Moving AD objects

Another new cmdlet in the 1.0.4 pack is Move-QADObject which allows you to move AD objects: users, groups, computers, OUs within the current domain.

The syntax is pretty easy:

Move-QADObject -Identity object-to-move -NewParentContainer target

Identity is the default parameter so you can skip the switch. You can supply almost anything as the parameter as long is it can identify the object in a unique fashion: samAccountName, DN, canonical name, domain\user, UPN, SID, GUID, etc.

The -NewParentContainer switch has a handy alias -to. The actual parameter is again pretty much anything unique enough. In my opinion DN or canonical name would make sense in most cases.

And the best of that all: the cmdlet accepts pipeline.

Here’s a bunch of examples of how this all works:

# Move a user
Move-QADObject dsotnikov -to qsft.local/employees/cto

# Move by location
Get-QADUser -City London | Move-QADObject -to qsft.local/employees/london

# Move all disabled account
Get-QADUser -Disabled | Move-QADObject -to qsft.local/disabled_accounts

# Use csv: first row is "object,target",
# then each column has comma-separated object and container identities

Import-CSV c:\tomove.csv | ForEach { Move-QADObject $_.object -to $ }

# Move groups, computers, etc.
Move-QADObject qsft\researchers -to qsft.local/groups

Get-QADComputer ny* | Move-QADObject -to qsft.local/ny/computers

# Move OU (with all objects and subcontainers)
Move-QADObject qsft.local/users/london -to qsft.local/employees/eu/uk

So next time you have to completely reconfigure your AD domain you know what to do, right? 😉


Tags: , , , , , , ,

13 Responses to “Moving AD objects”

  1. 1 Don February 18, 2008 at 6:47 pm

    Does this need to be ran from a Domain Controller or can I run it from my XP box with the 2003 Admin Pack installed?

  2. 2 dmitrysotnikov February 18, 2008 at 7:52 pm

    Any workstation which has PowerShell and AD cmdlets [] installed

  3. 3 Jeff May 15, 2008 at 5:31 pm

    When I try to import a computer name and DN from a csv file and then use the move-qadobject as in your example above, I get the error: ‘$’ was not followed by a valid variable name character. Consider using ${} to delimit… Any idea what I am doing wrong?

  4. 4 dmitrysotnikov May 15, 2008 at 7:53 pm


    It is very hard to tell what is going wrong without seeing the CSV and the command you are using.

    Could you post both of them to the AD PowerShell discussion forum:


  5. 5 Jeff May 15, 2008 at 9:46 pm

    Thanks, just figured it out though!

  6. 6 Mike June 12, 2008 at 2:12 pm

    Has anyone had a problem with using Move-QADObject -to ‘domain.local/test-ou/sub ou with spaces’

    when i try to run the full command
    Get-QADUser -Disabled | Move-QADObject -to ‘domain.local/test-ou/sub ou with spaces’

    it returns
    Move-QADObject : Cannot resolve DN for the given identity: domain.local/test-ou/sub ou with spaces’

    seems weird that it wouldn’t let me go that deep then again I could very well be doing this wrong.

  7. 7 dmitrysotnikov June 12, 2008 at 2:17 pm


    Cannot test it right now, but a few suggestions:

    1. Complain to the AD cmdlets forum: – the team is normally there and eager to help troubleshoot issues.

    2. Try using a DN instead of the canonical name.


  8. 8 Mike June 12, 2008 at 2:57 pm

    That worked better (the DN rather than the CN) thanks for the fast response!

  9. 9 zerocamber November 11, 2008 at 8:52 pm

    how to i specify computer accounts only. i get ambigous argument when i run this script.

  10. 10 zerocamber November 11, 2008 at 9:59 pm

    I found it would move user account that had the same names when I didn’t specify the container. I came up with this instead. I’m very new to PowerShell so I might have done something wrong.. here it is.

    Import-CSV c:\temp\filename.csv | ForEach $_ { Get-QADComputer $_.’computers’ | Move-QADObject -to ‘canonical=domain/../…’}

    I suggest running …’ -whatif} for your testing.

    This might be over kill until I figure PS out

  11. 11 Dmitry Sotnikov November 12, 2008 at 10:11 am


    Yep, using Get-QADComputer is a good approach when you need to limit the scope to computers only.

    In the future I would highly recommend posting such questions to the PowerShell AD forum at: – there are a lot of smart guys hanging out there and eager to help.


  12. 12 Jordi May 20, 2010 at 7:43 am

    There is also a “low-tech” solution using the dsmod command. E.g. to move mail contacts:

    get-mailcontact | % { dsmove $_.DistinguishedName -newparent “OU=Contacts,OU=Admin,OU=Mail,DC=yourdomain” }

  13. 13 Jordi May 20, 2010 at 7:46 am

    As you can see from the sample the right command is dsmove, not dsmod (which just modifies attributes). Sorry for the mistake…

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

My Recent Tweets


The posts on this blog are provided “as is” with no warranties and confer no rights. The opinions expressed on this site are mine and mine alone, and do not necessarily represent those of my employer - WSO2 or anyone else for that matter. All trademarks acknowledged.

© 2007-2014 Dmitry Sotnikov

August 2007

%d bloggers like this: