Set-ADServiceAccount

Modify an Active Directory service account.

Syntax
      Set-ADServiceAccount [-Identity] ADServiceAccount
        [-AccountExpirationDate DateTime] [-AccountNotDelegated bool]
           [-Add hashtable] [-Certificates string[]] [-Clear string[]]
              [-Description string] [-DisplayName string] [-Enabled bool]
                 [-HomePage string] [-Remove hashtable] [-Replace hashtable]
                    [-SamAccountName string] [-ServicePrincipalNames hashtable]
                       [-TrustedForDelegation bool] [-AuthType {Negotiate | Basic}]
                           [-Credential PSCredential] [-Partition string] [-PassThru]
                               [-Server string] [-Confirm] [-WhatIf] [CommonParameters]

      Set-ADServiceAccount -Instance ADServiceAccount
         [-AuthType {Negotiate | Basic}] [-Credential PSCredential]
            [-Partition string] [-PassThru] [-Server string]
               [-Confirm] [-WhatIf] [CommonParameters]

Key
   -AccountExpirationDate [System.DateTime]
       The expiry date for the account. (0=never expires)        
       Use PowerShell DateTime syntax
       Time is assumed to be local time unless otherwise specified.
       The default time is 12:00 (Midday) local time.
       The default date is the current date.
       Examples using GMT, UTC and local time:
        -AccountExpirationDate "Mon, 17 Apr 2011 21:22:48 GMT"
        -AccountExpirationDate "2011-04-17T14:22:48.0000000" 
        -AccountExpirationDate "04/17/2011 2:22:48 PM"
       The LDAP Display name (ldapDisplayName) for this property is accountExpires.

   -AccountNotDelegated bool
       Security delegation. When True, the security context of the user is not
       delegated to a service even when the service account is set as trusted for
       Kerberos delegation. Sets the AccountNotDelegated property for an AD account.
       This parameter also sets the ADS_UF_NOT_DELEGATED flag of the AD User Account
       Control (UAC) attribute.
       Values for this parameter: $false or 0, $true or 1

   -Add hashtable
       Specify values to add to an object property.
       Use this parameter to add one or more values to a property that cannot be modified
       using a cmdlet parameter. To modify an object property, you must use the LDAP display name.
       Specify multiple values to a property by specifying a comma-separated list of values
       and more than one property by separating them using a semicolon.
       The format for this parameter is 

          -Add @{Attribute1LDAPDisplayName=value1, value2, ...;
                 Attribute2LDAPDisplayName=value1, value2, ...; AttributeNLDAPDisplayName=value1, value2, ...}

        For example, to remove the value "555-222-2222" and add the values "555-222-1111" and "555-222-3333
        " to Phone-Office-Other attribute (LDAP display name 'otherTelephone'), and add the value "555-222-9999" to Pho
        ne-Mobile-Other (LDAP display name 'otherMobile'), set the Add and Remove parameters as follows.

          -Add @{otherTelephone='555-222-1111', '555-222-3333'; otherMobile='555-222-9999' } -Remove @{otherTelephone='
        555-222-2222'}

        When you use the -Add, -Remove, -Replace and -Clear parameters together, the operations will be
        performed in the order: Remove, then Add, then Replace, then clear.

   -AuthType {Negotiate | Basic}
       The authentication method to use: Negotiate (or 0), Basic (or 1)
       A Secure Sockets Layer (SSL) connection is required for Basic authentication.

   -Certificates X509Certificate[]
       Modifies the DER-encoded X.509v3 certificates of the account.
       These certificates include the public key certificates issued to
       this account by the Microsoft Certificate Service. 
       Sets the Certificates property of the account object.
       The LDAP Display Name for this property is "userCertificate".

       Syntax to add/remove/replace/clear:
         -Certificates @{Add=value1,value2,...}
         -Certificates @{Remove=value3,value4,...}
         -Certificates @{Replace=value1,value2,...}
         -Certificates $null

       Multiple operations may be specified by using a list separated by semicolons.
         -Certificates @{Add=value1,value2,...};@{Remove=value3,value4,...}

   -Clear string[]
       An array of object properties that will be cleared in the directory.
       Use this parameter to clear one or more values of a property that cannot be modified
       using a cmdlet parameter. To modify an object property, you must use the LDAP display name.
       Modify more than one property by specifying a comma-separated list.
       The format for this parameter is
          -Clear Attribute1LDAPDisplayName, Attribute2LDAPDisplayName

       For example, to clear the value for the Phone-Office-Other attribute
       (LDAP display name 'otherTelephone') set the Clear parameter as follows.

