Powershell - help with editing Custom Attributes in AD

[timbo343]

As part of our prep for O365, I'd like to have staff and students see different address lists - something like this https://blogs.msdn.microsoft.com/ukeducloud/2013/04/15/alumni-address-book-policy-in-office-365-education/.

 

Staff would see:

The staff email contacts along with the distribution groups. Also they'd see the Student address list with the student distribution groups

 

Students wouldn't be able to see the staff address lists or the distribution groups.

 

For this to work, i need to edit the Custom Attributes (Extension Attributes) in group policy. Luckily we already can see these in a single user as we have an OnPrem exchange server and have the Attributes Tabs shown however the Custom Attributes/Extension Attributes cannot be edited on mass, therefore we'd have to do this individually.

 

I've got a powershell script that allows me to edit each extension attribute individually but i'd like to extend this to the OU.

 

The script is Set-ADUser *username* -add @{extensionattribute15="test"}. Its only a simple script but i dont know enough of powershell to expand this to the OU or a Group.

 

I wish MS would let us edit the extensionattributes on mass, its possible to do it in exchange.

[Davit2005]

I've successfully used replace for this instead of Add.

 

$extensionAttribute1 = "Test"

 

Set-ADUser -Identity "AD ACCOUNT" -Replace @{extensionAttribute1=$extensionAttribute1}

[timbo343]

Thanks, but is there a way to do this to an OU rather that individual users?

[sparkeh]

You if want to use groups, then you could retrieve the group members then apply the command to each member:

$membersInGroup = Get-ADGroupMember "[i][/i]"

foreach ($member in $membersInGroup)
{
Set-ADUser $member.samaccountname -add @{extensionattribute15="test"}
}

As always, use at own risk and test test test beforehand

Edited March 31, 2017 by sparkeh

[pcstru]

And to enumerate users in an OU should be something like :

$membersInGroup = Get-ADUser -SearchBase “OU=Staff,OU=Users, dc=myschool,dc=org,dc=uk” -Filter * -ResultSetSize 5000 | Select SamAccountName

Which you could use in place of the first line in @sparkeh 's code (previous warnings apply!).

[timbo343]

I may have cheated a bit but i've found a bit of software that will edit the extensionAttributes on mass, and that is the ADModify program hosted on CodePlex https://admodify.codeplex.com/.

 

There's a Tab in the program called "Custom" and lets you edit attributes that aren't shown in the program, therefore it means you can type in extensionAttribute3 for example and give it a value and it will change this attribute based on users in selected OUs or groups.

[3s-gtech]

ADModify is one of my favourite programs of all. It does so much of our AD/Exchange/SfB stuff, including making bulk changes to Exchange attributes directly (we use the MSExchQuerybaseDN attribute to hide addresses from students).

[rama1712]

Can some provide a step to step guide to hiding staff emails from pupils etc by using AD attributes

[timbo343]

Can some provide a step to step guide to hiding staff emails from pupils etc by using AD attributes

Theres a bit of work to do and these guides helped me but i eventually got there.

 

http://www.careexchange.in/how-to-implement-address-book-policies-in-office-365exchange-20132016-effectively-part-3/

 

http://www.flexecom.com/gal-segmentation-in-office-365

 

https://blogs.msdn.microsoft.com/ukeducloud/2013/04/15/alumni-address-book-policy-in-office-365-education/

 

I already had the attributes shown in my AD as we have an onsite cexchange server but you may need to prepare the schema first. Im sure someone can clarify this.

 

In the end, if i can get it to work with a bit of trail and error anyone can get it to work.

 

I've had to implement a few CustomAttributes like:

 

CA15 = All Users

CA14 = *School initials* (This is just incase we become merged with someone else)

CA13 = StafforStudent

CA12 =StudentIntakeYear

CA11 =StudentHouse

CA10 =StudentForm

 

CA2 =StaffStudent-Staff-List.

-- This means that specific staff will show on the Students Staff list such as teachers and a few support staff too. It also means staff see a completely different addresslist too.

 

I'll post up my scripts for creating the addressbook policies later and provide a little explanation with them too.