AD User Attributes Bulk Modification

[JosPhantasmE]

My first post in this forum.

 

I just started working with windows server 2008 r2 and as a apprentice it have been a pleasure to work with WS2008R2. But, now I came across with this problem where I have over 100 users and I need to modify some attributes of each one of them, to be more specific in the "Sessions" and "Environment" tabs.

 

Is just a tedious task to do and I would like to know if there is any tool, script or anything else that can help me get this job done by bulk...?

 

Thanks.

[pcstru]

You can do it in Powershell. There's a script here which is a good starting point. You just need to mod it to modify attributes of objects that already exist.

[Marci]

Bulk AD Users

 

[Arthur]

If you need to clear AD attributes you could use this script as a starting point.

 

Import-Module ActiveDirectory

$users = Import-Csv -Path C:\Scripts\adtest.csv
                       
foreach ($user in $users) {
# Search in specified OU and Update existing attributes
Get-ADUser -Filter "SamAccountName -eq '$($user.samaccountname)'" -Properties * -SearchBase "cn=Users,DC=manticore,DC=org" |
 Set-ADUser -Clear l, physicalDeliveryOfficeName, division
}

 

... or this one to modify values.

 

Import-Module ActiveDirectory
           
$users = Import-CSV -Path C:\Scripts\adtest.csv

foreach ($user in $users) {
# Search in specified OU and Update existing attributes
Get-ADUser -Filter "SamAccountName -eq '$($user.samaccountname)'" -Properties * -SearchBase "cn=Users,DC=manticore,DC=org" |
 Set-ADUser -City $($user.City) -Office $($user.Office) -Division $($user.Division)
}

 

Bulk AD Users is also good.

[mdrabble]

Another nice little tool is ADModify. I used this when I had to tweak AD attributes for Exchange.

[3s-gtech]

ADModify.net is ace. USed it to add all sorts of things - main thing was adding the mandatory profile path to 850 users in five minutes!

[Duke5A]

Use dsquery and pipe its output to dsmod.

 

dsquery user "ou=2013,ou=grad year,ou=students,ou=users someschool,dc=someschooldistrict,dc=com" | dsmod user -pwdneverexpires no -canchpwd yes

 

The above would modify every user in that OU to having their password expire and be given ability to change it.

[Jamo]

Use dsquery and pipe its output to dsmod.

 

dsquery user "ou=2013,ou=grad year,ou=students,ou=users someschool,dc=someschooldistrict,dc=com" | dsmod user -pwdneverexpires no -canchpwd yes

 

The above would modify every user in that OU to having their password expire and be given ability to change it.

 

 

Bulk AD Users is an amazing tool, cant recommend enough

[plexer]

ADModify.net is ace. USed it to add all sorts of things - main thing was adding the mandatory profile path to 850 users in five minutes!

 

If running 2008 R2 possibly 2008 as well that is one property you can bulk change from ADUC.

 

Ben

[JosPhantasmE]

I have tried "Bulk AD Users", but it have never worked for me. Apparently is only compatible with WS2003 only. Same thing happened with "ADModify.net" Edited December 20, 2012 by JosPhantasmE

[3s-gtech]

Doesn't it work? I've used admodify.net with a Server 2008 R2 DC, last time I used it, it was running on 2008 functional level so may not work now on 2008 R2 but should do.

 

Much better that it's in ADUC now, common sense really.

[JosPhantasmE]

With "Bulk AD Users" I get this error: "Failure: TsUserEx.dll is required to read/modify terminal services attributes. You might need to install the Windows 2003 Administrative Tools Pack. (Which is not compatible with windows server 2008 R2)" And then, when I try to use ADmodify.Net all options are grayed out and I got this message at the bottom "Terminal Server and CDOEXM Modifications Disabled."

[JosPhantasmE]

ADModify.net is ace. USed it to add all sorts of things - main thing was adding the mandatory profile path to 850 users in five minutes!

 

What OS where you using?

[3s-gtech]

2008 R2, but also 2003 in the past.

[JosPhantasmE]

So there is not an easy way to do this...?

[Jamo]

With "Bulk AD Users" I get this error: "Failure: TsUserEx.dll is required to read/modify terminal services attributes. You might need to install the Windows 2003 Administrative Tools Pack. (Which is not compatible with windows server 2008 R2)" And then, when I try to use ADmodify.Net all options are grayed out and I got this message at the bottom "Terminal Server and CDOEXM Modifications Disabled."

 

 

Where are you running Bulk AD users from? Try it from your workstation, works on my Windows 7 station

[JosPhantasmE]

I'm runing it, in my windows 2008 r2 server. This is driving me crazy, any ideas?

[featured_spectre]

Sadly no easy way to do it.

 

Export to excel and do it manually on there (copy and paste perhaps). Failing that, I would have done any number of the above posts. Powershell would have been next.

[JosPhantasmE]

Since there is not easy solution I've been looking for the proper command to fill that field and noting at all... :S

[pcstru]

In powershell? Something like ...

 

# Set an ExtensionAttribute

$dn = (Get-ADUser $sam).DistinguishedName

$ext = [ADSI]"LDAP://$dn"

$ext.Put("extensionAttribute", $value)

$ext.SetInfo()

[JosPhantasmE]

Thanks for your response, honestly I'm not really familiar with powershell, would you explain to me how to do it step by step and what does each line does?

Thanks and sorry for my ignorance.

[pcstru]

$dn = (Get-ADUser $sam).DistinguishedName

 

Searches for a user in AD on distinguished name. User to search for is held in $sam variable. Creates a reference to this in $dn.

 

$ext = [ADSI]"LDAP://$dn"

 

Creates an instance of an ADSI object based on the previous search.

 

$ext.Put("extensionAttribute", $value)

 

Puts $value into the named extension attribute.

 

$ext.SetInfo()

 

Writes the change.

 

You need to modify the script I pointed out earlier so that it reads a file of account identifier (whatever that might be), searches for that and then if found, modifies the attributes you want. I have almost the code you need but not to hand. I'll try and remember to look it out tonight. If you are totally unfamiliar with Powershell then you will need to do a bit of learning!

[Jamo]

Since there is not easy solution I've been looking for the proper command to fill that field and noting at all... :S

Use a Windows 7 machine which is joined to the domain, it is far easier!

[JosPhantasmE]

Thanks you and I hope you remember, and yes that's what I want, learn.

[JosPhantasmE]

And how can that machine access the AD users?