Change Attributes for users in OU but restrict only to parent OU

Stefanos Constantinou 61 Reputation points

I'm using the following command to replace the attributes of all AD users in the specified OU

Get-ADUser -SearchBase 'OU=Test OU,OU=Users and Computers,OU=Company HQ,DC=DOMAIN,DC=com' -filter * | Set-ADUser -Replace @{c="IT";co="Italy";countryCode="380"}

However, the command will change users' attributes which are in Sub-OUs

is there any parameter to restrict the command to change the attributes only in the specified OU?

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,799 questions
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,343 questions
0 comments No comments
{count} votes

3 answers

Sort by: Most helpful
  1. Rich Matheisen 44,456 Reputation points

    Add -SearchScope OneLevel to the Get-ADUser.

  2. Thameur-BOURBITA 32,496 Reputation points


    You can add -SearchScope Base if you want modify only object in the parent OU.

    A SearchScope with a Base value searches only for the given user. If an OU is specified in the SearchBase parameter, no user will be returned by, for example, a specified Filter statement. A OneLevel query searches the immediate children of that path or object. This option only works when an OU is given as the SearchBase. If a user is given, no results are returned. A Subtree query searches the current path or object and all children of that path or object.


    Please don't forget to mark this reply as answer if it help you to fix your issue

  3. Andreas Baumgarten 94,711 Reputation points MVP

    There you go:

     Get-ADUser -SearchBase 'OU=Test OU,OU=Users and Computers,OU=Company HQ,DC=DOMAIN,DC=com' -SearchScope OneLevel -filter * | Set-ADUser -Replace @{c="IT";co="Italy";countryCode="380"}


     Get-ADUser -SearchBase 'OU=Test OU,OU=Users and Computers,OU=Company HQ,DC=DOMAIN,DC=com' -SearchScope Base -filter * | Set-ADUser -Replace @{c="IT";co="Italy";countryCode="380"}

    (If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

    Andreas Baumgarten