Set-ADObject – Modify Active Directory Object Properties

Set-ADObject cmdlet in Active Directory modifies the properties of an Active Directory object. You can modify commonly used property values using Set-ADObject cmdlet parameters like Add, Replace, Remove and Clear parameters.

You can use the Identity parameter to specify which Active Directory object to retrieve for modification. You can identify an object by its distinguished name or GUID. Another way to get an Active Directory object is to use the Get-ADObject cmdlet to retrieve an AD object and pass the object through the pipeline to the Set-ADObject cmdlet.

In this article, I will explain how to use Set-ADObject to modify properties of an active directory object like sets descriptions for the site, protect objects from accidental delete.

Set-ADObject Syntax

Set-ADObject cmdlet modifies active directory object properties.

Syntax:

Set-ADObject
   [-WhatIf]
   [-Confirm]
   [-Add <Hashtable>]
   [-AuthType <ADAuthType>]
   [-Clear <String[]>]
   [-Credential <PSCredential>]
   [-Description <String>]
   [-DisplayName <String>]
   [-Identity] <ADObject>
   [-Partition <String>]
   [-PassThru]
   [-ProtectedFromAccidentalDeletion <Boolean>]
   [-Remove <Hashtable>]
   [-Replace <Hashtable>]
   [-Server <String>]
   [<CommonParameters>]

Parameters:

-AuthType: It specifies the authentication method to use. The acceptable values for this parameter are Basic or Negotiate. The default authentication method is Negotiate.

-Credential: It specifies the user account credentials to perform the task. By default, it uses currently logged-on user credentials. You can use the Get-Credential cmdlet to get user credentials.

-Identity: It specifies an Active Directory object using the distinguished name, GUID. You can also use Get-ADObject to get adobject and pass the object through the pipeline to Set-ADObject.

Set-ADObject Identity parameter accepts either DistinguishedName or GUID. It doesn’t accept SAMAccountName.

-Description: It Specifies the description of the object. This parameter sets the value of the Description property for the object.

-DisplayName: It Specifies the display name of the object. This parameter sets the value of the DisplayName property for the object.

-Add: It Specifies values to add to an ad object property.

Clear: It specifies an array of object properties that are cleared in the directory. Use this parameter to clear one or more values of properties that cannot be modified using a cmdlet parameter.

-Remove: It specifies to remove one or more values of property that cannot be modified using a cmdlet.

-Replace: Use this parameter to replace one or more values of property that cannot be modified using a cmdlet parameter.

Let’s understand the Set-ADObject cmdlet to modify active directory object properties using examples.

Set-ADObject Description for Site

You can set the Description property for the active directory object Site using the below command

Get-ADObject -Identity "CN=Houston,CN=Sites,CN=Configuration,DC=SHELLPRO,DC=LOCAL" | Set-ADObject -Description "Houston Site"

In the above PowerShell script, the Get-ADObject cmdlet gets the active directory object by its distinguishedname and passes the output to the Set-ADObject cmdlet.

Set-ADObject uses Description parameter to set Description property for site.

The output of the above command as below

Set-ADObject Description
Set-ADObject Description

Cool Tip: How to use get-adprincipalgroupmembership in Active Directory!

Use Set-ADObject to Protect from Accidental Delete

Set-ADObject cmdlet in PowerShell has ProtectedFromAccidentalDeletion the property that accepts either $True or $False value to prevent active directory objects from accidental deletion.

Use the below command to protect organizational unit instances from accidental deletion.

Set-ADObject -Identity "OU=FINANCE,DC=SHELLPRO,DC=LOCAL" -ProtectedFromAccidentalDeletion $True

Set-ADObject to modify Displayname

You can use the Set-ADObject cmdlet to modify the DisplayName property for the active directory group.

Get-ADObject -Identity "CN=SALESLeader,OU=SALES,DC=SHELLPRO,DC=LOCAL" | Set-ADObject -DisplayName "Sales Leader"

In the above Set-ADObject example script,

Get-ADObject cmdlets get active directory group and pass output object to Set-ADObject cmdlet.

Set-ADObject uses the DisplayName parameter to modifies the AD group display name property.

Using Set-ADObject Replace Parameter

The set-ADObject cmdlet has Replace, Remove parameter to modify commonly used property values of ad object.

Set-ADObject -Identity "CN=Aron Seth,OU=HR,DC=SHELLPRO,DC=LOCAL" -Remove @{url="www.example.com"} -Replace @{description="HR Manager"}

Set-ADObject uses the Identity parameter to modify active directory user attributes values like URL and description.

Set-ADObject Remove parameter to remove URL attribute.

Set-ADObject Replace parameter relace existing aduser description property with specified Description value.

Cool Tip: How to use search-adaccount cmdlet in PowerShell!

Conclusion

I hope the above article using Set-ADObject to modify the property value of an active directory.

Use Get-ADObject cmdlet to get active directory object and pass ad object pipeline to Set-ADObject cmdlet.

The set-ADObject cmdlet does not work with a read-only domain controller and active directory snapshot.

You can find more topics about PowerShell Active Directory commands and PowerShell basics on ShellGeek home page.

Leave a Comment