Updating Active Directory Users with PowerShell

Introduction

Managing Active Directory (AD) users efficiently is a crucial task for IT administrators. Often, organizations require bulk updates to user attributes such as names, display names, and more. This blog will guide you through using PowerShell to update AD user details, including handling common errors.

Prerequisites

Before executing the script, ensure that:

• You have administrative privileges on the AD domain.
• The Active Directory module for PowerShell is installed.
• The CSV file containing user details is formatted correctly.

Preparing the CSV File

Create a CSV file (e.g., userdata.csv) with the following headers:

SamAccountName,FirstName,LastName
john.doe,John,Doe
jane.smith,Jane,Smith

This file contains the SamAccountName (username), FirstName, and LastName of each user to be updated.

PowerShell Script for Updating AD Users

Use the following PowerShell script to update GivenName, Surname, DisplayName, and Name attributes:

# Import Active Directory module
Import-Module ActiveDirectory

# Define CSV file path
$CSVFilePath = "c:\PS\userdata.csv"

# Import the CSV file
$Users = Import-Csv -Path $CSVFilePath

foreach ($User in $Users) {
    # Extract user attributes from CSV
    $SamAccountName = $User.SamAccountName
    $FirstName = $User.FirstName
    $LastName = $User.LastName
    $DisplayName = "$FirstName $LastName"

    # Check if the user exists in AD
    $ADUser = Get-ADUser -Filter {SamAccountName -eq $SamAccountName} -Properties DistinguishedName -ErrorAction SilentlyContinue
    
    if ($ADUser) {
        # Update AD user attributes
        Set-ADUser -Identity $SamAccountName `
            -GivenName $FirstName `
            -Surname $LastName `
            -DisplayName $DisplayName

        # Update the "Name" attribute using Rename-ADObject
        Rename-ADObject -Identity $ADUser.DistinguishedName -NewName $DisplayName

        Write-Host "Updated: $SamAccountName - $DisplayName" -ForegroundColor Green
    } else {
        Write-Host "User not found: $SamAccountName" -ForegroundColor Red
    }
}

Explanation of the Script

1. Import Active Directory Module – Ensures the necessary module is available.
2. Import CSV Data – Reads the user details from userdata.csv.
3. Loop Through Users – Iterates through each user and updates their attributes.
4. Set-ADUser – Updates GivenName, Surname, and DisplayName.
5. Rename-ADObject – Changes the Name (Common Name) attribute, which Set-ADUser cannot modify.
6. Error Handling – Uses -ErrorAction SilentlyContinue to prevent script failure if a user is not found.

Common Errors and Solutions

1. The attribute cannot be modified because it is owned by the system

• Cause: The Name attribute cannot be changed with Set-ADUser.
• Solution: Use Rename-ADObject instead, as shown in the script.

2. User Not Found

• Cause: The SamAccountName in the CSV does not match any AD user.
• Solution: Verify the usernames in Active Directory using Get-ADUser.

3. Insufficient Privileges

• Cause: The script is not run as an administrator.
• Solution: Open PowerShell as an administrator.

Conclusion

This PowerShell script simplifies the process of updating user details in Active Directory. By leveraging PowerShell’s automation capabilities, administrators can efficiently manage large-scale AD modifications with minimal effort. If you have any questions or need further customization, feel free to comment below!