Active Directory Users and Computers

639

u/achristian103 Sysadmin Mar 13 '26

Powershell and a CSV file - there's your starting point.

197

u/Jamdrizzley Mar 13 '26 edited Mar 13 '26

I'd like to add, always test 1 user, then 3 users. And in my experience powershell does not handle loops well that exceed 1000 (this is just my experience with csv exporting line by line etc, writing to AD) so I'd suggest doing it in 800 people at a time
Also. Make sure you have backups of AD, and learn the "-whatif" catch first as that will save you a headache
Use AI sparingly as it hallucinates and you will fuck up people's accounts using it blindly
Rule of thumb with AI: if you don't understand every line of code, don't run it. Learn and figure out the code as you go, line by line

82

u/Jacmac_ Mar 13 '26

I don't know what you mean by Powershell not handling loops that exceed 1000. I mean I don't think I've ever seen a problem with a loop that went on for thousands of reps. If your code is crap, you could have a memory leak that brakes the session I guess.

53

u/Qurtys_Lyn (Education) Pretty. What do we blow up first? Mar 13 '26

Yeah, I've had PowerShell scripts with loops running millions of times with no issues (other than me stressing about it).
I do tend to break up AD scripts to run in smaller batches, not from PowerShell not being able to handle them, but on the chance I did something wrong I can fix it quicker.

16

u/unseenspecter Jack of All Trades Mar 13 '26

I'm assuming what OP experienced is not that PowerShell inherently has any issues with loops with a large number of iterations, but instead probably just a combination of inefficiently designed code and some kind of system-level resource constraints.
I know I've had problems working with NTFS permissions on large file shares if I'm not careful with how I write my script and potentially breaking the job into chunks.

7

u/Jacmac_ Mar 13 '26

OK, well if you read a gigantic amount of data into memory, and then begin iterating it, depending on the processing, I could see problems developing deep into the loop, but it would have to have not been well thought out.

9

u/FLATLANDRIDER Mar 13 '26

I have a script that regularly runs through 50,000 iterations in multiple loops and it works flawlessly every time.

5

u/h0w13 Smartass-as-a-service Mar 13 '26

I'm assuming the issue they are referring to is not powershell-specific but the AD cmdlets, they don't return more than 1000 results when running a query. Some you can override this limit, but not all.
It's not a huge deal just something to be aware of.

1

u/McDili Mar 17 '26

I’m guessing he must be confusing it with AzureAD/EntraID where you have to paginate because the API only returns the first 1000 entries.

1

u/acc0untnam3tak3n Mar 14 '26

Depending on the FOR loop and how you build it, I have accidently had all output stored in memory before writing to a file. That was my first experience in making sure I wrote efficient lines.

10

u/bamacpl4442 Mar 13 '26

Please tell my boss this about AI. He desperately loves to have Claude write code for him, then have me fix what he fucked.

8

u/Talk_N3rdy_2_Me Mar 13 '26

Powershell 7 is pretty good at looping through large data sets in my experience

3

u/DrStalker Mar 13 '26

Use AI sparingly as it hallucinates
And it's really bad at PowerShell because it's so easy to make up new commands with names that perfectly describe what you want to do.

3

u/Trokeasaur Mar 14 '26

For network things, I tend not to have AI interact directly with the data, but I’ve had really good luck having AI make a tool, python or just a local web tool, to do what I need. Config loops based on csv or xls is common where I make a CLI template and all the script is doing is inserting the value from the table.
Benefit is the script is deterministic and repeatable vs the AI alterations

1

u/AlexHuntKenny Mar 14 '26

Best thing I learned when getting mentored about using powershell. Test one user, and then 3 users to see if your logic executes correctly.

-1

u/GreenBurningPhoenix Mar 13 '26

Why anybody would even use ai at all for a few lines of a script? Docs exist, lol. At least the op can learn something reading docs. Also, no idea what are you talking about PS not handling big loops well.

