Updating the description of a user object

In the previous section, you learned how to search and find a user object. Let's use that logic and get an instance of the ChrisB user object, as shown in the following command:

$UserObj = Get-ADUser -Filter {Name -eq "ChrisB" } -Properties *

The $UserObj variable stores the reference to the ChrisB user object. We can view the current description of the user object by using the following command, assuming the user account has a description set:

$UserObj.Description

To replace the current description with new value, first we need to understand what data type this attribute will accept. As we mentioned before, we can find this out using the GetType() method. You can invoke this method, as shown in the following command:

$userObj.Description.GetType()

The output of this command shows that it accepts data of string, as shown in the following screenshot:

To update the description to a new value, we need to use the Set-ADuser cmdlet and pass the $UserObj to the -Identity parameter and the string that you want to set in the description field to the -Description parameter. The following command will return to the PS prompt in the PowerShell window if it completes without any errors:

Set-ADUser -Identity $UserObj -Description "Added new description via PowerShell"

To verify if the new description is updated in the user description field, we can either check it through the GUI or run the PowerShell command that we used for querying the user object in the preceding command.

Putting everything together, the following code will update the description of a given Active Directory user:

$UserName = "ChrisB"
$NewDescription = "Delete this account after November"
$UserObj = Get-ADUser -Filter {Name -eq $UserName} -Properties *
Write-Host "Current description is : $($UserObj.Description)"
Set-ADUser -Identity $UserObj -Description $NewDescription
$UserObj = Get-ADUser -Filter {Name -eq $UserName} -Properties *
Write-Host "New description is : $($UserObj.Description)"

You can update values of any other attribute using the procedure explained in this code. As a matter of practice, try updating the DisplayName of a user.

Remember? Practice makes perfect!!!

Updating the telephone numbers of multiple users

In the previous example, you learned how to update the value of description using PowerShell. Now, let's take a look at updating telephone numbers of multiple users. This operation is a little different from updating the description operation. Here, we have two complexities, which are as follows:

Let's address these complexities one by one. First, we need to identify attributes that need to be updated. In this demonstration, we want to update the Office telephone number, Home number, and mobile number of the users. If these users already have these numbers set, then we can use the attribute editor to identify the attribute names that need to be updated. If not, set these telephone numbers for one user account and then use attribute editor to identify the attribute names. Alternatively, you can use the Get-ADUser cmdlet to retrieve all attributes. The PowerShell way is preferred here, as we want to learn more and more about it. Examine the output of the following command carefully and identify the attribute names that have the telephone numbers you see in the GUI:

Get-ADUser -Identity chrisB -Properties *

You will notice that the following command has the telephone numbers you see in the GUI:

Get-ADUser -Identity ChrisB -Properties * | select HomePhone, OfficePhone, mobile 

The description of the preceding command is shown in the following:

First, let's update the telephone details of one user, then we can extend the logic to update other users in bulk.

Let's store the numbers in variables first, as shown in the following commands:

$OfficeNumber = "+65 12345678"
$HomeNumber = "+65 87654321"
$MobileNumber = "+65 13578642"

The next step is to update the preceding values for a user account, as shown in the following command:

Set-ADUser -Identity ChrisB -OfficePhone $OfficeNumber -HomePhone $HomeNumber -MobilePhone $MobileNumber

This is straightforward because the Set-ADUser cmdlet has parameters that can set these phone numbers. If the attribute that you are trying to set is not available as a parameter to the cmdlet then you can use the -Add parameter to directly specify the attribute name and the value. Similarly, you can use other parameters such as -Replace and -Clear to work with attributes directly. The preceding example can be rewritten using the -Add parameter, as shown in the following commands:

Set-ADUser -Identity ChrisB -Clear telephonenumber, homephone, mobile
Set-ADUser -Identity ChrisB -Add @{telephonenumber = $OfficeNumber; homephone = $HomeNumber ; mobile = $MobileNumber } 

Here, we are setting the office phone number to the telephonenumber attribute, the home number to the homephone attribute, and the mobile number to the mobile attribute. Before setting them, we will clear existing values using the -Clear parameter.

Now, we can extend this logic to multiple users using a for loop in PowerShell. Before doing this, store the user names and numbers you want to set in a CSV file and import it into PowerShell. The following screenshot shows how the contents of the CSV look:

And the code to set the telephone numbers is as follows:

$Users = Import-CSV c:\temp\usersPhoneNumbers.csv
foreach($User in $Users) {
Set-ADUser -Identity $User.UserName -OfficePhone $User.OfficeNumber -HomePhone $User.HomeNumber -MobilePhone $User.MobileNumber
}

Enabling or disabling user accounts

Now, let's take a look at another scenario where we want to perform bulk user enable/disable operation. Fortunately, there are two cmdlets provided in Active Directory module to make this operation very easy and straightforward.

They are as follows:

Both these cmdlets require an object to be enabled/disabled. The object can be in one of the following formats:

To get these values for a given user, use the Get-ADUser cmdlet (use Get-ADComputer in the case of computer accounts)

Now, it's just a matter of passing the input values to either the Enable-ADAccount or Disable-ADAccount cmdlets based on which operation you want to perform.

Here are some common usage scenarios. These scenarios cover disable operations; to perform enable operations in a similar way, just replace the Disable-ADAccount cmdlet with the Enable-ADAccount cmdlet.

The following command can be used to disable a single user account:

Disable-ADAccount -Identity ChrisB -Passthru

The -PassThru parameter is used to return the object after the completion of the operation. Also it is useful to know the disable status if you want to perform further actions on this object.

You can disable users in a particular OU. The following command will return all users objects under LAB OU and its sub OUs:

Get-ADUser -SearchBase "OU=LAB,DC=techibee,DC=AD" -Filter * | Disable-ADAccount

To limit the search scope to the current OU, use the -SearchScope parameter. It takes three values: Basic (or 0), OneLevel (or 1), a Subtree (or 2). Subtree is the default value when nothing is specified.

Read usernames from a text file and disable them, as shown in the following command:

Get-Content C:\temp\users.txt | % { Disable-ADAccount -Identity $_ }

Here, the Get-Content cmdlet reads the usernames from the text file and passes them one by one to the Disable-ADAccount cmdlet using a foreach loop (% is an alias for a foreach loop in PowerShell). When passing the user name to the Disable-ADAccount cmdlet, we use the $_ automatic variable, which contains the name that is passed from the pipeline. Read more about automatic variables at http://technet.microsoft.com/en-us/library/hh847768.aspx.

You can disable all users in a department, for example, Sales. The following command queries all users who have their department value set to sales and passes them to the Disable-ADAccount cmdlet to disable them:

Get-ADUser -Filter 'Department -eq "sales"' | Disable-ADAccount

Likewise, to perform an enable operation, just replace Disable-ADAccount with the Enable-ADAccount cmdlet in the preceding examples.

Moving user accounts to another OU

For example, let's consider a scenario where all users of one department are moved from one office building to another. So, you would like to move all these user accounts to a new OU for ease of identification and management.

The Move-ADObject cmdlet is available in Active Directory module to accomplish this operation. As you might have already noted, this particular cmdlet can move any object from one OU to another; not just user accounts.

This cmdlet has two mandatory parameters:

Here are some use case scenarios:

You can use the following command to move users from one OU to another based on their department name:

Get-ADUser -Filter 'department -eq "Sales"' | Move-ADObject -TargetPath "OU=Sales,OU=PROD,DC=techibee,DC=AD"