          -Clear otherTelephone

   -Credential PSCredential
       A user account that has permission to perform this action.
       The default is the current user unless the cmdlet is run from an AD PowerShell provider drive
       in which case the account associated with the drive is the default.

       "MSAccount64" or "Domain01\MSAccount64" or a PSCredential object.

   -Description string
       A description of the object.
       The LDAP Display Name for this property is "description".

   -DisplayName string
       The display name of the object.
       The LDAP Display Name for this property is "displayName".

   -Enabled bool
       Is the account enabled.
       An enabled account requires a password.
       This parameter sets the Enabled property for an account object.
       Also sets the ADS_UF_ACCOUNTDISABLE flag of the AD User Account Control (UAC) attribute.
       Values for this parameter: $false or 0, $true or 1

   -HomePage string
       The URL of the home page of the object.
       The LDAP Display Name for this property is "wWWHomePage".

   -Identity ADAccount
       Specify an AD domain object by providing one of the following values.
       (The identifier in parentheses is the LDAP display name for the attribute.)

          Distinguished Name 
            Example: DC=Helvetia,DC=corp,DC=SS64,DC=com 
          GUID (objectGUID) 
            Example: 9abd016a-31af-470a-af5a-be175343f9c3
          Security Identifier (objectSid) 
            Example: S-1-5-21-5165297888-301467370-576410423-1803
          Security Accounts Manager (SAM) Account Name (sAMAccountName)
            Example: Helvetia

       The cmdlet searches the default naming context or partition to find the object.
       If two or more objects are found, the cmdlet returns a non-terminating error.

       This parameter can also get this object through the pipeline or you can set this
       parameter to an object instance.

   -Instance ADServiceAccount
       An instance of a service account object to use as a template for updating a service account object.
       When this parameter is used, any modifications made to the modified copy of the object are also
       made to the corresponding Active Directory object.
       Only the object properties that have changed will be updated.

       The -Instance parameter can only update service account objects that have been retrieved 
       with Get-ADServiceAccount. Do not also specify other parameters that set properties on the object.

       Example of modifying an instance:

         # Retrieve a local instance of the object.
         $holly = Get-ADServiceAccount  -Identity ADServiceAdmin
         # Modify one or more properties of the instance.
         $holly.Description = "default"
         # Save changes
         Set-ADServiceAccount -Instance $holly

   -Partition string
       The distinguished name of an AD partition.
       The distinguished name must be one of the naming contexts on the current
       directory server. The cmdlet searches this partition to find the object defined by
       the -Identity parameter. 
       The following two examples show how to specify a value for this parameter.
          -Partition "CN=Configuration,DC=Europe,DC=Test,DC=SS64,DC=com"
          -Partition "CN=Schema,CN=Configuration,DC=Europe,DC=Test,DC=SS64,DC=com"

       In many cases, a default value will be used for the Partition parameter if no value
       is specified.

   -PassThru
       Returns the new or modified object.
       By default (i.e. if -PassThru is not specified), this cmdlet does not generate any output.

   -Remove hashtable
       Remove values of an object property.
       Use this parameter to remove one or more values of a property that cannot be modified
       using a cmdlet parameter. To remove an object property, you must use the LDAP display name.
       You can remove more than one property by specifying a semicolon-separated list.
       The format for this parameter is 
          -Remove @{Attribute1LDAPDisplayName=value[];   Attribute2LDAPDisplayName=value[]}

       For example, to add the values blue and green and remove the value pink from a property with a LDAP
       display name of FavColors, set the Add and Remove parameters as follows.
          -Add @{FavColors=Blue,Green} -Remove {FavColors=Pink}

        When you use the -Add, -Remove, -Replace and -Clear parameters together, the operations will be
        performed in the order: Remove, then Add, then Replace, then clear.

