How to update Active Directory attributes using PowerShell

Active Directory (AD) is a critical component in most Windows-based IT environments, serving as a central repository for user accounts, group memberships, and other network-related information. Often, organizations need to update user attributes in AD to keep their directory information accurate and up-to-date. PowerShell, Microsoft’s scripting and automation framework, provides a powerful and efficient way to perform these updates.

In this blog post, we will explore how to update Active Directory attributes using PowerShell. We will cover essential concepts, provide practical examples, and offer some best practices to help you manage AD attributes effectively.

Prerequisites

Before you begin, ensure you have the following:

1. Access to an Active Directory domain.
2. PowerShell installed on your computer.
3. Sufficient permissions to read and modify AD attributes.

Recommended Articles

• Enabling External Out of Office Messages in Microsoft 365
• Message store has reached its maximum size outlook
• How to change Outlook Language on left Blade
• How to Connect with Microsoft Exchange Online PowerShell | Exchange 365

Getting Started

1. Open PowerShell: Launch PowerShell with administrative privileges to ensure you have the necessary permissions to make changes.
2. Load Active Directory Module (if not already loaded): If you’re running a newer version of Windows Server or Windows 10, the Active Directory module should already be available. You can verify this by running:

Get-Module -Name ActiveDirectory

• If it’s not installed, you can install it using the following command:

Install-WindowsFeature RSAT-AD-PowerShell

Updating AD Attributes

Now that you have the required tools and permissions in place, let’s dive into updating AD attributes using PowerShell. Here are some common tasks:

Changing User Password:

To change a user’s password, you can use the Set-ADAccountPassword cmdlet:

Set-ADAccountPassword -Identity "Username" -NewPassword (ConvertTo-SecureString "NewPassword" -AsPlainText -Force)

• Replace “Username” with the user’s username and “NewPassword” with the new password.

Updating User Attributes:

You can modify user attributes such as email address, phone number, or job title using Set-ADUser:

Set-ADUser -Identity "Username" -EmailAddress "new.email@example.com" -OfficePhone "123-456-7890" -Title "New Title"

• Replace “Username,” “new.email@example.com,” “123-456-7890,” and “New Title” with the appropriate values.

Adding/Removing Users from Groups:

To add a user to a group, you can use Add-ADGroupMember, and to remove, use Remove-ADGroupMember:

Add-ADGroupMember -Identity "GroupName" -Members "Username"
Remove-ADGroupMember -Identity "GroupName" -Members "Username"

Bulk update Active Directory attributes [CSV File Import]

Using a Comma-Separated Values (CSV) file is a practical way to update AD attributes in bulk. Here’s how you can do it:

Step 1: Create a CSV File

Create a CSV file that contains at least two columns: one for the object’s unique identifier (e.g., SamAccountName or DistinguishedName) and another for the attribute you want to update. For example:

SamAccountName,Department
user1,HR
user2,IT
user3,Finance

Step 2: Import the CSV and Update Attributes

Use PowerShell to import the CSV file and update the attributes:

Import-Csv "C:\Temp\file.csv" | foreach {Set-ADUser -Identity $_.SamAccountName –Department $_.Department}

Best Practices