Modify an AD computer object.
Syntax
Set-ADComputer [-Identity] ADComputer [-AccountExpirationDate [System.DateTime]]
[-AccountNotDelegated [bool]] [-Add hashtable]
[-AllowReversiblePasswordEncryption [bool]] [-AuthType {Negotiate | Basic}]
[-AuthenticationPolicy ADAuthenticationPolicy [-AuthenticationPolicySilo ADAuthenticationPolicySilo]
[-CannotChangePassword [bool]] [-Certificates hashtable] [-ChangePasswordAtLogon [bool]]
[-Credential PSCredential] [-Clear string[]] [-CompoundIdentitySupported Boolean]
[-Description string] [-DisplayName string] [-DNSHostName string]
[-Enabled [bool]] [-HomePage string] [-KerberosEncryptionType ADKerberosEncryptionType]
[-Location string] [-ManagedBy ADPrincipal]
[-OperatingSystem string] [-OperatingSystemHotfix string]
[-OperatingSystemServicePack string] [-OperatingSystemVersion string]
[-Partition String] [-PasswordNeverExpires [bool]] [-PasswordNotRequired [bool]]
[-PassThru] [-PrincipalsAllowedToDelegateToAccount ADPrincipal[]]
[-Remove hashtable] [-Replace hashtable]
[-ServicePrincipalNames hashtable] [-SAMAccountName string]
[-Server string] [-TrustedForDelegation [bool]]
[-UserPrincipalName string]
[-Confirm] [-WhatIf] [CommonParameters]
Key
-AccountExpirationDate [System.DateTime]
The expiry date for the account. (0=never expires)
Use PowerShell DateTime syntax
Time is assumed to be local time unless otherwise specified.
The default time is 12:00 (Midday) local time.
The default date is the current date.
Examples using GMT, UTC and local time:
-AccountExpirationDate "Sun, 17 Apr 2022 21:22:00 GMT"
-AccountExpirationDate "2022-04-17T14:22:00.0000000"
-AccountExpirationDate "04/17/2022 2:22:00 PM"
The LDAP provider name (ldapDisplayName) for this property is accountExpires.
-AccountNotDelegated bool
Security delegation. When True, the security context of the account is not
delegated to a service even when the service account is set as trusted for
Kerberos delegation. Sets the AccountNotDelegated property for an AD account.
This parameter also sets the ADS_UF_NOT_DELEGATED flag of the AD User Account
Control (UAC) attribute.
Values for this parameter: $false or 0, $true or 1
-Add hashtable
Add values to add to an object property.
Use this for properties that cannot be modified using a cmdlet parameter.
To modify an object property, use the LDAP provider name.
Specify multiple values as a comma-separated list of values
Specify more than one property by separating them with a semicolon
The format for this parameter is
-Add @{Attribute1LDAPName=value1, value2,... ; Attribute2LDAPName=value1, value2,... }
If the -Add, -Remove, -Replace and -Clear parameters are used together, the operations
will always be performed in the order: -Remove then -Add then -Replace then -Clear
-AllowReversiblePasswordEncryption bool
Whether reversible password encryption is allowed for the account.
This parameter sets the AllowReversiblePasswordEncryption property of the account.
This also sets the ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED flag of
the AD User Account Control (UAC) attribute.
Values for this parameter: $false or 0, $true or 1
-AuthenticationPolicy
An Active Directory Domain Services authentication policy object in one of the following formats:
• distinguished name
• GUID
• Name
This parameter can be set directly or through the pipeline.
The cmdlet searches the default naming context or partition to find the object.
If the cmdlet finds two or more objects, the cmdlet returns a non-terminating error.
-AuthenticationPolicySilo
An Active Directory Domain Services authentication policy silo object in one of the following formats:
• distinguished name
• GUID
• Name
This parameter can be set directly or through the pipeline.
The cmdlet searches the default naming context or partition to find the object.
If the cmdlet finds two or more objects, the cmdlet returns a non-terminating error.
-AuthType ADAuthType
The authentication method to use:
Negotiate or 0
Basic or 1
A Secure Sockets Layer (SSL) connection is required for the Basic authentication method.
-CannotChangePassword bool
Whether the account password can be changed.
Sets the 'CannotChangePassword' property of an account.
Values for this parameter: $false or 0, $true or 1
-Certificates X509Certificate[]
Modifies the DER-encoded X.509v3 certificates of the account.
These certificates include the public key certificates issued to
this account by the Microsoft Certificate Service.
Sets the Certificates property of the account object.
The LDAP provider Name for this property is "userCertificate".
Syntax to add/remove/replace/clear:
-Certificates @{Add=value1,value2,...}
-Certificates @{Remove=value3,value4,...}
-Certificates @{Replace=value1,value2,...}
-Certificates $null
Multiple operations may be specified by using a list separated by semicolons.
-Certificates @{Add=value1,value2,...};@{Remove=value3,value4,...}
Example - creating a certificate:
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate cert1.cer certPassword
Set-ADUser saradavis -Certificates @{Add=$cert}
-ChangePasswordAtLogon bool
Whether a password must be changed during the next logon attempt.
Values for this parameter: $false or 0, $true or 1
This cannot be set to $true for an account that also has PasswordNeverExpires set.
-Clear string[]
An array of object properties that will be cleared.
Use this parameter to clear properties that cannot be modified using a cmdlet parameter.
To modify an object property, use the LDAP provider name.
Modify more than one property by specifying a comma-separated list.
Example: Clear the value for the Phone-Office-Other attribute ( LDAP provider name: 'otherTelephone')
-Clear otherTelephone
If the -Add, -Remove, -Replace and -Clear parameters are used together, the operations
will always be performed in the order: -Remove then -Add then -Replace then -Clear
-CompoundIdentitySupported
Whether an account supports Kerberos service tickets which includes the authorization data for
the user’s device. This value sets the compound identity supported flag of the Active Directory
msDS-SupportedEncryptionTypes attribute.
Accepted values: $False or 0 $True or 1
Warning: Domain-joined Windows systems and services such as clustering manage their own
msDS-SupportedEncryptionTypes attribute. Therefore any changes to the flag on the
msDS-SupportedEncryptionTypes attribute is overwritten by the service or system which manages the setting.
-Credential PSCredential
A user account that has permission to perform this action.
The default is the current user unless the cmdlet is run from an AD PowerShell provider drive
in which case the account associated with the drive is the default.
"User64" or "Domain01\User64" or a PSCredential object.
-Description string
A description of the object.
-DisplayName string
The display name of the object.
-DNSHostName string
The fully qualified domain name (FQDN) of the computer.
This parameter sets the DNSHostName property for a computer object.
The LDAP provider Name for this property is "dNSHostName".
-Enabled bool
Is the account enabled.
An enabled account requires a password.
This parameter sets the Enabled property for an account object.
Also sets the ADS_UF_ACCOUNTDISABLE flag of the AD User Account Control (UAC) attribute.
Values for this parameter: $false or 0, $true or 1
-HomePage string
The URL of the home page of the object.
-Identity ADComputer
An AD computer object:
Distinguished Name
Example: CN=PC1234,CN=Europe,CN=Users,DC=SS64,DC=com
GUID (objectGUID)
Example: 579c4d2e-f62d-4d20-8a88-030d97495f10
Security Identifier (objectSid)
Example: S-1-5-21-3164297828-301567370-526410523-1153
Security Accounts Manager Account Name (sAMAccountName)
Example: PC1234
The identifier in parentheses is the LDAP provider name for the attribute.
The cmdlet searches the default naming context or partition to find the object.
If the identifier given is a DN, the partition to search will be computed from that DN.
If two or more objects are found, the cmdlet returns a non-terminating error.
This parameter can also accept an object through the pipeline.
-Instance ADComputer
Specifies a modified copy of a computer object to use to update the actual AD computer object.
When this parameter is used, any modifications made to the modified copy of the object are
also made to the corresponding AD object. This will only update the object properties that have changed.
The -Instance parameter can only update computer objects that have been retrieved with Get-ADComputer
you cannot specify other parameters that set properties on the object.
Example
# Retrieve a local instance of the object.
$computerInstance = Get-ADComputer -Identity PC001
# Modify one or more properties of the object instance.
$computerInstance.Description = "Graphic Design Computer"
# Save the changes
Set-ADComputer -Instance $computerInstance
-KerberosEncryptionType
Whether an account supports Kerberos encryption types which are used during creation of service tickets.
This value sets the encryption types supported flags of the Active Directory msDS-SupportedEncryptionTypes attribute.
Accepted values are:
• None
• DES
• RC4
• AES128
• AES256
None will remove all encryption types from the account which may result in the Key Distribution Center (KDC) being
unable to issue service tickets for services using the account.
Data Encryption Standard (DES) is a weak encryption type which is not supported by default since Windows 7 and
Windows Server 2008 R2.
Warning: Domain-joined Windows systems and services such as clustering manage their own msDS-SupportedEncryptionTypes
attribute. Therefore any changes to the flag on the msDS-SupportedEncryptionTypes attribute is overwritten by the
service or system which manages the setting.
-Location string
The location of the computer, such as an office number.
-ManagedBy ADPrincipal
The user or group that manages the object.
Note: The identifier in parentheses is the LDAP provider name for the property.
Examples:
Distinguished Name: CN=SaraDavis,OU=Europe,CN=Users,DC=corp,DC=ss64,DC=com
GUID (objectGUID) : 599c3d2e-f72d-4d20-8a88-030d99495f20
Security Identifier (objectSid) : S-1-5-21-3165297888-301567370-576410423-1103
SAM Account Name (sAMAccountName): JDoe
This parameter sets the Active Directory attribute with an LDAP provider Name of "managedBy".
-OperatingSystem string
An Operating System name. e.g. "Windows Server 2008 Enterprise"
-OperatingSystemHotfix string
An Operating System hotfix name.
-OperatingSystemServicePack string
The name of an Operating System service pack.
-OperatingSystemVersion string
An Operating System version.
-Partition string
The distinguished name of an AD partition.
The distinguished name must be one of the naming contexts on the current directory server.
The cmdlet searches this partition to find the object defined by the -Identity parameter.
examples:
-Partition "CN=Configuration,DC=EUROPE,DC=TEST,DC=SS64,DC=COM"
-Partition "CN=Schema,CN=Configuration,DC=EUROPE,DC=TEST,DC=SS64,DC=COM"
In many cases, a default value will be used for -Partition if no value is specified.
-PassThru
Returns the new or modified object.
By default (i.e. if -PassThru is not specified), this cmdlet does not generate any output.
-PasswordNeverExpires bool
Whether the password of an account can expire.
This parameter also sets the ADS_UF_DONT_EXPIRE_PASSWD flag of the AD UAC attribute.
Values for this parameter: $false or 0, $true or 1
Note: This parameter cannot be set to $true for an account that also has the ChangePasswordAtLogon property set.
-PasswordNotRequired bool
Whether the account requires a password.
This parameter also sets the ADS_UF_PASSWD_NOTREQD flag of the AD UAC attribute.
Values for this parameter: $false or 0, $true or 1
-PrincipalsAllowedToDelegateToAccount
Specifies the accounts which can act on the behalf of users to services running as this computer account.
This parameter sets the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of a computer account object.
This will overwrite the existing principal(s) so ensure everything you need is specified.
Example:
# Set up variables for each server
$ServerB1 = Get-ADComputer -Identity ServerB1
$ServerB2 = Get-ADComputer -Identity ServerB2
$ServerB3 = Get-ADComputer -Identity ServerB3
$ServerC = Get-ADComputer -Identity ServerC
# Grant resource-based Kerberos constrained delegation
Set-ADComputer -Identity $ServerC `
-PrincipalsAllowedToDelegateToAccount @($ServerB1,$ServerB2,$ServerB3)
-Remove hashtable
Remove values from an object property.
Use this for properties that cannot be modified using a cmdlet parameter.
To modify an object property, use the LDAP provider name.
Specify multiple values as a comma-separated list of values
Specify more than one property by separating them with a semicolon
The format for this parameter is
-Remove @{Attribute1LDAPName=value1, value2,... ; Attribute2LDAPName=value1, value2,... }
If the -Add, -Remove, -Replace and -Clear parameters are used together, the operations
will always be performed in the order: -Remove then -Add then -Replace then -Clear
-Replace hashtable
Replace values for an object property.
Use this for properties that cannot be modified using a cmdlet parameter.
To modify an object property, use the LDAP provider name.
Specify multiple values as a comma-separated list of values
Specify more than one property by separating them with a semicolon
The format for this parameter is
-Replace @{Attribute1LDAPName=value1, value2,... ; Attribute2LDAPName=value1, value2,... }
If the -Add, -Remove, -Replace and -Clear parameters are used together, the operations
will always be performed in the order: -Remove then -Add then -Replace then -Clear
-SAMAccountName string
The Security Account Manager (SAM) account name of the user, group, computer, or service account.
The maximum length of the description is 256 characters.
