PowerShell working with Comma Separate File Data

Test File

 

Read the complete CSV file contents into a string:

Code:

$CSV2String  = Get-Content -path "C:\Temp\Test-File.csv"

write-host "[$CSV2String]"

 

Output:

[User001, DFdP, FmpD User002, weKC, v85F User003, va2W, gwkE User004, fBBn, dhey User005, cUmC, 9vpK User006, xESN, FDTc User007, FL4p, EpgS User008, 9EV9, GBTc User009, NtPA, NGDN User010, FKcY, 1NCL]

 

 

Read the CSV file line by line.  Print each of the CSV file line in its CSV format

Code:

$CSV2String  = Get-Content -path "C:\Temp\Test-File.csv"

foreach ($line in $CSV2String) {
    write-host "[$line]"

}

 

Output:

[User001, DFdP, FmpD]
[User002, weKC, v85F]
[User003, va2W, gwkE]
…

 

Remove any spaces in CSV data

Code:

$CSV2String  = Get-Content -path "C:\Temp\Test-File.csv"

foreach ($line in $CSV2String) {
    # use below code if you need to replace any spaces in the data of csv file
    $line_text = $line -replace " ", ""
    write-host "[$line_text]"

}

 

Output:

[User001,DFdP,FmpD]
[User002,weKC,v85F]
[User003,va2W,gwkE]
…

 

Print each of the data in CSV file line after removing spaces:

Code:

$CSV2String  = Get-Content -path "C:\Temp\Test-File.csv"
  
foreach ($line in $CSV2String) {
    # use below code if you need to replace any spaces in the data of csv file
    $line_text = $line -replace " ", ""
    $text      = $line_text -split ","
    foreach($string in $text) {
        Write-Host "[$string]"
    }
}

 

Output:

[User001]
[DFdP]
[FmpD]
[User002]
[weKC]
…

 

 

Operate on Data in CSV fields

Code:

foreach ($line in $CSV2String) {
    # use below code if you need to replace any spaces in the data of csv file
    $line_text = $line -replace " ", ""
    $text      = $line_text -split ","
    foreach($string in $text) {
        $Username    = $text[0]
        $Data1       = $text[1]
        $Data2       = $text[2]
        if ($Username -eq ‘User001′) {
            Write-Host "Processing [$Username]: User Data is: [$Data1] and [$Data2] "
        }
    }
}

 

Output:

Processing [User001]: User Data is: [DFdP] and [FmpD]
Processing [User001]: User Data is: [DFdP] and [FmpD]
Processing [User001]: User Data is: [DFdP] and [FmpD]

PowerShell Script to Auto generate Random Simple String Passwords

Script:

cls

$Private:OFS = ""

$PasswordLength = 8

$InclChars = ‘abcdefghkmnprstuvwxyzABCDEFGHKLMNPRSTUVWXYZ123456789′

$RandomNums = 1..$PasswordLength | ForEach-Object { Get-Random -Maximum $InclChars.length }

$RandomPassowrd = [String]$InclChars[$RandomNums]

Write-Host $RandomPassowrd

 

 

Output:

cAbfE1GN

Ea5kMabu

spx3sFW7

 

 

Script:

PowerShell Output Field Separator ($OFS variable)

$OFS which is a special variable in Powershell. OFS stands for Output Field Separator. It exposes the .Net’s Systems.String object. as shown below

 

You would use this to separate objects in your array

For example:

If you run the below code to display objects in $array you’ll see the objects displayed one in each new line as that is the default object separator:

CODE:

$array = (1,3,5,7)
$array

 

OUTPUT:

1
3
5
7

 

 

By using $OFS variable, you’ll be able to specify your own separator character as shown below:

Note: as the OFS operates on strings, you need to convert the objects in array into String by using the type casting as in below example

CODE:

$array = (1,3,5,7)
$OFS =’^';[string]$array

OUTPUT:

1^3^5^7

 

 

An alternate to specify your string objects separator at any point in time of your code is by referring the OFS variable as private.

CODE:

$private:ofs=">"
$array = (1,3,5,7)
[string]$array

OUTPUT:

1^3^5^7

Windows PowerShell 2.0 – The Get-Random Cmdlet

 

The information in this article was written against the second Community Technology Preview (CTP2) of Windows PowerShell 2.0. This information is subject to change in future releases of Windows PowerShell 2.0.

Randomize Your Results with the Get-Random Cmdlet

No doubt when it came time for the 2008 Winter Scripting Games many of you thought, “Gee, I’d love to enter the Scripting Games, except for one thing: the solutions to the Scripting Games often require you to use random numbers, and Windows PowerShell doesn’t have a cmdlet that makes it a snap to generate random numbers. If PowerShell had a cmdlet for generating random numbers, why, I’d enter the Scripting Games in a heartbeat!” Well, we’ve got good news for those of you who’ve been waiting for a random number generator to be added to Windows PowerShell: just wait until you see Get-Random, a new cmdlet added to the Windows PowerShell 2.0 of PowerShell.

Looks like we’ll be seeing you at the 2009 Winter Scripting Games, eh?

Of course, Get-Random does have uses beyond just helping you rack up points in the Winter Scripting Games. Before we discuss those uses, however, let’s take a moment to explain how Get-Random actually works. In its simplest form, you can call Get-Random without any additional parameters; in turn, Get-Random will generate a random integer between 1 and 2,147,483,647. In other words:

Copy

PS C:\Scripts> Get-Random

965837031

And there you have it.

Being able to generate a random number between 1 and 2,147,483,647 is useful for the Scripting Guys; after all, that helps them keep track of the money in their checking account. More often than not, however, you’ll want to place slightly-stricter limits on the random numbers that get generated; for example, you might want to choose a random number between 1 and 100. That’s fine; Get-Random lets you do just that, provided you include the –minimum and –maximum parameters:

Copy

PS C:\Scripts> Get-Random -minimum 1 -maximum 101

And yes, -maximum must always be set to 1 more than the high number in the range. That means that, to select a random number between 1 and 100, we must set –maximum to 101; if we set –maximum to 100 then we’d actually select a random number between 1 and 99.

By contrast, -minimum is always set to the actual low end of the range. What if we wanted to select a random number between 200 and 299? Then we’d use this command:

Copy

PS C:\Scripts> Get-Random -minimum 200 -maximum 300

And so on.

But here’s the really cool thing about Get-Random: it can do more than just generate random numbers. For example, you can use Get-Random to randomly select from a list of names:

Copy

($a = "Dasher","Dancer","Prancer","Vixen","Comet","Cupid","Donder","Blitzen" ) | Get-Random

All we’ve done here is create an array named $a and then pipe that array to Get-Random; in turn, Get-Random will randomly select one of the items in the array:

Copy

Vixen

Incidentally, we could perform this same task by using the –input parameter rather than by creating an array:

Copy

Get-Random -input "Dasher","Dancer","Prancer","Vixen","Comet","Cupid","Donder","Blitzen"

Oh, and here’s a cool thing. What if you wanted to randomly select three reindeer? That’s easy; just add the –count parameter, like so:

Copy

($a = "Dasher","Dancer","Prancer","Vixen","Comet","Cupid","Donder","Blitzen" ) | Get-Random -count 3

That’s going to give us output similar to this:

Copy

Prancer

Donder

Dancer

You say that you don’t have an array of reindeer names, instead you have all the reindeer names in a text file like this one:

Copy

Dasher

Dancer

Prancer

Vixen

Comet

Cupid

Donder

Blitzen

That’s fine; just use the Get-Content cmdlet to read in the contents of the text file, then pipe that information to Get-Random:

Copy

Get-Content C:\Scripts\Test.txt | Get-Random

In this case Get-Random will randomly select a line from the text file:

Copy

Cupid

As far as we know, Get-Random handles pretty much any data you throw at it. For example, suppose, for testing purposes, you need to randomly select three files from the folder C:\Scripts. This command should do the trick:

Copy

Get-ChildItem C:\Scripts | Get-Random -count 3

In other words:

Copy

Mode LastWriteTime Length Name

—- ————- —— —-

-a— 7/30/2007 11:33 AM 977 test1.vbs

-a— 10/24/2007 2:42 PM 32124 new_cmdlets.txt

-a— 7/24/2007 9:54 AM 273 identify_winrm.vbs

Etc., etc.

Top of page

Related Links

• Scripting with Windows PowerShell Home

Source: Windows PowerShell 2.0 – The Get-Random Cmdlet

PowerShell: Start-Process cmdlet

DESCRIPTION
Starts one or more processes on the local computer.  To specify the program that runs in the process, enter an executable file or script file, or a file that can be opened by using a program on the computer. If you specify a non-executable file, Start-Process starts the program that is associated with the file, much like the Invoke-Item cmdlet.
    
You can use the parameters of Start-Process to specify options, such as loading a user profile, starting the process in a new window, or using alternate credentials.

SYNTAX

Start-Process [-FilePath] <string> [[-ArgumentList] <string[]>] [-PassThru] [-Verb <string>] [-Wait] [-WindowStyle {Normal | Hidden | Minimized | Maximiz
ed}] [-WorkingDirectory <string>] [<CommonParameters>]

 

Example: To launch Outlook in Maximized Window mode automatically

Start Outlook -WindowStyle Maximized

Disable “Welcome to Internet Explorer 8” prompt for first time IE8 launch

Prompt Window:

 

Disable Via Registry:

 

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"IE8RunOnceLastShown"=dword:00000001
"IE8RunOnceLastShown_TIMESTAMP"=hex:68,2d,96,3d,b7,ce,cc,01
"IE8TourShown"=dword:00000001
"IE8TourShownTime"=hex:58,6d,47,3f,b7,ce,cc,01

Accessing User MyDocuments Folder Path via Powershell

Sample Code:

PS C:\> $MyDocs = [System.Environment]::GetFolderPath("MyDocuments")
PS C:\> Write-host $MyDocs
C:\Users\TestUser1\Documents
PS C:\>

 

Listing all the SpecialFolders available via Environment Variables.

Code:

cls
### Start of Script

### Get the list of special folders
$folders = [system.Enum]::GetValues([System.Environment+SpecialFolder])

# Display these folders
"Folder Name            Path"
"———–            ———————————————–"

foreach ($folder in $folders) {
    "{0,-22} {1,-15}"  -f $folder,[System.Environment]::GetFolderPath($folder)
    }

#End of Script

 

Output:

Folder Name            Path
———–            ———————————————–
Desktop                C:\Users\Testuser1\Desktop
Programs               C:\Users\Testuser1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
Personal               C:\Users\Testuser1\Documents
Personal               C:\Users\Testuser1\Documents
Favorites              C:\Users\Testuser1\Favorites
Startup                C:\Users\Testuser1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Recent                 C:\Users\Testuser1\AppData\Roaming\Microsoft\Windows\Recent
SendTo                 C:\Users\Testuser1\AppData\Roaming\Microsoft\Windows\SendTo
StartMenu              C:\Users\Testuser1\AppData\Roaming\Microsoft\Windows\Start Menu
MyMusic                C:\Users\Testuser1\Music
DesktopDirectory       C:\Users\Testuser1\Desktop
MyComputer                           
Templates              C:\Users\Testuser1\AppData\Roaming\Microsoft\Windows\Templates
ApplicationData        C:\Users\Testuser1\AppData\Roaming
LocalApplicationData   C:\Users\Testuser1\AppData\Local
InternetCache          C:\Users\Testuser1\AppData\Local\Microsoft\Windows\Temporary Internet Files
Cookies                C:\Users\Testuser1\AppData\Roaming\Microsoft\Windows\Cookies
History                C:\Users\Testuser1\AppData\Local\Microsoft\Windows\History
CommonApplicationData  C:\ProgramData
System                 C:\Windows\system32
ProgramFiles           C:\Program Files
MyPictures             C:\Users\Testuser1\Pictures
CommonProgramFiles     C:\Program Files\Common Files

 

Reference:

1. Environment.SpecialFolder Enumeration
2. c# – Expand environment variable for My Documents – Stack Overflow

Set-ADServiceAccount

Set-ADServiceAccount

Modifies an Active Directory service account.

