Home / HomePage / Scripts / Change AD Properties

Change AD Properties

Someone wanted a script to walk through the Active Directory and change each user's CN to match their displayname. This script goes through every item in a named OU (or the whole AD) and makes the change, after first displaying it to the user and asking confirmation. It shows the use of dsquery, dsget, and dsmove commands. Could easily put a dsmod in there if needed.

@echo off
setlocal
::set OU to nothing if you want to walk through the whole AD
set OU="OU=test,DC=cojones,DC=org"
::query all users in the above named OU and pass to DSGET
for /f "tokens=*" %%a in ('dsquery user %OU% -o dn -name *') do (set DN=%%a) && call :DSGET
endlocal
goto :EOF

:DSGET
::get the displayname
set counter=0
for /f "tokens=*" %%a in ('dsget user %DN% -display') do (set displayname=%%a) && call :SHOWCHANGE
set DN=
goto :eof

:SHOWCHANGE
::show the DN and displayname to user
set /a counter=%counter% + 1
if {%counter%}=={2} (echo %DN% has displayname: %displayname%) & call :MAKECHANGE
goto :eof

:MAKECHANGE
::ask for confirmation. If confirmed, the user RDN is set to the displayname.
set /p DOIT="Change CN to %displayname%? y/n "
if {%DOIT%}=={y} dsmove %DN% -newname %displayname%
set DOIT=
goto :eof

scripts