To be compatible with older Operating Systems use 20 characters or less.
Note: If the SAMAccountName string provided, does not end with a '$', one will be appended if needed.
-Server string
The AD Domain Services instance to connect to, this may be a Fully qualified domain name,
NetBIOS name, Fully qualified directory server name (with or without port number) or AD Snapshot instance.
Examples: demo.SS64.com demo demoDC02.demo.ss64.com demoDC02.demo.ss64.com:3268
-ServicePrincipalNames string[]
The service principal names for the account.
Use the following syntax to add remove, replace or clear service principal name values:
-ServicePrincipalNames @{Add=value1,value2,...}
-ServicePrincipalNames @{Remove=value3,value4,...}
-ServicePrincipalNames @{Replace=value1,value2,...}
-ServicePrincipalNames $null
Multiple operations may be specified by using a list separated by semicolons.
-ServicePrincipalNames @{Add=value1,value2,...};@{Remove=value3,value4,...}
Example:
-ServicePrincipalNames @{Add="SQLservice\NewService.ss64.com:1456"};{Remove="SQLservice\demo.ss64.com:1456"}
-TrustedForDelegation bool
Whether an account is trusted for Kerberos delegation.
A service that runs under an account that is trusted for Kerberos delegation can
assume the identity of a client requesting the service.
This value also sets the ADS_UF_TRUSTED_FOR_DELEGATION flag of the AD UAC attribute.
Values for this parameter: $false or 0, $true or 1
-UserPrincipalName string
Each user account has a user principal name (UPN) in the format
user@DNS-domain-name
A UPN is a friendly name assigned by an administrator that is shorter than the LDAP
distinguished name used by the system and easier to remember.
The UPN is independent of the user object’s DN, so a user object can be moved or
renamed without affecting the user logon name. When logging on using a UPN, users
no longer have to choose a domain from a list on the logon dialog box.
-Confirm
Prompt for confirmation before executing the command.
-WhatIf
Describe what would happen if you executed the command, without actually executing the command.
Set-ADComputer modifies the properties of an AD computer object. Commonly used property values can be modified using the cmdlet parameters. Property values that are not associated with cmdlet parameters
can be modified by using the -Add, -Replace, -Clear and -Remove parameters.
The -Identity parameter specifies the AD computer to modify. Identify a computer by its distinguished name Members (DN), GUID, security identifier (SID) or Security Accounts Manager (SAM) account name. The -Identity parameter can also be set to an object variable, or you can pass an object through the PowerShell pipeline. For example, from Get-ADComputer.
The -Instance parameter provides a way to update a computer by applying the changes made to a copy of the computer object. When you specify the -Instance parameter you should not pass the -identity parameter.
Three ways to modify the -Location property of a computer object:
Method 1: Set-ADComputer -Identity PC00189 -Location "London"
Method 2: Get-ADComputer PC00189 | Set-ADcomputer -Location "London"
Method 3:
$computer = Get-ADcomputer PC00189
$computer.Location= "London"
Set-ADComputer -Instance $computer
Modify the SPN value for a given computer:
PS C:\> Set-ADComputer "SRV251" -ServicePrincipalName @{Replace="MSSQLSVC/SRV251.ss64.com:1456","MS OLAPSVC.3/SRV251.ss64.com:analyze"}
Modify the location for a given computer to "Ålesund, Norway":
PS C:\> Set-ADComputer "SRV251" -Location "Ålesund, Norway"
Set the 'managed by' attribute value for a given computer using the SAM account name of the user:
PS C:\> Set-ADComputer "SRV251" -ManagedBy "CN=SQL Administrator 01,OU=UserAccounts,OU=Managed,DC=ss64,DC=com"
Set the 'location' and 'managed-by' attributes of a given computer using the instance parameter set:
PS C:\> $comp = Get-ADComputer "SRV251"; $comp.Location = "Ålesund, Norway"
PS C:\> $comp.ManagedBy = "CN=SQL Administrator 01,OU=UserAccounts,OU=Managed,DC=ss64,DC=com"
PS C:\> Set-ADComputer -Instance $comp
“A happy person is not a person in a certain set of circumstances, but rather a person with a certain set of attitudes” ~ Hugh Downs
Get-ADComputer - Get one or more AD computers.
New-ADComputer - Create a new AD computer.
Remove-ADComputer - Remove an AD computer.
Add-Computer - Add a computer to the domain.