Syntax

Copy

Set-ADServiceAccount [-Identity] <ADServiceAccount> [-AccountExpirationDate <System.Nullable[System.DateTime]>] [-AccountNotDelegated <System.Nullable[bool]>] [-Add <hashtable>] [-Certificates <string[]>] [-Clear <string[]>] [-Description <string>] [-DisplayName <string>] [-Enabled <System.Nullable[bool]>] [-HomePage <string>] [-Remove <hashtable>] [-Replace <hashtable>] [-SamAccountName <string>] [-ServicePrincipalNames <hashtable>] [-TrustedForDelegation <System.Nullable[bool]>] [-AuthType {<Negotiate> | <Basic>}] [-Credential <PSCredential>] [-Partition <string>] [-PassThru <switch>] [-Server <string>] [-Confirm] [-WhatIf] [<CommonParameters>]

· Identity

· AccountExpirationDate

· AccountNotDelegated

· Add

· Certificates

· Clear

· Description

· DisplayName

· Enabled

· HomePage

· Remove

· Replace

· SamAccountName

· ServicePrincipalNames

· TrustedForDelegation

· AuthType

· Credential

· Partition

· PassThru

· Server

· Confirm

· WhatIf

Copy

Set-ADServiceAccount -Instance <ADServiceAccount> [-AuthType {<Negotiate> | <Basic>}] [-Credential <PSCredential>] [-Partition <string>] [-PassThru <switch>] [-Server <string>] [-Confirm] [-WhatIf] [<CommonParameters>]

· Instance

· AuthType

· Credential

· Partition

· PassThru

· Server

· Confirm

· WhatIf

Detailed Description

The Set-ADServiceAccount cmdlet modifies the properties of an Active Directory service account. You can modify commonly used property values by using the cmdlet parameters. Property values that are not associated with cmdlet parameters can be modified by using the Add, Replace, Clear and Remove parameters.
The Identity parameter specifies the Active Directory service account to modify. You can identify a service account by its distinguished name (DN), GUID, security identifier (SID), or Security Accounts Manager (SAM) account name. You can also set the Identity parameter to an object variable such as $<localServiceAccountObject>, or you can pass an object through the pipeline to the Identity parameter. For example, you can use the Get-ADServiceAccount cmdlet to retrieve a service account object and then pass the object through the pipeline to the Set-ADServiceAccount cmdlet.
The Instance parameter provides a way to update a service account object by applying the changes made to a copy of the object. When you set the Instance parameter to a copy of an Active Directory service account object that has been modified, the Set-ADServiceAccount cmdlet makes the same changes to the original service account object. To get a copy of the object to modify, use the Get-ADServiceAccount object. When you specify the Instance parameter you should not pass the Identity parameter. For more information about the Instance parameter, see the Instance parameter description.
For more information about how the Instance concept is used in Active Directory cmdlets, see about_ActiveDirectory_Instance.
The following examples show how to modify the ServicePrincipalNames property of a service account object by using three methods:
-By specifying the Identity and the ServicePrincipalNames parameters
-By passing a service account object through the pipeline and specifying the ServicePrincipalNames parameter
-By specifying the Instance parameter.
Method 1: Modify the ServicePrincipalNames property for the AccessIndia service account by using the Identity and ServicePrincipalNames parameters.
Set-ADServiceAccount -Identity AccessIndia -ServicePrincipalNames @{Add=ACCESSAPP/india.contoso.com}
Method 2: Modify the ServicePrincipalNames property for the AccessIndia service account by passing the AccessIndia service account through the pipeline and specifying the ServicePrincipalNames parameter.
Get-ADServiceAccount -Identity "AccessIndia" | Set-ADServiceAccount -ServicePrincipalNames @{Add=ACCESSAPP/india.contoso.com}
Method 3: Modify the <property> property for the AccessIndia service account by using the Windows PowerShell command line to modify a local instance of the AccessIndia service account. Then set the Instance parameter to the local instance.
$serviceAccount = Get-ADServiceAccount -Identity "AccessIndia"
$serviceAccount.ServicePrincipalNames = @{Add=ACCESSAPP/india.contoso.com}
Set-ADServiceAccount -Instance $serviceAccount.

Parameters

AccountExpirationDate

Specifies the expiration date for an account. When you set this parameter to 0, the account never expires. This parameter sets the AccountExpirationDate property of an account object. The LDAP Display name (ldapDisplayName) for this property is accountExpires.
Use the DateTime syntax when you specify this parameter. Time is assumed to be local time unless otherwise specified. When a time value is not specified, the time is assumed to 12:00:00 AM local time. When a date is not specified, the date is assumed to be the current date. The following examples show commonly-used syntax to specify a DateTime object.
"4/17/2006"
"Monday, April 17, 2006"
"2:22:45 PM"
"Monday, April 17, 2006 2:22:45 PM"
These examples specify the same date and the time without the seconds.
"4/17/2006 2:22 PM"
"Monday, April 17, 2006 2:22 PM"
"2:22 PM"
The following example shows how to specify a date and time by using the RFC1123 standard. This example defines time by using Greenwich Mean Time (GMT).
"Mon, 17 Apr 2006 21:22:48 GMT"
The following example shows how to specify a round-trip value as Coordinated Universal Time (UTC). This example represents Monday, April 17, 2006 at 2:22:48 PM UTC.
"2006-04-17T14:22:48.0000000"
The following example shows how to set this parameter to the date May 1, 2012 at 5 PM.
-AccountExpirationDate "05/01/2012 5:00:00 PM"

Default Value:

Data Type: System.Nullable[System.DateTime]

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

AccountNotDelegated

Specifies whether the security context of the user is delegated to a service. When this parameter is set to true, the security context of the account is not delegated to a service even when the service account is set as trusted for Kerberos delegation. This parameter sets the AccountNotDelegated property for an Active Directory account. This parameter also sets the ADS_UF_NOT_DELEGATED flag of the Active Directory User Account Control (UAC) attribute. Possible values for this parameter include
$false or 0
$true or 1
The following example shows how to set this parameter so that the security context of the account is not delegated to a service.
-AccountNotDelegated $true

Default Value:

Data Type: System.Nullable[bool]

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

Add

Specifies values to add to an object property. Use this parameter to add one or more values to a property that cannot be modified using a cmdlet parameter. To modify an object property, you must use the LDAP display name. You can specify multiple values to a property by specifying a comma-separated list of values and more than one property by separating them using a semicolon.. The format for this parameter is
-Add @{Attribute1LDAPDisplayName=value1, value2, …; Attribute2LDAPDisplayName=value1, value2, …; AttributeNLDAPDisplayName=value1, value2, …}
For example, if you want to remove the value "555-222-2222" and add the values "555-222-1111" and "555-222-3333" to Phone-Office-Other attribute (LDAP display name ‘otherTelephone’), and add the value "555-222-9999" to Phone-Mobile-Other (LDAP display name ‘otherMobile’), set the Add and Remove parameters as follows.
-Add @{otherTelephone=’555-222-1111′, ’555-222-3333′; otherMobile=’555-222-9999′ } -Remove @{otherTelephone=’555-222-2222′}
When you use the Add, Remove, Replace and Clear parameters together, the operations will be performed in the following order:
..Remove
..Add
..Replace

Default Value:

Data Type: hashtable

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

AuthType

Specifies the authentication method to use. Possible values for this parameter include:
Negotiate or 0
Basic or 1
The default authentication method is Negotiate.
A Secure Sockets Layer (SSL) connection is required for the Basic authentication method.
The following example shows how to set this parameter to Basic.
-AuthType Basic

The following lists the acceptable values for this parameter:

· Negotiate

· Basic

Default Value: Microsoft.ActiveDirectory.Management.AuthType.Negotiate

Data Type: ADAuthType

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

Certificates

Modifies the DER-encoded X.509v3 certificates of the account. These certificates include the public key certificates issued to this account by the Microsoft Certificate Service. This parameter sets the Certificates property of the account object. The LDAP Display Name (ldapDisplayName) for this property is "userCertificate".
Syntax:
To add values:
-Certificates @{Add=value1,value2,…}
To remove values:
-Certificates @{Remove=value3,value4,…}
To replace values:
-Certificates @{Replace=value1,value2,…}
To clear all values:
-Certificates $null
You can specify more than one operation by using a list separated by semicolons. For example, use the following syntax to add and remove Certificate values
-Certificates @{Add=value1,value2,…};@{Remove=value3,value4,…}
The operators will be applied in the following sequence:
..Remove
..Add
..Replace
The following example shows how to create a certificate by using the New-Object cmdlet, and then add it to a user account. When this cmdlet is run, <certificate password> is replaced by the password used to add the certificate.
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate certificate1.cer <certificate password>
Set-ADUser saradavis -Certificates @{Add=$cert}
The following example shows how to add a certificate that is specified as a byte array.
Set-ADUser saradavis -Certificates @{Add= [Byte[]](0xC5,0xEE,0×53,…)}

Default Value:

Data Type: string[]

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	true	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	true	variableLength

Clear

Specifies an array of object properties that will be cleared in the directory. Use this parameter to clear one or more values of a property that cannot be modified using a cmdlet parameter. To modify an object property, you must use the LDAP display name. You can modify more than one property by specifying a comma-separated list. The format for this parameter is
-Clear Attribute1LDAPDisplayName, Attribute2LDAPDisplayName
For example, if you want to clear the value for the Phone-Office-Other attribute (LDAP display name ‘otherTelephone’) set the Clear parameter as follows.
-Clear otherTelephone
When you use the Add, Remove, Replace and Clear parameters together, the operations will be performed in the following order:
..Remove
..Add
..Replace
..Clear

Default Value:

Data Type: string[]

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	true	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	true	variableLength

Credential

Specifies the user account credentials to use to perform this task. The default credentials are the credentials of the currently logged on user unless the cmdlet is run from an Active Directory PowerShell provider drive. If the cmdlet is run from such a provider drive, the account associated with the drive is the default.
To specify this parameter, you can type a user name, such as "User1" or "Domain01\User01" or you can specify a PSCredential object. If you specify a user name for this parameter, the cmdlet prompts for a password.
You can also create a PSCredential object by using a script or by using the Get-Credential cmdlet. You can then set the Credential parameter to the PSCredential object The following example shows how to create credentials.
$AdminCredentials = Get-Credential "Domain01\User01"
The following shows how to set the Credential parameter to these credentials.
-Credential $AdminCredentials
If the acting credentials do not have directory-level permission to perform the task, Active Directory PowerShell returns a terminating error.

Default Value:

Data Type: PSCredential

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

Description

Specifies a description of the object. This parameter sets the value of the Description property for the object. The LDAP Display Name (ldapDisplayName) for this property is "description".
The following example shows how to set this parameter to a sample description.
-Description "Description of the object"

Default Value:

Data Type: string

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

DisplayName

Specifies the display name of the object. This parameter sets the DisplayName property of the object. The LDAP Display Name (ldapDisplayName) for this property is "displayName".
The following example shows how to set this parameter.
-DisplayName "Sara Davis Laptop"

Default Value:

Data Type: string

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

Enabled

Specifies if an account is enabled. An enabled account requires a password. This parameter sets the Enabled property for an account object. This parameter also sets the ADS_UF_ACCOUNTDISABLE flag of the Active Directory User Account Control (UAC) attribute. Possible values for this parameter include:
$false or 0
$true or 1
The following example shows how to set this parameter to enable the account.
-Enabled $true

Default Value:

Data Type: System.Nullable[bool]

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

HomePage

Specifies the URL of the home page of the object. This parameter sets the homePage property of an Active Directory object. The LDAP Display Name (ldapDisplayName) for this property is "wWWHomePage".
The following example shows how to set this parameter to a URL.
-HomePage "http://employees.contoso.com/sdavis"

Default Value:

Data Type: string

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

Identity

Specifies an Active Directory account object by providing one of the following property values. The identifier in parentheses is the LDAP display name for the attribute.
Distinguished Name
Example: CN=WebAccount,CN=ManagedServiceAccounts,DC=corp,DC=contoso,DC=com
GUID (objectGUID)
Example: 599c3d2e-f72d-4d20-8a88-030d99495f20
Security Identifier (objectSid)
Example: S-1-5-21-3165297888-301567370-576410423-1103
SAM Account Name (sAMAccountName)
Example: WebAccount$
The cmdlet searches the default naming context or partition to find the object. If two or more objects are found, the cmdlet returns a non-terminating error.
This parameter can also get this object through the pipeline or you can set this parameter to an object instance.
This example shows how to set the parameter to a distinguished name.
-Identity "CN=WebAccount,CN=ManagedServiceAccounts,DC=corp,DC=contoso,DC=com"
This example shows how to set this parameter to an account object instance named "AccountInstance".
-Identity $AccountInstance

Default Value:

Data Type: ADServiceAccount

Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	true (ByValue)	pipelineInput
Position?	1	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

Instance

Specifies a modified copy of a service account object to use to update the actual Active Directory service account object. When this parameter is used, any modifications made to the modified copy of the object are also made to the corresponding Active Directory object. The cmdlet only updates the object properties that have changed.
The Instance parameter can only update service account objects that have been retrieved by using the Get-ADServiceAccount cmdlet. When you specify the Instance parameter, you cannot specify other parameters that set properties on the object.
The following is an example of how to use the Get-ADServiceAccount cmdlet to retrieve an instance of the ADServiceAccount object. The object is modified by using the Windows PowerShell command line. Then the Set-ADServiceAccount cmdlet saves the changes to the Active Directory object.
Step 1: Retrieve a local instance of the object.
$serviceAccountInstance = Get-ADServiceAccount -Identity ADServiceAdmin
Step 2: Modify one or more properties of the object instance.
$serviceAccountInstance.Description = "default"
Step3: Save your changes to ADServiceAdmin.
Set-ADServiceAccount -Instance $serviceAccountInstance

Default Value:

Data Type: ADServiceAccount

Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

Partition

Specifies the distinguished name of an Active Directory partition. The distinguished name must be one of the naming contexts on the current directory server. The cmdlet searches this partition to find the object defined by the Identity parameter.
The following two examples show how to specify a value for this parameter.
-Partition "CN=Configuration,DC=EUROPE,DC=TEST,DC=CONTOSO,DC=COM"
-Partition "CN=Schema,CN=Configuration,DC=EUROPE,DC=TEST,DC=CONTOSO,DC=COM"
In many cases, a default value will be used for the Partition parameter if no value is specified. The rules for determining the default value are given below. Note that rules listed first are evaluated first and once a default value can be determined, no further rules will be evaluated.
In AD DS environments, a default value for Partition will be set in the following cases: – If the Identity parameter is set to a distinguished name, the default value of Partition is automatically generated from this distinguished name.
- If running cmdlets from an Active Directory provider drive, the default value of Partition is automatically generated from the current path in the drive.
- If none of the previous cases apply, the default value of Partition will be set to the default partition or naming context of the target domain.
In AD LDS environments, a default value for Partition will be set in the following cases:
- If the Identity parameter is set to a distinguished name, the default value of Partition is automatically generated from this distinguished name.
- If running cmdlets from an Active Directory provider drive, the default value of Partition is automatically generated from the current path in the drive.
- If the target AD LDS instance has a default naming context, the default value of Partition will be set to the default naming context. To specify a default naming context for an AD LDS environment, set the msDS-defaultNamingContext property of the Active Directory directory service agent (DSA) object (nTDSDSA) for the AD LDS instance.
- If none of the previous cases apply, the Partition parameter will not take any default value.

Default Value:

Data Type: string

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

PassThru

Returns the new or modified object. By default (i.e. if -PassThru is not specified), this cmdlet does not generate any output.

Default Value:

Data Type: switch

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

Remove

Specifies that the cmdlet remove values of an object property. Use this parameter to remove one or more values of a property that cannot be modified using a cmdlet parameter. To remove an object property, you must use the LDAP display name. You can remove more than one property by specifying a semicolon-separated list. The format for this parameter is
-Remove @{Attribute1LDAPDisplayName=value[]; Attribute2LDAPDisplayName=value[]}
For example, if you want to add the values blue and green and remove the value pink from a property with a LDAP display name of FavColors, set the Add and Remove parameters as follows.
-Add @{FavColors=Blue,Green} -Remove {FavColors=Pink}
When you use the Add, Remove, Replace and Clear parameters together, the parameters will be applied in the following sequence:
..Remove
..Add
..Replace
..Clear

Default Value:

Data Type: hashtable

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

Replace

Specifies values for an object property that will replace the current values. Use this parameter to replace one or more values of a property that cannot be modified using a cmdlet parameter. To modify an object property, you must use the LDAP display name. You can modify more than one property by specifying a comma-separated list. The format for this parameter is
-Replace @{Attribute1LDAPDisplayName=value[], Attribute2LDAPDisplayName=value[]}
For example, if you want to replace the value "555-222-2222" with the values "555-222-1111" for Phone-Office-Other attribute (LDAP display name ‘otherTelephone’) set the Replace parameter as follows.
-Replace @{otherTelephone=’555-222-2222′, ’555-222-1111′}
When you use the Add, Remove, Replace and Clear parameters together, the operations will be performed in the following order:
..Remove
..Add
..Replace
..Clear

Default Value:

Data Type: hashtable

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

SamAccountName

Specifies the Security Account Manager (SAM) account name of the user, group, computer, or service account. The maximum length of the description is 256 characters. To be compatible with older operating systems, create a SAM account name that is 20 characters or less. This parameter sets the SAMAccountName for an account object. The LDAP display name (ldapDisplayName) for this property is "sAMAccountName".
The following example shows how to specify this parameter.
-SAMAccountName "saradavis"
Note: If the string value provided is not terminated with a ‘$’ character, the system adds one if needed.

Default Value:

Data Type: string

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

Server

Specifies the Active Directory Domain Services instance to connect to, by providing one of the following values for a corresponding domain name or directory server. The service may be any of the following: Active Directory Lightweight Domain Services, Active Directory Domain Services or Active Directory Snapshot instance.
Domain name values:
Fully qualified domain name
Examples: corp.contoso.com
NetBIOS name
Example: CORP
Directory server values:
Fully qualified directory server name
Example: corp-DC12.corp.contoso.com
NetBIOS name
Example: corp-DC12
Fully qualified directory server name and port
Example: corp-DC12.corp.contoso.com:3268
The default value for the Server parameter is determined by one of the following methods in the order that they are listed:
-By using Server value from objects passed through the pipeline.
-By using the server information associated with the Active Directory PowerShell provider drive, when running under that drive.
-By using the domain of the computer running Powershell.
The following example shows how to specify a full qualified domain name as the parameter value.
-Server "corp.contoso.com"

Default Value:

Data Type: string

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

ServicePrincipalNames

Specifies the service principal names for the account. This parameter sets the ServicePrincipalNames property of the account. The LDAP display name (ldapDisplayName) for this property is servicePrincipalName. This parameter uses the following syntax to add remove, replace or clear service principal name values.
Syntax:
To add values:
-ServicePrincipalNames @{Add=value1,value2,…}
To remove values:
-ServicePrincipalNames @{Remove=value3,value4,…}
To replace values:
-ServicePrincipalNames @{Replace=value1,value2,…}
To clear all values:
-ServicePrincipalNames $null
You can specify more than one change by using a list separated by semicolons. For example, use the following syntax to add and remove service principal names.
@{Add=value1,value2,…};@{Remove=value3,value4,…}
The operators will be applied in the following sequence:
..Remove
..Add
..Replace
The following example shows how to add and remove service principal names.
-ServicePrincipalNames-@{Add="SQLservice\accounting.corp.contoso.com:1456"};{Remove="SQLservice\finance.corp.contoso.com:1456"}

Default Value:

Data Type: hashtable

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

TrustedForDelegation

Specifies whether an account is trusted for Kerberos delegation. A service that runs under an account that is trusted for Kerberos delegation can assume the identity of a client requesting the service. This parameter sets the TrustedForDelegation property of an account object. This value also sets the ADS_UF_TRUSTED_FOR_DELEGATION flag of the Active Directory User Account Control attribute. Possible values for this parameter are:
$false or 0
$true or 1
The following example shows how to specify that an account is trusted for Kerberos delegation.
-TrustedForDelegation $true

Default Value:

Data Type: System.Nullable[bool]

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

Confirm

Prompts you for confirmation before executing the command.

Default Value:

Data Type: SwitchParameter

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	true	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength

WhatIf

Describes what would happen if you executed the command without actually executing the command.

Default Value:

Data Type: SwitchParameter

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	true	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength

Input Type

None or Microsoft.ActiveDirectory.Management.ADServiceAccount

A service account object is received by the Identity parameter.
A service account object that was retrieved by using the Get-ADServiceAccount cmdlet and then modified is received by the Instance parameter.

Return Type

None or Microsoft.ActiveDirectory.Management.ADServiceAccount

Returns the modified service account object when the PassThru parameter is specified. By default, this cmdlet does not generate any output.

Notes

·
This cmdlet does not work with AD LDS.
This cmdlet does not work with an Active Directory Snapshot.
This cmdlet does not work with a read-only domain controller.

Examples

————————– EXAMPLE 1 ————————–

Command Prompt: C:\PS>

Copy

Set-ADServiceAccount service1 -Description "Secretive Data Server"

Set the description of Service Account ‘service1′ to "Secretive Data Server"

————————– EXAMPLE 2 ————————–

Command Prompt: C:\PS>

Copy

Set-ADServiceAccount Mongol01ADAM -ServicePrincipalNames @{replace="ADAMwdb/a.contoso.com", "ADAMbdb/a.contoso.com"}

Replace the value of property ServicePrincipalNames with "ADAMwdb/a.contoso.com", "ADAMbdb/a.contoso.com"

See Also

Reference

Get-ADServiceAccount
New-ADServiceAccount
Remove-ADServiceAccount
Install-ADServiceAccount
Uninstall-ADServiceAccount

Other Resources

Online version:

 

Source: Set-ADServiceAccount

Active Directory Cmdlets in Windows PowerShell

Active Directory Cmdlets in Windows PowerShell

Windows PowerShell™ is a task-based command-line shell and scripting language designed especially for system administration. This reference topic for the information technology (IT) professional introduces the 76 Windows PowerShell cmdlets that you can use to manage and administer the Active Directory® directory service and Active Directory Domain Services (AD DS).

What does the Active Directory module do?

The Active Directory module for Windows PowerShell in Windows Server 2008 R2 is a Windows PowerShell module (named Active Directory) that consolidates a group of cmdlets. You can use these cmdlets to manage your Active Directory domains, Active Directory Lightweight Directory Services (AD LDS) configuration sets, and Active Directory Database Mounting Tool instances in a single, self-contained package.

Tip

For more information about getting started with the Active Directory Windows PowerShell module, see Active Directory Administration with Windows PowerShell.

In the Microsoft® Windows® 2000 Server operating system, the Windows Server® 2003 operating system, and Windows Server 2008, administrators used a variety of command-line tools and Microsoft Management Console (MMC) snap-ins to connect to their Active Directory domains and AD LDS configuration sets to monitor and manage them. The Active Directory module in Windows Server 2008 R2 now provides a centralized experience for administering your directory service instances.

Active Directory module provider

Administrators can use the Active Directory module provider to easily navigate and access data that is stored in Active Directory domains, AD LDS instances and configuration sets, and Active Directory Database Mounting Tool instances. The Active Directory module provider exposes the Active Directory database through a hierarchical navigation system, which is very similar to the file system. For example, while you are using the Active Directory module, you can use the following commands to navigate through your directory:

· cd

· dir

· remove

· .

· ..

You can use the Active Directory module provider to map Active Directory domains, AD LDS instances, and Active Directory Database Mounting Tool instances to specific provider drives. When the Active Directory module is first loaded, a default Active Directory drive (AD:) is mounted. To connect to that drive, run the cd AD: command. To connect a new provider drive to an Active Directory domain, an AD LDS server, or an Active Directory Database Mounting Tool instance, use the following cmdlet:

New-PSDrive -Name <name of the drive> -PSProvider ActiveDirectory -Root "<DN of the partition/NC>" –Server <server or domain name (NetBIOS/FQDN)[:port number]> -Credential <domain name>\<username>

Parameter	Description
-Name <name of the drive>	Specifies the name of the drive that is being added.
-PSProvider ActiveDirectory	The name of the provider, in this case, ActiveDirectory.
-Root "<DN of the partition/NC>"	Specifies the internal root or path of the provider.
–Server <server or domain name (NetBIOS/FQDN)[:port number]>	Specifies the server that hosts your Active Directory domain or an AD LDS instance.
-Credential <domain name>\<username>	Specifies the credentials that you must have to connect to the Active Directory domain or the AD LDS server.

Active Directory module cmdlets

You can use the Active Directory module cmdlets to perform various administrative, configuration, and diagnostic tasks in your AD DS and AD LDS environments. In this release of Windows Server 2008 R2, you can use the Active Directory module to manage existing Active Directory user and computer accounts, groups, organizational units (OUs), domains and forests, domain controllers, and password policies, or you can create new ones.

The following table lists all the cmdlets that are available in this release of the Active Directory module in Windows Server 2008 R2.