   -Replace hashtable
       Specify values for an object property that will replace the current values.
       Use this parameter to replace one or more values of a property that cannot be modified
       using a cmdlet parameter. To modify an object property, you must use the LDAP display name.
       You can modify more than one property by specifying a comma-separated list. 
       The format for this parameter is 
          -Replace @{Attribute1LDAPDisplayName=value[],   Attribute2LDAPDisplayName=value[]}

   -SamAccountName string
       The Security Account Manager (SAM) account name of the user, group, computer, or service account.
       The maximum length of the description is 256 characters.
       For compatibility with older operating systems use 20 characters or less.
       The LDAP Display Name of this property is "sAMAccountName".
       If the value provided is not terminated with a '$' character, the system will add one if needed.

   -Server string
       The AD Domain Services instance to connect to, this may be a Fully qualified domain name,
       NetBIOS name or Fully qualified directory server name (with or without port number).

       Examples: demo.SS64.com  demo  demoDC02.demo.ss64.com  demoDC02.demo.ss64.com:3268

   -ServicePrincipalNames string[]
       The service principal names for the account.
       Use the following syntax to add remove, replace or clear service principal name values:

          -ServicePrincipalNames @{Add=value1,value2,...}
          -ServicePrincipalNames @{Remove=value3,value4,...}
          -ServicePrincipalNames @{Replace=value1,value2,...}
          -ServicePrincipalNames $null

       Multiple operations may be specified by using a list separated by semicolons.
         -ServicePrincipalNames @{Add=value1,value2,...};@{Remove=value3,value4,...}

       Example:
         -ServicePrincipalNames @{Add="SQLservice\NewService.ss64.com:1456"};{Remove="SQLservice\demo.ss64.com:1456"}

   -TrustedForDelegation bool
       Whether an account is trusted for Kerberos delegation.
       A service that runs under an account that is trusted for Kerberos delegation can
       assume the identity of a client requesting the service. 
       This value also sets the ADS_UF_TRUSTED_FOR_DELEGATION flag of the AD UAC attribute.
       Values for this parameter: $false or 0, $true or 1

   -Confirm
       Prompt for confirmation before executing the command.

   -WhatIf
       Describe what would happen if you executed the command, without actually executing the command.

   CommonParameters:
       -Verbose, -Debug, -ErrorAction, -ErrorVariable, -WarningAction, -WarningVariable,
       -OutBuffer -OutVariable.

Set-ADServiceAccount modifies the properties of an AD service account. Modify commonly used property values by using the cmdlet parameters. Property values that are not associated with cmdlet parameters can be modified by using the -Add, -Replace, -Clear and -Remove parameters.

The -Identity parameter specifies the AD service account to modify. Identify a service account by its distinguished name (DN), GUID, security identifier (SID), or Security Accounts Manager (SAM) account name. Alternatively set the -Identity parameter to an object variable or by passing an object through the pipeline. e.g. from Get-ADServiceAccount

The -Instance parameter provides a way to update a service account object by applying the changes made to a copy of the object. If the Instance parameter is set to a copy of an AD service account object that has been modified, then Set-ADServiceAccount may be used to save the same changes to the original service account object.

Examples

Set the description of Service Account 'svc_firewall' to "Firewall Alert Service":

PS C:\> Set-ADServiceAccount svc_firewall -Description "Firewall Alert Service"

Replace the value of property ServicePrincipalNames with "ADAMwdb/a.SS64.com", "ADAMbdb/a.SS64.com":

PS C:\> Set-ADServiceAccount svc_SS64 -ServicePrincipalNames @{replace="ADAMwdb/a.SS64.com", "ADAMbdb/a.SS64.com"}

“Identity would seem to be the garment with which one covers the nakedness of the self, in which case, it is best that the garment be loose, a little like the robes of the desert, through which one's nakedness can always be felt, and, sometimes, discerned” ~ James Arthur Baldwin

Related:

Get-adServiceAccount - Get one or more AD service accounts.
Add-adComputerServiceAccount - Add one or more service accounts to an AD computer.
Reset-adServiceAccountPassword - Reset the service account password for a computer
Active Directory Management Gateway Service - Required to manage AD Domain Services with PowerShell.
Service Accounts Step-by-Step Guide - Configure and administer Managed Service Accounts in Windows 2008.


© Copyright SS64.com 1999-2013
Some rights reserved