Why are some Active Directory object attributes not writeable with PowerShell?

Question

Hello,

I want to use PowerShell to write to the flags attribute of a group object in my Active Directory.

But PowerShell with the ActiveDirectory module won't even retrieve this attribute.

Why is that?

Is there any PowerShell module that allows one to write any attribute in AD?

Thanks

Answer 1

You can always fall back to using ADSI in PowerShell.

Not showing the script (or at least the portion of the script) you're having a problem with is never a good idea.

It may be that the object returned by PowerShell has decoded the flag bits into named properties of that object, but who can tell exactly what you're trying to do?

Answer 2

Hello @fubar ,

Thank you for posting here.

Based on the descroption above, not sure what PS command you are using and what error message you are receiving.

Here is PS command, I can add flags attribute value to one group (groups1 is the group name, I set the flags value as 2.).

For example:

Set the flags value:
Get-ADGroup -Identity group1 -Properties * | Set-ADGroup -replace @{flags = 2}

View the flags value:
(Get-ADGroup -Identity group1 -Properties *)

Set-ADGroup
https://learn.microsoft.com/en-us/powershell/module/addsadministration/set-adgroup?view=win10-ps

hope the information above is helpful.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou