New-ADGroup [-Name] <string> [-GroupScope] <System.Nullable[Microsoft.ActiveDirectory.Management.ADGroupScope]>

[-AuthType {<Negotiate> | <Basic>}] [-Credential <PSCredential>]

[-Description <string>] [-DisplayName <string>] [-GroupCategory <System.Nullable[Microsoft.ActiveDirectory.Management.ADGroupCategory]>]

[-HomePage <string>] [-Instance <ADGroup>] [-ManagedBy <ADPrincipal>]

[-OtherAttributes <hashtable>] [-PassThru <switch>] [-Path <string>]

[-SamAccountName <string>] [-Server <string>] [-Confirm] [-WhatIf] [<CommonParameters>]

• Name
  
  
• GroupScope
  
  
• AuthType
  
  
• Credential
  
  
• Description
  
  
• DisplayName
  
  
• GroupCategory
  
  
• HomePage
  
  
• Instance
  
  
• ManagedBy
  
  
• OtherAttributes
  
  
• PassThru
  
  
• Path
  
  
• SamAccountName
  
  
• Server
  
  
• Confirm
  
  
• WhatIf
  
  

Specifies the authentication method to use. Possible values for this parameter include:
Negotiate or 0
Basic or 1

The default authentication method is Negotiate.

A Secure Sockets Layer (SSL) connection is required for the Basic authentication method.

The following example shows how to set this parameter to Basic.
-AuthType Basic

The following lists the acceptable values for this parameter:

• Negotiate
  
  
• Basic
  
  

Default Value: Microsoft.ActiveDirectory.Management.AuthType.Negotiate

Data Type: ADAuthType

Attributes

Value Attributes

Specifies the user account credentials to use to perform this task. The default credentials are the credentials of the currently logged on user unless the cmdlet is run from an Active Directory PowerShell provider drive. If the cmdlet is run from such a provider drive, the account associated with the drive is the default.

To specify this parameter, you can type a user name, such as "User1" or "Domain01\User01" or you can specify a PSCredential object. If you specify a user name for this parameter, the cmdlet prompts for a password.

You can also create a PSCredential object by using a script or by using the Get-Credential cmdlet. You can then set the Credential parameter to the PSCredential object The following example shows how to create credentials.
$AdminCredentials = Get-Credential "Domain01\User01"

The following shows how to set the Credential parameter to these credentials.
-Credential $AdminCredentials

If the acting credentials do not have directory-level permission to perform the task, Active Directory PowerShell returns a terminating error.

Default Value:

Data Type: PSCredential

Attributes

Value Attributes

Specifies a description of the object. This parameter sets the value of the Description property for the object. The LDAP Display Name (ldapDisplayName) for this property is "description".

The following example shows how to set this parameter to a sample description.
-Description "Description of the object"

Default Value:

Data Type: string

Attributes

Value Attributes

Specifies the display name of the object. This parameter sets the DisplayName property of the object. The LDAP Display Name (ldapDisplayName) for this property is "displayName".

The following example shows how to set this parameter.
-DisplayName "Sara Davis Laptop"

Default Value:

Data Type: string

Attributes

Value Attributes

Specifies the category of the group. Possible values of this parameter are:
Distribution or 0
Security or 1

This parameter sets the GroupCategory property of the group. This parameter value combined with other group values sets the LDAP Display Name (ldapDisplayName) attribute named "groupType".

The following example shows how to specify that a group is a security group.
-GroupCategory security

Default Value: Security

Data Type: System.Nullable[Microsoft.ActiveDirectory.Management.ADGroupCategory]

Attributes

Value Attributes

Specifies the group scope of the group. Possible values of this parameter are:
DomainLocal or 0
Global or 1
Universal or 2

This parameter sets the GroupScope property of a group object to the specified value. The LDAP display name of this property is "groupType".

The following example shows two ways to set this parameter to DomainLocal.
-GroupScope DomainLocal
-GroupScope 0

Default Value:

Data Type: System.Nullable[Microsoft.ActiveDirectory.Management.ADGroupScope]

Attributes

Value Attributes

Specifies the URL of the home page of the object. This parameter sets the homePage property of an Active Directory object. The LDAP Display Name (ldapDisplayName) for this property is "wWWHomePage".

The following example shows how to set this parameter to a URL.
-HomePage "http://employees.contoso.com/sdavis"

Default Value:

Data Type: string

Attributes

Value Attributes

Specifies an instance of a group object to use as a template for a new group object.