Cmdlet	Description
Add-ADComputerServiceAccount	Adds one or more service accounts to an Active Directory computer.
Add-ADDomainControllerPasswordReplicationPolicy	Adds users, computers, and groups to the Allowed List or the Denied List of the read-only domain controller (RODC) Password Replication Policy (PRP).
Add-ADFineGrainedPasswordPolicySubject	Applies a fine-grained password policy to one more users and groups.
Add-ADGroupMember	Adds one or more members to an Active Directory group.
Add-ADPrincipalGroupMembership	Adds a member to one or more Active Directory groups.
Clear-ADAccountExpiration	Clears the expiration date for an Active Directory account.
Disable-ADAccount	Disables an Active Directory account.
Disable-ADOptionalFeature	Disables an Active Directory optional feature.
Enable-ADAccount	Enables an Active Directory account.
Enable-ADOptionalFeature	Enables an Active Directory optional feature.
Get-ADAccountAuthorizationGroup	Gets the Active Directory security groups that contain an account.
Get-ADAccountResultantPasswordReplicationPolicy	Gets the resultant password replication policy for an Active Directory account.
Get-ADComputer	Gets one or more Active Directory computers.
Get-ADComputerServiceAccount	Gets the service accounts that are hosted by an Active Directory computer.
Get-ADDefaultDomainPasswordPolicy	Gets the default password policy for an Active Directory domain.
Get-ADDomain	Gets an Active Directory domain.
Get-ADDomainController	Gets one or more Active Directory domain controllers, based on discoverable services criteria, search parameters, or by providing a domain controller identifier, such as the NetBIOS name.
Get-ADDomainControllerPasswordReplicationPolicy	Gets the members of the Allowed List or the Denied List of the RODC PRP.
Get-ADDomainControllerPasswordReplicationPolicyUsage	Gets the resultant password policy of the specified ADAccount on the specified RODC.
Get-ADFineGrainedPasswordPolicy	Gets one or more Active Directory fine-grained password policies.
Get-ADFineGrainedPasswordPolicySubject	Gets the users and groups to which a fine-grained password policy is applied.
Get-ADForest	Gets an Active Directory forest.
Get-ADGroup	Gets one or more Active Directory groups.
Get-ADGroupMember	Gets the members of an Active Directory group.
Get-ADObject	Gets one or more Active Directory objects.
Get-ADOptionalFeature	Gets one or more Active Directory optional features.
Get-ADOrganizationalUnit	Gets one or more Active Directory OUs.
Get-ADPrincipalGroupMembership	Gets the Active Directory groups that have a specified user, computer, or group.
Get-ADRootDSE	Gets the root of a domain controller information tree.
Get-ADServiceAccount	Gets one or more Active Directory service accounts.
Get-ADUser	Gets one or more Active Directory users.
Get-ADUserResultantPasswordPolicy	Gets the resultant password policy for a user.
Install-ADServiceAccount	Installs an Active Directory service account on a computer.
Move-ADDirectoryServer	Moves a domain controller in AD DS to a new site.
Move-ADDirectoryServerOperationMasterRole	Moves operation master (also known as flexible single master operations or FSMO) roles to an Active Directory domain controller.
Move-ADObject	Moves an Active Directory object or a container of objects to a different container or domain.
New-ADComputer	Creates a new Active Directory computer.
New-ADFineGrainedPasswordPolicy	Creates a new Active Directory fine-grained password policy.
New-ADGroup	Creates an Active Directory group.
New-ADObject	Creates an Active Directory object.
New-ADOrganizationalUnit	Creates a new Active Directory OU.
New-ADServiceAccount	Creates a new Active Directory service account.
New-ADUser	Creates a new Active Directory user.
Remove-ADComputer	Removes an Active Directory computer.
Remove-ADComputerServiceAccount	Removes one or more service accounts from a computer.
Remove-ADDomainControllerPasswordReplicationPolicy	Removes users, computers, and groups from the Allowed List or the Denied List of the RODC PRP.
Remove-ADFineGrainedPasswordPolicy	Removes an Active Directory fine-grained password policy.
Remove-ADFineGrainedPasswordPolicySubject	Removes one or more users from a fine-grained password policy.
Remove-ADGroup	Removes an Active Directory group.
Remove-ADGroupMember	Removes one or more members from an Active Directory group.
Remove-ADObject	Removes an Active Directory object.
Remove-ADOrganizationalUnit	Removes an Active Directory OU.
Remove-ADPrincipalGroupMembership	Removes a member from one or more Active Directory groups.
Remove-ADServiceAccount	Removes an Active Directory service account.
Remove-ADUser	Removes an Active Directory user.
Rename-ADObject	Changes the name of an Active Directory object.
Reset-ADServiceAccountPassword	Resets the service account password for a computer.
Restore-ADObject	Restores an Active Directory object.
Search-ADAccount	Gets Active Directory user, computer, and service accounts.
Set-ADAccountControl	Modifies user account control (UAC) values for an Active Directory account.
Set-ADAccountExpiration	Sets the expiration date for an Active Directory account.
Set-ADAccountPassword	Modifies the password of an Active Directory account.
Set-ADComputer	Modifies an Active Directory computer.
Set-ADDefaultDomainPasswordPolicy	Modifies the default password policy for an Active Directory domain.
Set-ADDomain	Modifies an Active Directory domain.
Set-ADDomainMode	Sets the domain functional level for an Active Directory domain.
Set-ADFineGrainedPasswordPolicy	Modifies an Active Directory fine-grained password policy.
Set-ADForest	Modifies an Active Directory forest.
Set-ADForestMode	Sets the forest mode for an Active Directory forest.
Set-ADGroup	Modifies an Active Directory group.
Set-ADObject	Modifies an Active Directory object.
Set-ADOrganizationalUnit	Modifies an Active Directory OU.
Set-ADServiceAccount	Modifies an Active Directory service account.
Set-ADUser	Modifies an Active Directory user.
Uninstall-ADServiceAccount	Uninstalls an Active Directory service account from a computer.
Unlock-ADAccount	Unlocks an Active Directory account.

Note

To list all the cmdlets that are available in the Active Directory module, use the Get-Command *-AD* cmdlet.

For more information about—or for the syntax for—any of the Active Directory module cmdlets, use the Get-Help <cmdlet name> cmdlet, where <cmdlet name> is the name of the cmdlet that you want to research. For more detailed information, you can run any of the following cmdlets:

· Get-Help <cmdlet name> -Detailed

· Get-Help <cmdlet name> -Full

· Get-Help <cmdlet name> -Detailed

· Get-Help <cmdlet name> -Examples

More information

For more information about the Active Directory module cmdlets, see the following:

· What’s New in AD DS: Active Directory Module for Windows PowerShell

Active Directory Administration with Windows PowerShell

Source: Active Directory Cmdlets in Windows PowerShell

Set-ADDomainMode

Set-ADDomainMode

Set-ADDomainMode

Sets the domain mode for an Active Directory domain.

Syntax

Copy

Set-ADDomainMode [-Identity] <ADDomain> [-DomainMode] {<Windows2000Domain> | <Windows2003InterimDomain> | <Windows2003Domain> | <Windows2008Domain> | <Windows2008R2Domain> | <UnknownDomain>} [-AuthType {<Negotiate> | <Basic>}] [-Credential <PSCredential>] [-PassThru <switch>] [-Server <string>] [-Confirm] [-WhatIf] [<CommonParameters>]

· Identity

· DomainMode

· AuthType

· Credential

· PassThru

· Server

· Confirm

· WhatIf

Detailed Description

The Set-ADDomainMode cmdlet sets the domain mode for a domain. You specify the domain mode by setting the DomainMode parameter.
The domain mode can be set to the following values that are listed in order of functionality from lowest to highest.
Windows2000Domain
Windows2003InterimDomain
Windows2003Domain
Windows2008Domain
Windows2008R2Domain
You can change the domain mode to a mode with higher functionality only. For example, if the domain mode for a domain is set to Windows 2003, you can use this cmdlet to change the mode to Windows 2008. However, in the same situation, you cannot use this cmdlet to change the domain mode from Windows 2003 to Windows 2000.
The Identity parameter specifies the Active Directory domain to modify. You can identify a domain by its distinguished name (DN), GUID, security identifier (SID), DNS domain name, or NetBIOS name. You can also set the Identity parameter to a domain object variable such as $<localADDomainObject>, or you can pass a domain object through the pipeline to the Identity parameter. For example, you can use the Get-ADDomain cmdlet to retrieve a domain object and then pass the object through the pipeline to the Set-ADDomainMode cmdlet.
The Set-ADDomainMode always prompts for permission unless you specify -confirm:$false.

