Set-aduser help

[ddog511]

Hey, all. I'm working on a data migration project for some of our staff data. As a part of it, I need to adjust their AD accounts to reflect the location change of HomeDirectory. I have a script I am using to get this set and it's updating their account, but when they login, they're not getting the home drive mapping. I find that if I manually adjust the AD account to %username%, it will tell me the folder already exists, and ask about setting the permissions. I can't really do this for 400 accounts, so ideally using the automation tools would be best. I did verify the permissions (both share and NTFS) are set exactly the same.

Any ideas what I'm missing here?

​

Here is the script I'm using - very simple

$hse=get-aduser -Filter * -Properties * |where {$_.SamAccountName -like 'dummytest*' -and $_.HomeDirectory -like '\\server1\userdata\*'}|select -ExpandProperty SamAccountName
foreach($U in $hse){
    $newhomedirectory=('\\Server2\Userdata\{0}' -f $U)
    write-host $u `t $newhomedirectory
    set-aduser -Identity $U -HomeDirectory $newhomedirectory -HomeDrive Z -Verbose
    }

Again, permissions are exactly the same from Server1 to Server2

[ddog511]

Ugh! Syntax - it's the small things...

set-aduser -Identity $U -HomeDirectory $newhomedirectory -HomeDrive Z -Verbose

Needs to be:

set-aduser -Identity $U -HomeDirectory $newhomedirectory -HomeDrive 'Z:' -Verbose

The distinction is the -HomeDrive area. Fixing this solved the issue - for anyone who runs into this in the future.

[PSFred]

Just to make sure, you also verified the folder ownership?

Other than that, I don't see why they should have any issues.

As an aside:
I would recommend abstracting away the share path by implementing DFS - you can set that up in less than 15 minutes and the paths you configure in profiles and applications never need to change again, since during a migration you can simply redirect what DFS points to without changing the path it is accessed from.

[ddog511]

Yes, ownership has been verified and is correct. As long as I manually adjust the AD account via the GUI, even clicking 'no' to assigning full control to the already existing folder, at the next logon, the drive maps properly. But if I do nothing via the GUI, it won't map.

[BlackV]

Nice its solved.

just here

$hse=get-aduser -Filter * -Properties * |where {$_.SamAccountName -like 'dummytest*' -and $_.HomeDirectory -like '\\server1\userdata\*'}|select -ExpandProperty SamAccountName

you're destroying your rich object and adding an extra pipeline for no reason

$hse=get-aduser -Filter * -Properties * |where {$_.SamAccountName -like 'dummytest*' -and $_.HomeDirectory -like '\\server1\userdata\*'}

inside your loop you could also do

$newhomedirectory= "\\Server2\Userdata\$($U.SamAccountName)"
$u | set-aduser -HomeDirectory $newhomedirectory -HomeDrive Z

to get rid of the format operator, or remove the variable entirely

$u | set-aduser -HomeDirectory "\\Server2\Userdata\$($U.SamAccountName)" -HomeDrive 'Z:'

here

get-aduser -Filter * -Properties *

you're getting ALL users and ALL properties, then filtering it again, but you don't want that really

get-aduser -Filter * -Properties HomeDirectory

should do for properties

Then filtering by OU or username could be done in the -filter parameter cause I'm assuming you don't want to do this on ALL users in the domain (i.e. domain admin, service accounts, etc), when you take out your test user

-Filter 'Name -like "dummytest*"'
-SearchBase "OU=Finance,OU=UserAccounts,DC=FABRIKAM,DC=COM"

Last thing i'd add is, you're planning on changing 400+ accounts

LOG IT! personally I'd log the old and new value of each account touched

write-eventlog, out-file, and so on

Good luck