You can use an instance of an existing group object as a template or you can construct a new group object by using the Windows PowerShell command line or by using a script. The following examples show how to use these two methods to create group object templates.

Method 1: Use an existing group object as a template for a new object. Use the Get-ADGroup cmdlet to retrieve a group object then pass this object to the Instance parameter of the New-ADGroup cmdlet to create a new group object. You can override property values of the new object by setting the appropriate parameters.

$groupInstance = Get-ADGroup -Identity "KarenTohReports"
New-ADGroup -Name "Sara Davis Reports" -Instance $groupInstance GroupType DomainLocal

Method 2: Create a new ADGroup object and set the property values by using the Windows PowerShell command line interface. Then pass this object to the Instance parameter of the New-ADGroup cmdlet to create the new group object.

$groupTemplate = New-Object Microsoft.ActiveDirectory.Management.ADGroup
$groupTemplateGroupType = DomainLocal
New-ADGroup -Name "Sara Davis Reports" -Instance $groupInstance

Note: Specified attributes are not validated, so attempting to set attributes that do not exist or cannot be set will raise an error.

Default Value:

Data Type: ADGroup

Attributes

Value Attributes

Specifies the user or group that manages the object by providing one of the following property values. Note: The identifier in parentheses is the LDAP display name for the property.
Distinguished Name
Example: CN=SaraDavis,OU=Europe,CN=Users,DC=corp,DC=contoso,DC=com
GUID (objectGUID)
Example: 599c3d2e-f72d-4d20-8a88-030d99495f20
Security Identifier (objectSid)
Example: S-1-5-21-3165297888-301567370-576410423-1103
SAM Account Name (sAMAccountName)
Example: saradavis

This parameter sets the Active Directory attribute with an LDAP Display Name of "managedBy".

The following example shows how to specify this parameter.
-ManagedBy ContosoAdmins

Default Value:

Data Type: ADPrincipal

Attributes

Value Attributes

Specifies the name of the object. This parameter sets the Name property of the Active Directory object. The LDAP Display Name (ldapDisplayName) of this property is "name".

The following example shows how to set this parameter to a name string.
-Name "SaraDavis"

Default Value:

Data Type: string

Attributes

Value Attributes

Specifies object attribute values for attributes that are not represented by cmdlet parameters. You can set one or more parameters at the same time with this parameter. If an attribute takes more than one value, you can assign multiple values. To identify an attribute, specify the LDAPDisplayName (ldapDisplayName) defined for it in the Active Directory schema.

Syntax:
To specify a single value for an attribute:
-OtherAttributes @{'AttributeLDAPDisplayName'=value}
To specify multiple values for an attribute
-OtherAttributes @{'AttributeLDAPDisplayName'=value1,value2,...}

You can specify values for more than one attribute by using semicolons to separate attributes. The following syntax shows how to set values for multiple attributes:
-OtherAttributes @{'Attribute1LDAPDisplayName'=value; 'Attribute2LDAPDisplayName'=value1,value2;...}

The following examples show how to use this parameter.

To set the value of a custom attribute called favColors that takes a set of Unicode strings, use the following syntax:
-OtherAttributes @{'favColors'="pink","purple"}

To set values for favColors and dateOfBirth simultaneously, use the following syntax:
-OtherAttributes @{'favColors'="pink","purple"; 'dateOfBirth'=" 01/01/1960"}

Default Value:

Data Type: hashtable

Attributes

Value Attributes

Returns the new or modified object. By default (i.e. if -PassThru is not specified), this cmdlet does not generate any output.

Default Value:

Data Type: switch

Attributes

Value Attributes

Specifies the X.500 path of the Organizational Unit (OU) or container where the new object is created.

In many cases, a default value will be used for the Path parameter if no value is specified. The rules for determining the default value are given below. Note that rules listed first are evaluated first and once a default value can be determined, no further rules will be evaluated.

In AD DS environments, a default value for Path will be set in the following cases:
- If the cmdlet is run from an Active Directory PowerShell provider drive, the parameter is set to the current path of the provider drive.
- If the cmdlet has a default path, this will be used. For example: in New-ADUser, the Path parameter would default to the Users container.
- If none of the previous cases apply, the default value of Path will be set to the default partition or naming context of the target domain.

