Set ANY AD attribute with PowerShell

How can you set an arbitrary AD attribute with PowerShell?

Of course Get-QADUser and Set-QADUser have a set of default most common attributes the cmdlets retrieve and operate. Thus, for example moving me to marketing could be as simple as:

Set-QADUser "Dmitry Sotnikov" -Department Marketing

However, sometimes (extended schema or necessity to operate a not-so-common sets of attributes) makes you want to go beyond the most common parameters.

In a few recent posts I’ve blogged about:

• Getting a full list of user attributes from AD schema,
• Retrieving and manipulating arbitrary AD attributes,
• Optimizing retrieval by memory and performance.

Now let’s (hopefully) finish the series by talking about how you can set any attribute in AD.

In most cases, when you need to set any of the attributes beyond the default scope, you can do that using the -ObjectAtributes parameter.

For example:

Set-QADUser jsmith -ObjectAttributes @{l=’New York’;description='Reallocated Jan 1'}

changes city and description attributes for user jsmith.

Or

Set-QADUser ‘mycompany.com/usersOU/User1′ -objectAttributes @{otherTelephone=@(’555-34-67′,’555-34-68′)}

sets multivalued otherTelephone attribute to values 555-34-67 and 555-34-68.

Or

[Collections.DictionaryEntry] $de = new-object Collections.DictionaryEntry -argumentList ‘Append, @(’555-34-
67′,’555-34-68′)’
Set-QADUser User1 -objectAttributes @{otherTelephone=$de}

Appends multivalued otherTelephone attribute with values 555-34-67 and 555-34-68.

In some cases you might also need to make sure you supply data in right format because -ObjectAttributes does not convert values of attributes before passing them to AD. For INTEGER8 attributes like accountExpires this
means you must pass only values of types accepted by Microsoft LDAP ADSI:
IADsLargeInteger, string or int.

This means that you would need to do the conversion manually with something like this:

$dateOfExpiration = (get-date -year 2007 -month 10 -day
15).ToFileTime().ToString()
set-qaduser user1 -ObjectAttributes @{accountExpires =
$dateOfExpiration}

Hope this helps (and hope that in most cases the default set of attributes will be more than enough so you won’t need all these advanced tricks).

Dmitry

Tags: AD cmdlets, cmdlets, oneliner, one-liner, AD, Active Directory, Examples