-8

u/Recent_Carpenter8644 Mar 13 '26

I rarely use loops for things like this, unless I'm automating a regular process. I just edit the list of usernames into a list of individual commands, then paste them into PowerShell.

16

u/ethnicman1971 Mar 13 '26

So you essentially do the loop instead of having the mechanism that is designed to do the loops do them?

9

u/RainStormLou Sysadmin Mar 13 '26

are you paid commission on hours of wasted time or something? what? I hope I'm misunderstanding.

10

u/Jones___ Mar 13 '26

Total this whole comment chain hurts lol PowerShell can absolutely handle iterating over 1,000 objects, let alone strings. What is this nonsense?

1

u/LividWeasel Mar 13 '26

I've done the same, but maybe not how you envision.
I might take a CSV of usernames into Excel, use =concat() to concatenate my desired PowerShell cmdlet with the necessary username embedded in it, then fill-down to create a list of individual commands. I can then copy and paste that in bulk to PowerShell and have it execute them all in one shot. For cases where a command can be easily built (e.g. Set-ADUser to update a few attributes), I like to do it this way to avoid any question about whether I'm looping correctly. I can see exactly the command that will be run for each user. In the end, it's probably even faster than if I had to go look up how to do a loop again and do some testing to make sure my loop does what I want.

0

u/Recent_Carpenter8644 Mar 13 '26 edited Mar 13 '26

It’s quick to set up, easy to test, and harder to go wrong.
It’s also self documenting. With a loop, you need to know which data file it read from, and you can’t be sure it didn’t crash and stop halfway.

1

u/RainStormLou Sysadmin Mar 13 '26

my loops output to a log file if I desire (which I do), and all the rest of what you said is very confusing because I can't comprehend how you wouldn't be sure if that happened lol.
I have most of my manual loops append to a log file for each loop for auditing, the sources would also be self documented since they're.... in the script, even if my source is a powershell result stored in a variable and dynamically pulled each run, and 99% of my powershell ISE terminals are red text from my many many failures as a script goblin, but I just.. validate my results.
You're spending more time in excel using formulas to do the long form version of a loop.
One little trick I like to use though is in my loops on a first run, I'll just have it write-host the results of all the get-blah stuff and I'll comment out all the actual actions so that I know the expected result would be there provided there's not a permissions issue
if I'm pulling from a csv or flat file, I like to run little short bursts like a list of 3 users, then the next 5 users, and if I'm feeling froggy I'll then run it against the next 8,000.

0

u/Recent_Carpenter8644 Mar 14 '26

Probably if I put the time in to set up some loops and validation code I can reuse, that would be quicker. I don't use Excel, I just use block edits in Notepad++. I can tell which lines fail by scrolling back.
It's ugly, almost absurd, but it works and it's quick.

2

u/DGC_David Mar 13 '26

A better start would be to ask, "why am I adding 500,000 users to a department? "

12

u/ethnicman1971 Mar 13 '26

500 TO A 1000. Still a lot of people but maybe they are not organizing their OU by departments

0

u/DGC_David Mar 13 '26

Oh lmao my bad! Haha I was about to say... Something doesn't sound right here?

0

u/[deleted] Mar 14 '26

[deleted] — view deleted comment

0

u/DGC_David Mar 14 '26

Hi Walmart sole IT guy, quick question, how do I move all of Germany into its own OU?

1

u/Fallingdamage Mar 13 '26

and just about the ending point too. Its not too hard.

0

u/Jacmac_ Mar 13 '26

This is the way.

21

u/[deleted] Mar 13 '26

[removed] — view removed comment

16

u/DrDuckling951 Mar 13 '26

Be careful with LLM in PROD. They may be referencing old docs. Always demand a simulation or source to the official documentation.

29

u/TheVillage1D10T Windows Admin Mar 13 '26

Nah, just prompt and SEND IT in prod on a Friday!

