--- title: "Set-ADUser: Modifying Active Directory Users with PowerShell" description: "Learn how to inspect AD user accounts with the Get-ADUser PowerShell cmdlet and make changes to AD user objects with the Set-ADUser cmdlet." canonical: "https://adamtheautomator.com/set-aduser/" --- # Set-ADUser: Modifying Active Directory Users with PowerShell > Learn how to inspect AD user accounts with the Get-ADUser PowerShell cmdlet and make changes to AD user objects with the Set-ADUser cmdlet. Source: https://adamtheautomator.com/set-aduser/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Set-ADUser: Modifying Active Directory Users with PowerShell](https://adamtheautomator.com/wp-content/uploads/2019/11/male-1354358_1280.png) # Set-ADUser: Modifying Active Directory Users with PowerShell [![](https://secure.gravatar.com/avatar/d0d2f27a9722f2dfe1e0cb0ac68e75dbd5dd01c6f6e7d25440b7a195d4903060?s=192&d=mm&r=g)Kevin Sapp](https://adamtheautomator.com/author/kevinsapp/)12 November 20195 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Active Directory](/tag/active-directory/)[PowerShell](/tag/powershell/) Table of Contents * [Prerequisites/Requirements](#prerequisites-requirements) * [Test Environment Setup Scripts](#test-environment-setup-scripts) * [Inspecting AD User Accounts with Get-ADUser](#inspecting-ad-user-accounts-with-get-aduser) * [Changing AD User Account Properties with Set-ADUser](#changing-ad-user-account-properties-with-set-aduser) * [Changing the Office and State AD Attributes](#changing-the-office-and-state-ad-attributes) * [Changing the Title AD Attribute](#changing-the-title-ad-attribute) * [Using Alternate Credentials](#using-alternate-credentials) * [Disabling AD User Accounts](#disabling-ad-user-accounts) * [Summary](#summary) * [Further Reading](#further-reading) Are you tired of going through the motions of making changes to an Active Directory account using the _Active Directory (AD) Users and Computers (ADUC)_ console application? If so, why not save yourself time and automate the trivial process of updating AD objects with PowerShell using the set-aduser cmdlet! Not a reader? Watch this related video tutorial! **_Not seeing the video? Make sure your ad blocker is disabled._** A common way to modify AD accounts is to use the ADUC installed on your machine. However, with this approach there’s a caveat of taking more time on average to make AD account changes. This task can quickly become very tedious. This article will explain the details on how to use the AD PowerShell cmdlet set-aduser to make changes to AD user accounts. ## Prerequisites/Requirements This article is a walk-through on learning about the `Set-ADUser` PowerShell cmdlet. If you’d like to follow along, ensure that you have the following prerequisites in place. * Read and write permissions to the AD environment you’re using. * The [Remote Server Administration Tools (RSAT) package](https://www.microsoft.com/en-us/download/details.aspx?id=45520) installed. This gives you the required ActiveDirectory [PowerShell module](https://adamtheautomator.com/powershell-modules/ "PowerShell module"). ### Test Environment Setup Scripts To expedite setting up a test environment, you can also download a script called [_Create-OU-Structure.ps1_](https://github.com/CodeDuet/powershell/blob/master/set-aduser_article/Create-OU-Structure.ps1). This script will set up the following OU structure in AD: * Department (Root OU) * Accounting (Nested OU) * Users * Computers * Marketing (Nested OU) * Users * Computers * IT (Nested OU) * Users * Computers To get some AD user accounts to work with you, you can also download and run a [_Populate-AD\_Accounts.ps1_](https://github.com/CodeDuet/powershell/blob/master/set-aduser_article/Populate-AD_Accounts.ps1) PowerShell script. This script will add sample user accounts to the Accounting, Marketing, and IT OUs. The OUs and user accounts created from these two scripts will be used throughout this article. ## Inspecting AD User Accounts with Get-ADUser Before you can modify a user account, you should first read a user account. To read an AD user account, you’ll use the `Get-ADUser` cmdlet. The [`Get-ADUser`](https://adamtheautomator.com/get-aduser/ "Get-ADUser") cmdlet allows you to inspect one or more AD user accounts. To demonstrate, use the `Get-ADUser` cmdlet to inspect the _accountant\_user1_ user account created from the user-provisioning script described earlier. Use the `Identity` parameter to specify the username. This parameter is required. Below you can see we’re using the `Properties` parameter as well. By default, not all AD user account properties are returned. The `Properties` parameter tells `Get-ADUser` to return extra properties. > _The acceptable values for the `Identity` parameter are: Distinguished Name, GUID (objectGUID), Security Identifier (objectSid), and SAM Account Name (sAMAccountName)._ In addition, we’re using the [`Select-Object` cmdlet](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/select-object?view=powershell-7.1&viewFallbackFrom=powershell-6) to limit the output of the  AD properties retrieved from AD. As you can see below, this command only returns the `Name`, `Department`, `physicalDeliveryOffice`_,_ and `State` user attributes. ```powershell PS51> Get-ADUser -Identity accountant_user1 -Properties Name,Department,physicalDeliveryOfficeName,st | Select-Object -Property Name,Department,physicalDeliveryOfficeName,State Name Department physicalDeliveryOfficeName State ---- ---------- -------------------------- -- accountant_user1 Accounting Miami FL ``` ## Changing AD User Account Properties with Set-ADUser Now that you know what the _account\_user1_ user account properties are currently set at, now change them with `Set-ADUser`. The most important parameter you’ll need to use with `Set-ADUser` is the `Identity` parameter. This parameter expects the same value as `Get-ADUser` does. > _You can also use the PowerShell pipeline to pass the output of `Get-ADUser` to `Set-ADUser` as well without explicitly using the `Identity` parameter._ ### Changing the Office and State AD Attributes To demonstrate changing some user account attributes, change the _Office_ AD attribute from Miami to Atlanta and _State_ AD attribute from FL to GA for the _accountant\_user1_ object. You’ll see below that `Set-ADUser` has parameters that correlate to the AD attributes they are changing. ```powershell PS51> Set-ADUser -Identity accountant_user1 -Office 'Atlanta' -State 'GA' ``` > _By default, there is no output when running the_ `Set-ADUser` _command. However, you can change this behavior by adding the [`Verbose`](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_commonparameters?view=powershell-5.1&redirectedfrom=MSDN) parameter. The_ `Verbose` _parameter displays detailed information about the operation being performed by the cmdlet._ Now run `Get-ADUser` using the `Properties` parameter again passing the output of `Get-ADUser` to `Select-Object`. ```powershell PS51> Get-ADUser -Identity accountant_user1 -Properties Name,Department,physicalDeliveryOfficeName,State | Select-Object -Property Name,Department,physicalDeliveryOfficeName,State Name Department physicalDeliveryOfficeName State ---- ---------- -------------------------- -- accountant_user1 Accounting Atlanta GA ``` Viola! The _accountant\_user1_ user object has been changed to include Atlanta and Georgia (as GA), as the `Office` and `State` AD attribute values, respectively. > _Try running the following command to view the full list of parameters available and syntax for the `Set-ADUser` cmdlet: `[Get-help](https://adamtheautomator.com/powershell-get-help/) Set-ADUser`._ ### Changing the Title AD Attribute The `Set-ADUser` cmdlet has several parameters available to change the property values of AD accounts. Just as an example, in this section, you will focus on changing the `Title` property for a single user account. Using the same approach as the previous section, you can see below you can change the `Title` AD attribute using the `Title` parameter on `Set-ADUser`. ```powershell PS51> Set-ADUser -Identity it_user12 -Title 'CIO' ``` Once the change has been made, now check to make sure that the change was successful using `Get-ADUser` just as we did in the previous section. Below you can see the AD attribute `Title` has been changed to _CIO_. ```powershell PS51> Get-ADUser -Identity it_user12 -Properties Name,Department,title | Select-Object -Property Name,Department,title Name Department title ---- ---------- ----- it_user12 IT CIO ``` ## **Using Alternate Credentials** By default, `Set-ADUser` runs under the context of the logged-on user. But you can change this behavior by providing an alternate