Change Attributes for users in OU but restrict only to parent OU

Stefanos Constantinou 61 Reputation points
2020-12-20T19:18:52.99+00:00

I'm using the following command to replace the attributes of all AD users in the specified OU 

Get-ADUser -SearchBase 'OU=Test OU,OU=Users and Computers,OU=Company HQ,DC=DOMAIN,DC=com' -filter * | Set-ADUser -Replace @{c="IT";co="Italy";countryCode="380"}

However, the command will change users' attributes which are in Sub-OUs

is there any parameter to restrict the command to change the attributes only in the specified OU?

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,858 questions
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,364 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rich Matheisen 44,776 Reputation points
    2020-12-20T19:38:48.67+00:00

    Add -SearchScope OneLevel to the Get-ADUser.

  2. Thameur-BOURBITA 32,511 Reputation points
    2020-12-20T21:14:00.873+00:00

    Hi,

    You can add -SearchScope Base if you want modify only object in the parent OU.

    A SearchScope with a Base value searches only for the given user. If an OU is specified in the SearchBase parameter, no user will be returned by, for example, a specified Filter statement. A OneLevel query searches the immediate children of that path or object. This option only works when an OU is given as the SearchBase. If a user is given, no results are returned. A Subtree query searches the current path or object and all children of that path or object.

    get-aduser

    Please don't forget to mark this reply as answer if it help you to fix your issue

  3. Andreas Baumgarten 96,441 Reputation points MVP
    2020-12-21T18:55:44.237+00:00

    There you go: 

     Get-ADUser -SearchBase 'OU=Test OU,OU=Users and Computers,OU=Company HQ,DC=DOMAIN,DC=com' -SearchScope OneLevel -filter * | Set-ADUser -Replace @{c="IT";co="Italy";countryCode="380"}

    or 

     Get-ADUser -SearchBase 'OU=Test OU,OU=Users and Computers,OU=Company HQ,DC=DOMAIN,DC=com' -SearchScope Base -filter * | Set-ADUser -Replace @{c="IT";co="Italy";countryCode="380"}

    (If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

    Regards
    Andreas Baumgarten