Share via

PowerShell Tip: How to check AD Attributes using PowerShell?

  • Article

Most of the organization will have the same query.

  • We have changed the AD field and it's not showing the updated new value - Strange issue
  • We have two way full trust forest and I couldn't query trusted domain users details

Question:
I often get queries when did you changed the department in AD - I don't see it

Answer: 
Give some time for Domain Controller to replicate I did it in DC001. We do have 40 DC in our environment.

OP said, okay I will log on to DC001 and confirm.

Question:
We do have FIM SYNC - Using for Exchange Online to fetch AD users information from on premises to cloud. But every time we need to do FIM SYNC more than once to get new values updated.

Answer:
Once the Domain Controller replication is done - FIM will get correct value in first time SYNC. Because FIM will not point to one DC. It will be like 'Automatically Detect DC'

PowerShell Tip to FIND and SOLVE :)

There are many ways to do this, but I opted the below

Change User Department:
Power Tip: Use "-Service" and ensure FIM is pointing to the same DC

Set-QADUser -Identity "SomeID" -Department "IT Admin" -Service "DC" -Credential "DOMAIN\ADMIN"

In Trusted Forest you can use alternate DC which is your partners environment.

Enjoy PowerShell :)