credential set using the `Credential` parameter. To authenticate to AD with alternate credentials, you have to create a _PSCredential_ object using `Get-Credential` as seen below. > _For more information on creating a PSCredential object, check out the ATA blog post entitled [Using the PowerShell Get-Credential cmdlet and all things credentials](https://adamtheautomator.com/powershell-get-credential/)._ ```powershell PS51> $credential = Get-Credential ``` Now, pass the _PSCredential_ object to the `Credential` parameter with `Set-ADUser` as shown below. This will pass the username and password stored in the credential set to AD to authenticate and make the required change. ```powershell PS51> Set-ADUser -Identity it_user12 -Title 'Senior Software Developer' -Credential $credential ``` ## Disabling AD User Accounts It is best practice to disable AD accounts that are no longer in use or, in a company setting, when people leave an organization. The next task is to disable a single user account in the Marketing OU. First, review the AD user object before you make changes to it with `Get-ADUser` using the `Properties` parameter and `Select-Object` cmdlet you’ve been using throughout this article. You can see an example of inspecting the _market\_user6_ user account below. You can see an `Enabled` property returned of `True`. When disabled, this property will return `False`. ```powershell PS51> Get-ADUser -Identity market_user6 -Properties Name,Department,Enabled | Select-Object -Property Name,Department,Enabled Name Department Enabled ---- ---------- ------- market_user6 Marketing True ``` Next, disable the user objects using the set-aduser cmdlet. Disable the AD account for the _market\_user6_ user using the `Enabled` parameter and setting the value to `$false` or `0`. Below you can see an example of this. > _Find leaked & unsafe passwords in your Active Directory by checking against [the NCSC Password list](https://specopssoft.com/product/specops-password-auditor/?utm_source=ATA&utm_medium=referral&utm_campaign=ATA%20promo%202021&utm_content=SPA%20in-article%20link)._ ```powershell PS51> Set-AdUser -Identity market_user6 -Enabled $False ``` Now, check that the correct changes were implemented by running the `Get-ADUser` command again as shown below. ```powershell PS51> Get-ADUser -Identity market_user6 -Properties Name,Department,Enabled | Select-Object -Property Name,Department,Enabled Name Department Enabled ---- ---------- ------- market_user6 Marketing False ``` The _market\_user6_ user is now disabled in AD! > _Note: You can also leverage using the `Disable-ADAccount` cmdlet to disable AD accounts._ ## Summary In this article, you learned how to inspect AD user accounts with the `Get-ADUser` PowerShell cmdlet and make changes to AD user objects with the `Set-ADUser` cmdlet. The ability to make changes to the user objects in AD is a crucial skill needed in many organizations to remove the need for a GUI and promote automation. Now get automating! ## Further Reading * [_**Active Directory Scripts Galore: Come and Get It!**_](https://adamtheautomator.com/active-directory-scripts/) Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fset-aduser%2F&text=Set-ADUser%3A%20Modifying%20Active%20Directory%20Users%20with%20PowerShell)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fset-aduser%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fset-aduser%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2024/11/image-23.png) ### [Managing Active Directory Groups with PowerShell: The Ultimate Guide](/powershell-ad-groups-guide/) Learn how to manage Active Directory groups with PowerShell! This hands-on guide shows you how to query, create and modify AD groups using practical real-world ![](https://adamtheautomator.com/wp-content/uploads/2019/08/database-152091_1280.png) ### [Active Directory Database: PowerShell Monitoring Made Easy](/active-directory-database/) Find the ntds.dit location and monitor your Active Directory database using PowerShell. ![](https://adamtheautomator.com/wp-content/uploads/2019/07/panic-1393619_1280.png) ### [How to Find Locked Out Users in Active Directory with PowerShell](/find-locked-out-users-in-active-directory-powershell/) See what we can do to find locked out users in Active Directory with PowerShell! ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)