of the user.
(H)
-HomeDirectorySpecifies the home directory of the user account.
-HomeDriveSets the UNC path of the home directory of the user account.
(I)
-IdentitySpecifies the user account whose properties need to be changed.
A user can be identified by its:

• Distinguished Name (DN)
• GUID
• Security Identifier (SID)
• Security Account Manager (SAM) account name

Alternatively, you can feed a user object through the pipeline to the Identity parameter, or set it to an object variable. For example, you can use the Get-ADUser cmdlet to retrieve a user object, which can be passed via the pipeline to the Set-ADUser cmdlet.
-InitialsSpecifies the initials of the user.
-InstanceSpecifies an ADUser object that identifies the Active Directory user object to be changed and the modifications to be made to that object. When this parameter is supplied, any changes made to the ADUser object are also propagated to the appropriate Active Directory object. Only the object properties that have changed are updated by the cmdlet.
This parameter is mainly used when you make changes to an object’s properties with a CSV or script using variables. You call the object, make changes to the desired properties, then use Set-ADUser with the -Instance parameter for those changes to take effect.
(K)
-KerberosEncryptionTypeSpecifies whether the user account is compatible with Kerberos encryption.
(L)
-LogonWorkstationsSpecifies the logon workstations of the user.
(M)
-ManagerSpecifies the manager of the user.
-MobilePhoneSpecifies the mobile phone number of the user.
(O)
-OfficeSpecifies the physical office location of the user.
-OfficePhoneSpecifies the office phone number of the user.
-OrganizationSpecifies the organization of the user.
-OtherNameSpecifies any other name property of the user.
(P)
-PartitionSpecifies the distinguished name of an Active Directory partition. The distinguished name must be one of the naming contexts on the current directory server.
-PassThruReturns an object that represents the object you are working with. By default, this cmdlet does not generate any output.
-PasswordNeverExpiresSpecifies whether the account password never needs to be updated.
-PasswordNotRequiredSpecifies that the user account does not need a password.
-POBoxSpecifies the PO box of the user.
-PostalCodeSpecifies the postal code of the user.
-ProfilePathSpecifies the profile path of the user.
(R)
-RemoveRemoves one or more values of the properties that cannot be modified using a cmdlet parameter (i.e., properties for which no parameter is available).
-ReplaceReplaces one or more values of the properties that cannot be modified using a cmdlet parameter (i.e., properties for which no parameter is available).
This parameter is mostly used for more than one property value, or multiline attributes, particularly those for which there is no parameter available, but you can also use it for properties for which a specific parameter is available.
(S)
-SamAccountNameProvides the security account manager (SAM) account name of the user on creation.
-ScriptPathSpecifies a path to the user’s log on script.
-ServerSpecifies the AD DS instance to connect to.
-ServicePrincipalNamesSpecifies the service principal name of the user.
-SmartcardLogonRequiredSpecifies whether smart card logon is required for the user.
-StateSpecifies the state of the user.
-StreetAddressSpecifies the street address of the user.
(T)
-TitleSpecifies the user’s job title.
-TrustedForDelegationSpecifies whether the account is trusted for Kerberos delegation. A service running under a trusted Kerberos delegation account can take on the identity of the client requesting the service.
(U)
-UserPrincipalNameSpecifies the user principal name (UPN) property of a user in the format testuser@testdomain.com.
(W)
-WhatIfShows the output that would result from running the cmdlet, without actually running it.

Verbose Command

By default, the Set-ADUser cmdlet produces no output. To get information about what the cmdlet is doing, use the /verbose switch.

Verbose is mostly used with variables and scripts, though sometimes it is also used with cmdlets.

Set-ADUser Examples

The following are examples for using the Set-ADUser cmdlet.

  • Change a User’s Office and State Attributes
  • Change a User’s Title
  • Specify a User’s Manager
  • Replace User Properties
  • Modify Multiple Attributes for Multiple Users, Example 1
  • Modify Multiple Attributes for Multiple Users, Example 2
  • Modify Multiple Attributes for Multiple Users, Example 3
  • Modify Multiple Attributes for Multiple Users Using a CSV File
  • Use Alternate Credentials
  • Clear an Attribute Value
  • Disable AD User Accounts
  • Force a Password Change at Next Logon
  • Modify Attributes that Can Have Multiple Values

Start Your Free Trial of Netwrix GroupID

Simplify user management in AD without complex PowerShell scripts with Netwrix

We care about security of your data.