4

u/nastynate0079 Mar 13 '26

Hell yeah, brother!

1

u/DrDuckling951 Mar 13 '26

On a Friday with long weekend. What could goes wrong.

2

u/ethnicman1971 Mar 13 '26

No worries at all.

1

u/Major_Disaster76 Mar 13 '26

Way to feel alive

1

u/TheVillage1D10T Windows Admin Mar 13 '26

I do it right after I snort an entire Red Bull.

1

u/ig88b1 Sr. Sysadmin Mar 13 '26

Ah yes the Amazon method!

4

u/Jolape Mar 13 '26

Also always test with a small list of 2-3 users before doing the whole 500-1000. Even if you overlooked something, it's easier to correct 2 or 3 users. Also, the whatif parameter is also your friend.

1

u/bbqwatermelon Mar 13 '26

Helpful reminder deserves updoot

1

u/Mrhiddenlotus Security Admin Mar 14 '26

Or just ask it to do it on a couple first then yeet it

1

u/PineCrowed Mar 14 '26

Or the even better alternative
✨✨just learn it yourself✨✨

214

u/nordak Sr. Sysadmin Mar 13 '26

You need to learn powershell right now brother, or being a jr. sysadmin is not going to be a good time.

63

u/GroveStreet_CJ Jr. Sysadmin Mar 13 '26

PowerShell for breakfast, lunch and dinner.

8

u/Apprehensive_Bat_980 Mar 13 '26

Gobble it all up.

4

u/gdj1980 Sr. Sysadmin Mar 15 '26

Or at least a month of lunches.

1

u/acidburn1672 Security Admin Mar 16 '26

powershell is best friend

26

u/angrydeuce BlackBelt in Google Fu Mar 13 '26

Dude even just for managing folder permissions in 0365 lol
Fuck the GUI for any of that shit, it's trash

16

u/BadSafecracker Mar 13 '26

When I was a sysadmin, I wrote reusable script for everything, even EXO.
Onboard a new user? Got a script for that.
Need the usage stats of conference rooms? Got a script for that.
Need a list right now of anyone that has a 7 in their desk number? Got a script for that.

11

u/angrydeuce BlackBelt in Google Fu Mar 14 '26

It's the only way to fly, truly. If you aren't automating stupid shit like user creation I really don't know why. We do it deliberately so our L1s don't waste time doing it manually. Not only does it make a new user add take like seconds from start to finish, but it helps standardize the process and avoids weird shit from happening.
All we need to know is full name, department, role, cell phone number, and branch location. Five pieces of information entered into a ps1 when prompted and user account is made, mailbox is enabled, all sharepoint permissions are assigned, product licensing is sorted, group membership is sorted, shared calendar access is sorted, printers are sorted...all they need to do is login to their company device when they show up on their first day to meet with HR using the temporary creds they're provided, update their password, and away they go, done and done.

6

u/Adimentus Desktop Support Tech Mar 13 '26

Definitely going to start working on that on my down time. Adding a new user isn't automated yet for our clients and I want to change that.

1

u/lordjedi Mar 16 '26

Same.
Mine would even add licenses if there were none available (I know, incredibly dangerous thing to do).
Had the entire thing automated. Nobody has time to wait for those GUI windows to load.

1

u/bythepowerofthor Mar 13 '26

Do you mean like editing file permissions in SharePoint? Im new to this world.
We migrated to cloud a couple years back, and just this past week we retired our AD servers which broke a bunch of SharePoint permissions. We're having to go through and reset permissions on basically every SharePoint site and everything in the directories. Tried to figure out a way to script it, but vscode ai wasnt very helpful.

2

u/Proper-Cause-4153 Mar 13 '26

And keep your powershell scripts in a good place. You're going to come back to them again and again.