Parameters

AuthType

Specifies the authentication method to use. Possible values for this parameter include:
Negotiate or 0
Basic or 1
The default authentication method is Negotiate.
A Secure Sockets Layer (SSL) connection is required for the Basic authentication method.
The following example shows how to set this parameter to Basic.
-AuthType Basic

The following lists the acceptable values for this parameter:

· Negotiate

· Basic

Default Value: Microsoft.ActiveDirectory.Management.AuthType.Negotiate

Data Type: ADAuthType

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

Credential

Specifies the user account credentials to use to perform this task. The default credentials are the credentials of the currently logged on user unless the cmdlet is run from an Active Directory PowerShell provider drive. If the cmdlet is run from such a provider drive, the account associated with the drive is the default.
To specify this parameter, you can type a user name, such as "User1" or "Domain01\User01" or you can specify a PSCredential object. If you specify a user name for this parameter, the cmdlet prompts for a password.
You can also create a PSCredential object by using a script or by using the Get-Credential cmdlet. You can then set the Credential parameter to the PSCredential object The following example shows how to create credentials.
$AdminCredentials = Get-Credential "Domain01\User01"
The following shows how to set the Credential parameter to these credentials.
-Credential $AdminCredentials
If the acting credentials do not have directory-level permission to perform the task, Active Directory PowerShell returns a terminating error.

Default Value:

Data Type: PSCredential

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

DomainMode

Specifies the domain mode for an Active Directory domain. You can set the domain mode to one of the following values that are listed in order of functionality from least to most.
Windows2000Domain or 0
Windows2003InterimDomain or 1
Windows2003Domain or 2
Windows2008Domain or 3
Windows2008R2Domain or 4
The following example shows how to set this parameter to Windows 2008 R2.
-DomainMode Windows2008R2Domain

The following lists the acceptable values for this parameter:

· Windows2000Domain

· Windows2003InterimDomain

· Windows2003Domain

· Windows2008Domain

· Windows2008R2Domain

· UnknownDomain

Default Value:

Data Type: ADDomainMode

Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	3	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

Identity

Specifies an Active Directory domain object by providing one of the following property values. The identifier in parentheses is the LDAP display name for the attribute. All values are for the domainDNS object that represents the domain.
Distinguished Name
Example: DC=redmond,DC=corp,DC=contoso,DC=com
GUID (objectGUID)
Example: 599c3d2e-f72d-4d20-8a88-030d99495f20
Security Identifier (objectSid)
Example: S-1-5-21-3165297888-301567370-
DNS domain name
Example: redmond.corp.contoso.com
NetBIOS domain name
Example: redmond
The cmdlet searches the default naming context or partition to find the object. If two or more objects are found, the cmdlet returns a non-terminating error.
This parameter can also get this object through the pipeline or you can set this parameter to a domain object instance.
This example shows how to set the parameter to a distinguished name.
-Identity "DC=redmond,DC=corp,DC=contoso,DC=com"
This example shows how to set this parameter to a domain object instance named "domainInstance".
-Identity $domainInstance

Default Value:

Data Type: ADDomain

Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	true (ByValue)	pipelineInput
Position?	1	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

PassThru

Returns the new or modified object. By default (i.e. if -PassThru is not specified), this cmdlet does not generate any output.

Default Value:

Data Type: switch

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

Server

Specifies the Active Directory Domain Services instance to connect to, by providing one of the following values for a corresponding domain name or directory server. The service may be any of the following: Active Directory Lightweight Domain Services, Active Directory Domain Services or Active Directory Snapshot instance.
Domain name values:
Fully qualified domain name
Examples: corp.contoso.com
NetBIOS name
Example: CORP
Directory server values:
Fully qualified directory server name
Example: corp-DC12.corp.contoso.com
NetBIOS name
Example: corp-DC12
Fully qualified directory server name and port
Example: corp-DC12.corp.contoso.com:3268
The default value for the Server parameter is determined by one of the following methods in the order that they are listed:
-By using Server value from objects passed through the pipeline.
-By using the server information associated with the Active Directory PowerShell provider drive, when running under that drive.
-By using the domain of the computer running Powershell.
The following example shows how to specify a full qualified domain name as the parameter value.
-Server "corp.contoso.com"

Default Value:

Data Type: string

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	true	required
Variable Length?	false	variableLength

Confirm

Prompts you for confirmation before executing the command.

Default Value:

Data Type: SwitchParameter

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	true	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength

WhatIf

Describes what would happen if you executed the command without actually executing the command.

Default Value:

Data Type: SwitchParameter

Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	true	variableLength
Accept wildcard characters?	false	globbing
Accept Pipeline Input?	false	pipelineInput
Position?	named	position

Value Attributes

Name	Value	PSMAML Attribute
Required?	false	required
Variable Length?	false	variableLength

Input Type

Microsoft.ActiveDirectory.Management.ADDomain

A domain object is received by the Identity parameter.

Return Type

None or Microsoft.ActiveDirectory.Management.ADDomain

Returns the modified domain object when the PassThru parameter is specified. By default, this cmdlet does not generate any output.

Notes

·
This cmdlet does not work with AD LDS.
This cmdlet does not work with an Active Directory Snapshot.
This cmdlet does not work with a read-only domain controller.
This cmdlet does not work when connected to Global Catalog port.

Examples

————————– EXAMPLE 1 ————————–

Command Prompt: C:\PS>

Copy

Set-ADDomainMode -Identity fabrikam.com -DomainMode Windows2003Domain

Set the DomainMode property of the fabrikam.com domain to Windows2003Domain.

————————– EXAMPLE 2 ————————–

Command Prompt: C:\PS>

Copy

$pdc = Get-ADDomainController -Discover -Service PrimaryDC

Set-ADDomainMode -Identity $pdc.Domain -Server $pdc.HostName[0] -DomainMode Windows2003Domain

Set the DomainMode of the current logged on user’s domain to Windows2003Domain. The Set operation targets the PrimaryDC FSMO to apply the update.

See Also

Reference

Get-ADDomain

Other Resources

Online version:

Source: Set-ADDomainMode