Privacy Policy

Change a User’s Office and State Attributes

The following cmdlet will set the values of the Office and State attributes of the AbbeyCrawford object:

Set-ADUser -Identity AbbeyCrawford -Office 'Atlanta' -State 'GA'
Change a User’s Office and State Attributes

Here you can see that the user’s Office and State attributes have been set as specified:

Change a User’s Office and State Attributes

Change a User’s Title

The following cmdlet will update the Title property of the AbbeyCrawford user object:

Set-ADUser -Identity AbbeyCrawford -Title 'CIO'

To check that the update was successful, use the following command:

Get-ADUser -Identity AbbeyCrawford -Properties Name,Department,title | Select-Object -Property Name,Department,title
Change a User’s Title

Specify a User’s Manager

The following command uses Get-ADUser to get the AD user object AbbeyCrawford, which is passed to the Set-ADUser cmdlet, which update its Manager attribute:

Get-ADUser -Identity "AbbeyCrawford" | Set-ADUser -Manager "AbbeyEckels"
Specify a User’s Manager

You can confirm the change by using the following cmdlet:

Get-ADUser -Identity AbbeyCrawford -Properties manager | Select-Object -Property manager
Specify a User’s Manager

Replace User Properties

To replace a property’s current value with a new value, use the Replace parameter. Use the LDAP display name to identify the object to be modified.

This command updates the title and email address of the user AbbeyCrawford:

Set-ADUser -Identity Abbey.Crawford -Replace @{title="manager";mail="AbbeyCrawford@corp.net"}
Replace User Properties

You can verify the changes using this cmdlet:

Get-ADUser -Identity AbbeyCrawford -Properties title,mail | Select-Object -Property title,mail
Replace User Properties

Modify Multiple Attributes for Multiple Users, Example 1

The following script updates several properties for a particular set of users:

  • The first command fetches AD users from the Engineering OU.
  • The output is piped to the second command, which replaces three attributes for all those users.
Get-ADUser -SearchBase " OU=Engineering,OU=Versacorp,DC=corp,DC=com" -filter * -Properties Department,Company,l,st | Set-ADUser -Replace @{Department=”Engineering”;Company="VersaCorp";l=”San Francisco”;St=”CA”}
Modify Multiple Attributes for Multiple Users, Example 1

You can check the results using the following script:

Get-ADUser -SearchBase "OU=Engineering,OU=Versacorp,DC=corp,DC=com" -Filter * -Properties DisplayName,Department,Company,l,st | select-object -property DisplayName,Department,Company,l,St
Modify Multiple Attributes for Multiple Users, Example 1

Modify Multiple Attributes for Multiple Users, Example 2

Similarly, the following script updates the DisplayName attribute of the users in the Engineering OU:

Get-ADUser -Filter 'Name -like "*"' -SearchBase ”OU=Engineering,OU=Versacorp,DC=corp,DC=com”  -Properties DisplayName | % {Set-ADUser $_ -DisplayName ($_.GivenName + ' ' + $_.SurName)}
Modify Multiple Attributes for Multiple Users, Example 2

To inspect the output of this cmdlet, run the following script:

Get-ADUser -SearchBase "OU=Engineering,OU=Versacorp,DC=corp,DC=com" -Filter * -Properties DisplayName | select-object -property DisplayName
Modify Multiple Attributes for Multiple Users, Example 2

Modify Multiple Attributes for Multiple Users, Example 3

Suppose all users in your Boston office are being relocated to the Worcester office, so you need to update the Office attribute for all of them.

First, we create a variable with the appropriate users:

$BostonUsers = Get-ADUser -Filter "physicalDeliveryOfficeName -eq 'Boston'" -Property *

To check this list of users and their offices, we can use this cmdlet:

$BostonUsers | Select-Object Name, Office

The next step is to update the office location of each user. We will again use a ForEach loop:

ForEach ($User in $BostonUsers){Set-ADUser -Identity $User -Office ‘Worcester’}

Finally, to verify that the update was successful, we can use the Get-ADUser cmdlet to display a list of the users in the Worcester office:

Get-ADUser -Filter "physicalDeliveryOfficeName -eq 'Worcester'" -Property * | Select-Object Name,Office

Modify Multiple Attributes for Multiple Users Using a CSV File

Alternatively, you can use a CSV file to provide the list of AD users whose properties you want to modify. Let’s say you have the following CSV file:

Modify Multiple Attributes for Multiple Users Using a CSV File

We can create the “$Users” variable to fetch the information about the users from the CSV file:

$users = Import-csv -Path c:\hr.csv

Then we can use the following script to make the desired changes; the “ForEach” loop iterates through all the user objects and updates their department and title properties:

foreach ($user in $users) {
Get-ADUser -Filter "employeeID -eq '$($user.employeeID)'" -Properties * -SearchBase " OU=Engineering,OU=Versacorp,DC=corp,DC=com" |Set-ADUser -department $($user.department) -title $($user.title) 
}
Modify Multiple Attributes for Multiple Users Using a CSV File

Even though you can execute a script line by line in Windows PowerShell, it is recommended to use the Windows PowerShell ISE for larger scripts, as shown below:

Modify Multiple Attributes for Multiple Users Using a CSV File

Windows PowerShell ISE has two sections:

  • Script Editor
  • PowerShell Console

The following image shows how the cmdlet or script is run. There is a toolbar button for playing and stopping the script.

Modify Multiple Attributes for Multiple Users Using a CSV File

Use Alternate Credentials

By default, Set-ADUser runs in the context of the currently logged-on user. To specify different credentials, use the -Credential parameter.