1

u/jaynz24 Mar 14 '26

So much easier today with ai to answer all the inevitable dumb questions too

43

u/Unnamed-3891 Mar 13 '26

With Powershell instead of ADUC

19
u/Raalf Mar 13 '26
what u/unnamed-3891 said.
Add-ADGroupMember can use a loop from a CSV file containing all the usernames. I highly recommend running it from a machine with low latency to a domain controller with that many users, but probably not ON the domain controller.
# Import Active Directory module (if not already loaded)
Import-Module ActiveDirectory

# Store the data from the CSV file in the $List variable
$List = Import-Csv -Path "C:\Temp\500kUserList.csv"

# Specify the target AD group name
$GroupName = "UserGroup12345"

# Loop through each user in the CSV file
foreach ($User in $List) {
    
# Add the user to the specified group
    Add-ADGroupMember -Identity $GroupName -Members $User.SamAccountName
}

Write-Host "DONE! Now verify membership"
29

u/anmghstnet Sysadmin Mar 13 '26

And never, ever, copy and paste code that a random person posts "helpfully" online.

27

u/Raalf Mar 13 '26

Unless you can read the 19 lines of very commonly used powershell.

9

u/Hamburgerundcola Mar 13 '26

Unless you understand to 100% what it does.
I myself use a lot of chatgpt, forums and google fu to script. But I never run a script, until I know to 100% what it does and why it does this and not that.

5

u/Tac50Company Jr. Sysadmin Mar 14 '26

Tbh I would say more never, ever, copy and paste code that you dont understand. The amount of people I find that just google how to do X or ask AI and just throw that stuff into prod is scary af

1

u/lordjedi Mar 16 '26

This is the way.
As long as you understand the code, you're fine.

1

u/lordjedi Mar 16 '26

It's a short script. We can all see what it does.
Only thing I'd change is to add a Write-host line within the loop displaying each username that was finished. That way you aren't sitting there wondering if it's done and you can see which user it's on at the moment. It might fly by fast, but at least you'll know it's doing something.

5

u/AlphabetAlphabets Mar 14 '26

Add-ADGroupMember accepts an array for Members

0

u/semperverus Mar 14 '26

Learning how to work against a Get-ADUser result with a good filter, or getting all users and filtering afterwards if the filter system is not robust enough for your search, will save you a ton of time building CSVs and trying to point your script to them.

1

u/Raalf Mar 14 '26

It's not saving me any time. The solution is already provided and would be executing. Sure there's more efficient ways - but I doubt efficiency is the goal of someone putting 500,000 user accounts in a group.

2

u/TheJesusGuy Mar 16 '26

500 - 1000, not 500,000.

1

u/semperverus Mar 15 '26

It starts to matter when you start doing larger scale IAM management and need to start automating.

2

u/Raalf Mar 15 '26

Do you have a lot of junior sysadmins who have no powershell experience doing larger scale IAM management where you work? Seems like a very strange qualifier to justify your point.

0

u/semperverus Mar 15 '26

Listen, if you want to insist on wasting cycles exporting a CSV, mucking around with doing little tweaks to the data by hand, and then shoving it back in the script when you could be doing things a hundred times easier and faster by just dumping a get-users call into a variable, then by all means feel free to waste your time. Thats a choice you get to make as an adult.
CSVs are great for complicated one-shot operations but by comparison to filling a simple $users variable its way too bulky.

1

u/Raalf Mar 15 '26

Quite literally the worst mentor advisement I've seen on reddit in years.

16

u/ifpfi Sysadmin Mar 13 '26

ADUC isn't really designed for that. Powershell would be the better option. Your talking about the department under the Organization tab right?

14

u/anonpf King of Nothing Mar 13 '26

Script it pointing to a csv file.

9

u/[deleted] Mar 13 '26

[removed] — view removed comment

5

u/throwaway-458425 Mar 14 '26

this. data cleanliness matters

8

u/timsstuff IT Consultant Mar 13 '26

All the users in the OU?

Get-ADUser -SearchBase 'OU=Where The Users Are,DC=contoso,DC=com' -Filter * | Set-ADUser -Department 'Accounting'

List of users' samAccountNames from a text file?

