elementary business solutions

Modify attributes of a user account in Active Directory. Supported are both Active Directory Domain Services (AD DS) and Active Directory Lightweight Directory Services (AD LDS).

This cmdlet is part of the Quest ActiveRoles Server product. Use Get-QARSProductInfo to view information about ActiveRoles Server.

Syntax

Set-QADUser [-Identity] <IdentityParameter> [-AccountExpires <System.Nullable`1[System.DateTime]>] [-City <string>] [-Company <string>] [-Connection <ArsConnection>] [-ConnectionAccount <string>] [-ConnectionPassword <SecureString>] [-Control <hashtable>] [-Credential <PSCredential>] [-Department <string>] [-Description <string>] [-DeserializeValues] [-DisplayName <string>] [-Email <string>] [-ExcludedProperties <string[]>] [-Fax <string>] [-FirstName <string>] [-HomeDirectory <string>] [-HomeDrive <string>] [-HomePhone <string>] [-IncludedProperties <string[]>] [-Initials <string>] [-LastName <string>] [-LogonScript <string>] [-Manager <IdentityParameter>] [-MobilePhone <string>] [-Notes <string>] [-ObjectAttributes <ObjectAttributesParameter>] [-Office <string>] [-Pager <string>] [-PasswordNeverExpires <Boolean>] [-PhoneNumber <string>] [-PostalCode <string>] [-PostOfficeBox <string>] [-ProfilePath <string>] [-Proxy] [-SamAccountName <string>] [-Service <string>] [-StateOrProvince <string>] [-StreetAddress <string>] [-Title <string>] [-TsAllowLogon <Boolean>] [-TsBrokenConnectionAction <int>] [-TsConnectClientDrives <Boolean>] [-TsConnectPrinterDrives <Boolean>] [-TsDefaultToMainPrinter <Boolean>] [-TsHomeDirectory <string>] [-TsHomeDrive <string>] [-TsInitialProgram <string>] [-TsMaxConnectionTime <TimeSpan>] [-TsMaxDisconnectionTime <TimeSpan>] [-TsMaxIdleTime <TimeSpan>] [-TsProfilePath <string>] [-TsReconnectionAction <int>] [-TsRemoteControl <int>] [-TsWorkDirectory <string>] [-UseDefaultExcludedProperties <Boolean>] [-UseGlobalCatalog] [-UserMustChangePassword <Boolean>] [-UserPassword <string>] [-UserPrincipalName <string>] [-WebPage <string>] [-Confirm] [-WhatIf] [<CommonParameters>]

Detailed Description

Use this cmdlet to change or remove values of attributes of a user account in Active Directory.

The cmdlet takes a series of optional, attribute-specific parameters allowing you to make changes to user attributes in Active Directory. Thus, to modify the value of the 'givenName', 'sn', or 'l' attribute, you can use the -FirstName, -LastName, or -City parameter, respectively.

If a given attribute is referred to by both the ObjectAttributes array and an attribute-specific parameter, the ObjectAttributes setting has no effect on that attribute. The cmdlet sets the attribute to the value specified by the attribute-specific parameter.

The cmdlet has optional parameters that determine the server and the security context for the operation. Normally, the connection parameters could be omitted so far as a connection to a server is established prior to using the cmdlet. In this case, the server and the security context are determined by the Connect-QADService cmdlet.

If you do not use Connect-QADService and have no connection established prior to using a cmdlet, then the connection settings, including the server and the security context, are determined by the connection parameters of the first cmdlet you use. Subsequent cmdlets will use those settings by default.

Parameters

   -Control @{<name> = <value>; [<name> = <value>] ...}

   'true' if logon is allowed
   'false' if logon is not allowed

   1  (The client session should be terminated.)
   0  (The client session should be disconnected.)

   'true' if reconnection is enabled
   'false' if reconnection is disabled

   'true' if reconnection is enabled
   'false' if reconnection is disabled

   'true' if printing to the client's default printer is enabled
   'false' if printing to the client's default printer is disabled

   1  (Reconnection is allowed from the original client computer only.)
   0  (Reconnection from any client computer is allowed.)

   0  (Remote control is disabled.)
   1  (The user of remote control has full control of the user's session,
         with the user's permission.)
   2  (The user of remote control has full control of the user's session;
         the user's permission is not required.)
   3  (The user of remote control can view the session remotely,
         with the user's permission; the remote user cannot actively control
         the session.)
   4  (The user of remote control can view the session remotely,
         but not actively control the session; the user's permission
         is not required.)

Examples

EXAMPLE 1

set-QADUser 'CN=John Smith,OU=CompanyOU,DC=company,DC=com' -description 'Sales person'

Description

Connect to any available domain controller with the credentials of the locally logged on user, bind to a specific user account by DN, and modify the user description.

EXAMPLE 2

$pw = read-host "Enter password" -AsSecureString

C:\PS>connect-QADService -service 'server.company.com' -ConnectionAccount 'company\administrator' -ConnectionPassword $pw

C:\PS>set-QADUser -identity 'S-1-5-21-1279736177-1630491018-182859109-1305' -description 'Service account'

C:\PS>disconnect-QADService

Description

Connect to a specific domain controller with the credentials of a specific user, bind to a certain user account by SID, modify the user description, and then disconnect.

EXAMPLE 3

$pw = read-host "Enter password" -AsSecureString

C:\PS>connect-QADService -service 'localhost' -proxy -ConnectionAccount 'company\administrator' -ConnectionPassword $pw

C:\PS>set-QADUser -identity 'company\jsmith' -ObjectAttributes @{l='New York';description=''} -UserPassword 'P@ssword'

C:\PS>disconnect-QADService

Description

Connect to the local Administration Service with the credentials of a specific user, bind to a certain user account by Domain\Name, set or clear certain attributes, and then disconnect.

EXAMPLE 4

Set-QADUser 'mycompany.com/usersOU/User1' -objectAttributes @{otherTelephone=@('555-34-67','555-34-68')}

Description

Assign two values to a multi-valued attribute such as "otherTelephone". This replaces the current values of the attribute with the specified values.

EXAMPLE 5

Set-QADUser 'mycompany.com/usersOU/User1' -objectAttributes @{otherTelephone=@{Append=@('555-34-67','555-34-68')}}

Description

Add two values to a multi-valued attribute such as "otherTelephone". This appends the specified values to the existing values of the attribute. The existing values are not removed.

EXAMPLE 6

Set-QADUser 'mycompany.com/usersOU/User1' -objectAttributes @{otherTelephone=@(Delete=@('555-34-67','555-34-68'))}

Description

Delete the specified values from a multi-valued attribute such as "otherTelephone", leaving the other attribute values intact.

EXAMPLE 7

Set-QADUser 'mycompany.com/usersOU/User1' -objectAttributes @{otherTelephone=''}

Description

Delete all values from a multi-valued attribute such as 'otherTelephone' (clear the attribute on the user object).

EXAMPLE 8

set-QADUser '<DN of user object>' -Service 'server.domain.local:389' -description 'My AD LDS user object'

Description

Connect to the AD LDS instance on 'server.domain.local:389' with the credentials of the locally logged on user, bind to a specific AD LDS user object by DN, and modify the description of the AD LDS user object.