The following command uses Get-Credential to produce a credential object:

$credential = Get-Credential
Use Alternate Credentials

We can then pass that credential object to the Set-ADUser cmdlet using the -Credential parameter:

Set-ADUser -Identity AbbeyCrawford -Title “Senior Software Developer” -Credential $credential

Clear an Attribute Value

To clear the value for an Active Directory user attribute, use the -Clear parameter. The script below uses the Get-ADUser cmdlet to retrieve users from the specified OU and passes the result to Set-ADUser, which clears the Department attribute:

Get-ADUser -filter * -SearchBase " OU=Engineering,OU=Versacorp,DC=corp,DC=com" | Set-AdUser -clear department
Clear an Attribute Value

To check the results, use the following script:

Get-ADUser -SearchBase "OU=Engineering,OU=Versacorp,DC=corp,DC=com" -Filter * -Properties DisplayName | select-object -property DisplayName,Department
Clear an Attribute Value

Disable AD User Accounts

Whenever a user leaves the organization, it’s vital to ensure their account is deactivated.

First, we’ll use the Get-ADUser cmdlet to check whether the departing user’s account is enabled:

Get-ADUser -Identity AbbeyCrawford -Properties Enabled | Select Enabled
Disable AD User Accounts

The output shows that the account is active (Get-ADUser Enabled is True), so we need to disable it. We can use the following script; the first command gets the AD user’s Enabled property, and the second command disables the user account:

Get-ADUser -Identity AbbeyCrawford -Properties Enabled | Set-ADUser -Enabled $False
Disable AD User Accounts

We can check the results by running the following cmdlet:

Get-ADUser -Identity AbbeyCrawford -Properties DisplayName,Enabled | select-object -Property DisplayName,Enabled
Disable AD User Accounts

Force a Password Change at Next Logon

The following command will modify the value of the UserAccountControl property for all users in the specified OU, forcing them to change their password at the next login:

Get-ADUser -Filter *  -SearchBase "OU=Test,DC=corp,DC=com" | Set-ADUser -ChangePasswordAtLogon $true
Force a Password Change at Next Logon

The following image shows the checkbox we just set:

Force a Password Change at Next Logon

Modify Attributes that Can Have Multiple Values

Some properties, such as ProxyAddress and OtherTelephone, can have multiple values. To modify them, use the -Add and -Remove parameters of Set-ADUser.

To remove a single value, specify the property and the value to remove from it:

Set-ADUser -Identity AbbeyCrawford -Remove @{proxyAddresses="AbbeyCrawford@hotmail.com"}
Modify Attributes that Can Have Multiple Values

To verify the result, use the Get-ADUser cmdlet:

Get-ADUser -Identity AbbeyCrawford -Properties manager | Select-Object -Property manager

Notice that AbbeyCrawford@hotmail.com has been removed from the ProxyAddresses list.

Modify Attributes that Can Have Multiple Values

To add several values, use a comma-separated list, as shown below:

Set-ADUser -Identity AbbeyCrawford -Add @{proxyAddresses="AbbeyCrawford@corp.net","AbbeyCrawford@hotmail.com"}
Modify Attributes that Can Have Multiple Values

To check the results, use the Get-ADUser cmdlet:

Get-ADUser -Identity AbbeyCrawford -Properties proxyaddresses | Select-Object -Property proxyaddresses
Modify Attributes that Can Have Multiple Values

Alternatives to PowerShell for Managing AD Users

Netwrix GroupID Management Shell

Netwrix GroupID Shell is a command-line tool that makes it easy to manage objects in Active Directory and Azure-based identity stores, as well as to perform other administrative activities that you can do with PowerShell.

As you can see here, Netwrix GroupID Shell cmdlets are similar to PowerShell cmdlets:

Netwrix GroupID Management Shell
Netwrix GroupID Management Shell

Here is the Netwrix GroupID Shell cmdlet that is similar to Set-ADUser:

Netwrix GroupID Management Shell

Netwrix GroupID Self-Service Portal

With Netwrix GroupID, you can quickly create web-based portals that enable helpdesk technicians and business users to perform certain tasks without help from the IT team. Users can:

  • Search the directory
  • Update their profiles
  • Create and update directory objects and groups

When users manage their own information, data is more accurate and dependable. Administrators keep complete control over data integrity, though, because they decide what users can see and modify through the portal. Administrators can also build workflows that act as an auditing system to ensure that the correct data is entered before changes are committed to the directory.

Here are some of the user attributes that can be updated through the Self-Service portal:

Netwrix GroupID Self-Service Portal
Netwrix GroupID Self-Service Portal

Windows PowerShell Scripting Tutorial for Beginners

Download your free guide now

We care about security of your data.

Privacy Policy
Since 2012, Jonathan Blackwell, an engineer and innovator, has provided engineering leadership that has put Netwrix GroupID at the forefront of group and user management for Active Directory and Azure AD environments. His experience in development, marketing, and sales allows Jonathan to fully understand the Identity market and how buyers think.