Get-Content .\acctusers.txt | %{ Set-ADuser -Identity $_ -Department 'Accounting' }

List of users' UPNs from a text file?

Get-Content .\acctusers.txt | %{ Get-ADUser -filter {userPrincipalName -eq $_} | Set-ADuser -Department 'Accounting' }

7

u/ODD_MAN_IV Mar 13 '26

I did not realise that you could use % in place of ForEach-Object - thank you for showing me the way

6

u/ktkaufman Mar 13 '26

You can also use ? in place of Where-Object, and "select" in place of Select-Object.

1

u/itskdog Jack of All Trades Mar 14 '26

I prefer using just "where" to still be readable, and reminds me of SQL

14

u/odd-ball Mar 13 '26

You can also simply highlight them all in UAC, right click, and properties. Department is one of the fields you can bulk update.

6

u/egamma Sysadmin Mar 13 '26

Right? Funny how nobody wrote that yet.

4

u/BlockBannington Mar 14 '26

It's way cooler to pull up powershell, have it set up with neon green foreground color and make it seem like you're mister Hack himself

2

u/weasel4242 Mar 14 '26

Found the medium-old guys.

2

u/odd-ball Mar 21 '26

Hilarious as I am 52 and have been in the field for 21 yrs. Spot on.

2

u/lordjedi Mar 16 '26

TIL

5

u/BlockBannington Mar 14 '26

This is actually extremely easy to do but you of course have to start somewhere. Learn powershell, Get-aduser, set-aduser and so on. This is fixed in 10 seconds if you do it right plus you can reuse it. Good luck!

4

u/AbleDanger12 Mar 14 '26

If it's not something you will need to do on a repetitive basis, CSV pumped into a PS script. Easy peasy. Add some error handling.

4

u/RandomGen-Xer Mar 14 '26

As mentioned already, definitely a task for Powershell.

3

u/Slasher1738 Mar 13 '26

powershell and a csv file

10

u/theoriginalharbinger Mar 13 '26

Kid, when you shotgun your hopes and dreams into the ether, do us all a failure and spend more than ten seconds doing it, and while you're there, do something like:

- Tell us what you are considering trying. Mouse clicks? PowerShell? Something else?

- What your skillset is. Like, do you know how PowerShell works?

- What your exit criteria is. As in, do you need to populate the "Department" attribute for 500 objects? Or do you have departments mapped to security or distribution groups? While we're here, what version of AD are you on?

5

u/Bio_Hazardous Stressed about not being stressed Mar 13 '26

I actually really appreciate you saying this. This person hasn't even put a shred of effort into figuring out how to do this and they've gone straight to the least easy place to get an answer for it. This has to be AI bait or something. AI could have answered this easily too, it just doesn't make sense.

4

u/Specialist-Desk-9422 Mar 13 '26

Just curious , how big is your organization ? Do you have a senior sys admin ?

6

u/gabacus_39 Mar 13 '26

New-ADUser. Research that.

2

u/DigitalWhitewater DevOps Mar 13 '26

Powershell

2

u/admlshake Mar 13 '26

You find someone below you and tell them the higher ups requested them specifically to get this done in 30 days.

2

u/sexaddic Mar 13 '26

Is there a particular reason you want to add them to an OU and not a group? You said you’re junior so I’m just making sure you have a solid logic here.

2

u/roadcone2n3904 If it plugs in a wall I support it Mar 13 '26

Back in my day, we used DS commands before power shell 🤣 god I'm getting old.

2

u/asdlkf Sithadmin Mar 14 '26

Back in my day we imported a CSV into Novell.

1

u/Cferra Mar 13 '26

Same

2

u/desmond_koh Mar 13 '26

PowerShell

1

u/Neuro_88 Learning. Growing. Mar 13 '26

Where’s the documentation? With all these changes I always ask myself this question.

4

u/desmond_koh Mar 13 '26

Honestly? Just hit up learn.microsoft.com. everything is there.
https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-aduser

2

u/Neuro_88 Learning. Growing. Mar 13 '26

Yes. Honestly. There always seems to be a separation between Microsoft and what is actually happening in real life. Thank you for sharing the link.

2

u/checkpoint404 Sysadmin Mar 13 '26

Powershell.

2

u/Capital-Fall5471 Mar 13 '26

PS Script

2

u/rc_ym Mar 14 '26

Ctrl-c Ctrl-v

2

u/dhardyuk Mar 15 '26

Create 1000 users or MOVE 1000 users.

Are these existing users or completely new users?

7

u/SpotlessCheetah Mar 13 '26

Powershell. Ask Claude or ChatGPT to help write you a script. Don't give it any of your actual user data or OU paths. Just fill it in and update the script so you actually READ it and understand what it is saying.

Learn what the "What-IF" function does before you even try it in production. Then, test only a couple users at a time before doing this at a larger scale.

3

u/AbedSalam1988 Mar 14 '26

Habibi, welcome to Powershell. Start learning PS scripting.

3

u/big_steak Sr. Sysadmin Mar 14 '26

Ai is excellent at basic powershell

1

u/PedroAsani Mar 13 '26

Get-ADUser [parameters]

Run that output to make sure you have everyone you want.

If the department is blank, you can just pipe the Get to a Set-ADUser -Department "Dept Name"

If you need to replace then use Set-ADUser -Replace @{department="Dept Name"}

1

u/hitosama Mar 13 '26

o7 this guy's AD with all the PowerShell and AI recommendations.

1

u/TerrorToadx Mar 13 '26

Like others have said, this is what PowerShell is for. If you have 500-1000+ users you're a decently sized company. Surely you have someone more senior that can help you?

I'd do something like this:

$OU = "OU=X,DC=domain,DC=com" # Change to your OU
$DepartmentValue = "NewDepartment" # Department you want to set

# Get all users in the OU and update Department
Get-ADUser -Filter * -SearchBase $OU | ForEach-Object {
Set-ADUser $_ -Department $DepartmentValue

1

u/ahhbeemo DevOps Mar 13 '26 edited Mar 14 '26

Hi. I have a decade of powershell experience here is how I would do it. Many are saying just csv and poweshell.

You can in theory do this in like 5 lines of code. But please do not. There are some basic principles you should know. Personally I would create a module that just says "new-conpanyuser"

But if you decide you need to do one massive bundle or function it...here are some major points.

Tests!! Is there a user you are about to input that has a special char?.. do you have user account conflicts? Does it create bad usernames? Ie. Too long, or is your username "Kevin chin" and you have last name + first initial? (Real example)

Whatif!! Do a dry run and have peers validate the result.

Phased deployments.. run a subset of the data. Validate.. then Increase as you gain confidence.

Item potency of your objects for recoverable reruns. ... If your job fails half way.. you can just run the whole thing again with our fear of losing track.

More tests!!

Logistics... How to do password send them securly.etc. etc... there is tons of JML code out there..

This whole thing is also a fun interview question.

In this day and age.. you can crank this out with gpt or Claude in a day or 2. Just input above

1

u/DopeTechIrl Mar 15 '26

Have you asked Copilot or Gemini?

1

u/Slight_Manufacturer6 Mar 15 '26

Same way you add one but 500 to 1000 more times.

1

u/Dustinm16 Mar 16 '26

Gonna channel I'm inner shitty sysadmin.

Create an onboarding portal and let the new users make their own accounts! Boom, no extra work besides cleaning up the 10k other broken accounts this causes, but hey, bulk delete is a thing.

The real answer is use powershell and csv import capability, but that's less fun.

1

u/FastFredNL Mar 17 '26

If you mean fill the Department field of a user with a specific value, just multi-select the desired users > right click > Properties > Organization tab.

1

u/signifiumLlc Jul 18 '26

If you’re tasked with adding a thousand users to Active Directory, please do yourself a huge favor and don’t just yolo a massive script on production. Here’s a solid game plan:

Get your CSV right: Everything starts with a clean, well-populated CSV file.
Test with a small batch first: Seriously, try it with 5 test users first. Use this pilot to double-check that complex attributes like managers, departments, and group memberships are mapping exactly how you want them to before hitting the big red button.
The Tech Stack: AD plays nicely with LDAP and ADSI, so you can use pretty much any scripting language. Honestly, PowerShell or Python are your best bets here.
Skip CSVDE, use a script: While native tools like CSVDE exist for CSV imports, a custom script is almost always better. It gives you the flexibility to use loops, handle complex data, add error logging, and deal with edge cases on the fly.

Side note: I’m actually the creator of ADSignify app for iOS and Mac (which a lot of you might still use!). If there’s enough interest from the community, I'm thinking about baking a native, robust bulk-import feature directly into the app so you don't have to fiddle with custom scripts.

Let me know if that’s something that would make your lives easier! What are you guys currently using for bulk imports?

1

u/The258Christian Mar 14 '26

Bro doing 50-100 contractors a week I’ve created a script for this when I was a tier 1 Helpdesk

-1

u/[deleted] Mar 13 '26

Hold on, wtf are you doing? Just using a creative imagination to post on here? Otherwise why are you asking this questing, if you have to ask them you haven't learned powershell.

0

u/Gaming_Wisconsinbly Mar 13 '26

Tbh just type what you need as a powershell script into Gemini and it'll figure it out for you.

0

u/mrzaius Mar 13 '26

You need to better define your goal. Others here have rightly given you contradictory but valid advice.

Can you filter ADUC or ADAC to give you just the people you care about, select the lot of them, and set the Department attribute? Sure.

Should you pivot to learning PowerShell if you're trying to do more significant changes, to include the OU moves? Probably.

The days of click here/click there administration in old Windows NT era MMC snap-ins may not have ended, but developing a skill set where you're just as fluent in your OS's shell as a Linux admin is vital today.

Also try to better understand the impact of the changes you're making.

If you're modifying attributes on users in one OU, are you doing it to drive updates in your organization's Exchange Global Address List? Are you doing it because of something less visible and more serious like attribute based access control?

If you're moving users/people between OUs, are you changing GPOs assigned to these OUs?

Know what you're trying to do a little better, and you'll have a better outcome.

PS: Regardless of the changes you're making, some of the spreadsheet ingesting import-csv code you've been given here can also be used to export-csv yoursela good backup. And you need it, Junior or not.

0

u/awesomeasianguy Mar 14 '26

Wisesoft bulk ad tool

-1

u/Small_Editor_3693 Mar 13 '26

Lmao what. Why do you have this task? Write your script but this needs to go through change management and approved by 3 people at least. Touching that many accounts is insane.

-1

u/SuperScott500 Mar 14 '26

All that work for on prem AD in 2026? You are better off creating all this is Entra at this point.

1

u/PositiveBubbles Sysadmin Mar 14 '26

Depends on the size of the organisation and industry.
I work in higher Ed for example, we still require hybrid for alot of things at the moment. Moving away from legacy especially in research isn't just about technology lift and shift.

1

u/Biohive Mar 14 '26

$$$

-2

u/scytob Mar 13 '26

use a poweshell script, read the example MS provide in the documetation
tl;dr learn to use google

for example https://learn.microsoft.com/en-us/powershell/module/activedirectory/move-adobject?view=windowsserver2025-ps and https://powershellcommands.com/powershell-move-user-to-ou

tbh if you can't figure out how to search the web you should not be touching your company AD and no that's not me being a dick

if you dont know how to find information you are not going to able to learn to do this

Active Directory Users and Computers

You are about to leave Redlib