In AD LDS environments, a default value for Path will be set in the following cases:
- If the cmdlet is run from an Active Directory PowerShell provider drive, the parameter is set to the current path of the provider drive.
- If the cmdlet has a default path, this will be used. For example: in New-ADUser, the Path parameter would default to the Users container.
- If the target AD LDS instance has a default naming context, the default value of Path will be set to the default naming context. To specify a default naming context for an AD LDS environment, set the msDS-defaultNamingContext property of the Active Directory directory service agent (DSA) object (nTDSDSA) for the AD LDS instance.
- If none of the previous cases apply, the Path parameter will not take any default value.

The following example shows how to set this parameter to an OU.

-Path "ou=mfg,dc=noam,dc=corp,dc=contoso,dc=com"

Note: The Active Directory Provider cmdlets, such New-Item, Remove-Item, Remove-ItemProperty, Rename-Item and Set-ItemProperty also contain a Path property. However, for the provider cmdlets, the Path parameter identifies the path of the actual object and not the container as with the Active Directory cmdlets.

Default Value:

Data Type: string

Attributes

Value Attributes

Specifies the Security Account Manager (SAM) account name of the user, group, computer, or service account. The maximum length of the description is 256 characters. To be compatible with older operating systems, create a SAM account name that is 20 characters or less. This parameter sets the SAMAccountName for an account object. The LDAP display name (ldapDisplayName) for this property is "sAMAccountName".

The following example shows how to specify this parameter.
-SAMAccountName "saradavis"

Note: If the string value provided is not terminated with a '$' character, the system adds one if needed.

Default Value:

Data Type: string

Attributes

Value Attributes

Specifies the Active Directory Domain Services instance to connect to, by providing one of the following values for a corresponding domain name or directory server. The service may be any of the following: Active Directory Lightweight Domain Services, Active Directory Domain Services or Active Directory Snapshot instance.
Domain name values:
Fully qualified domain name
Examples: corp.contoso.com
NetBIOS name
Example: CORP

Directory server values:
Fully qualified directory server name
Example: corp-DC12.corp.contoso.com
NetBIOS name
Example: corp-DC12
Fully qualified directory server name and port
Example: corp-DC12.corp.contoso.com:3268

The default value for the Server parameter is determined by one of the following methods in the order that they are listed:
-By using Server value from objects passed through the pipeline.
-By using the server information associated with the Active Directory PowerShell provider drive, when running under that drive.
-By using the domain of the computer running Powershell.

The following example shows how to specify a full qualified domain name as the parameter value.
-Server "corp.contoso.com"

Default Value:

Data Type: string

Attributes

Value Attributes

Prompts you for confirmation before executing the command.

Default Value:

Data Type: SwitchParameter

Attributes

Value Attributes

Describes what would happen if you executed the command without actually executing the command.

Default Value:

Data Type: SwitchParameter

Attributes

Value Attributes

A group object that is a template for the new group object is received by the Instance parameter.

Returns the new group object when the PassThru parameter is specified. By default, this cmdlet does not generate any output.

New-ADGroup -Name "RODC Admins" -SamAccountName RODCAdmins -GroupCategory Security -GroupScope Global -DisplayName "RODC Administrators" -Path "CN=Users,DC=Fabrikam,DC=Com" -Description "Members of this group are RODC Administrators"

Create a new group named 'RODC Admins' in the container 'CN=Users,DC=Fabrikam,DC=Com' and set the GroupCategory, DisplayName, GroupScope, and Description properties on the new object.

Get-ADGroup FabrikamBranch1 -Properties Description | New-ADGroup  -Name Branch1Employees  -SamAccountName Branch1Employees -GroupCategory Distribution -PassThru

GroupScope : Universal
Name : Branch1Employees
GroupCategory : Distribution
SamAccountName : Branch1Employees
ObjectClass : group
ObjectGUID : 8eebce44-5df7-4bed-a98b-b987a702103e
SID : S-1-5-21-41432690-3719764436-1984117282-1117
DistinguishedName : CN=Branch1Employees,CN=Users,DC=Fabrikam,DC=com

Description

-----------

Create a new group using the property values from a current group.

New-ADGroup -Server localhost:60000 -Path "OU=AccountDeptOU,DC=AppNC" -Name AccountLeads -GroupScope DomainLocal  -GroupCategory Distribution

Create a new group named 'AccountLeads' on an AD LDS instance.

Add-ADGroupMember [-Identity] <ADGroup> [-Members] <ADPrincipal[]>

[-AuthType {<Negotiate> | <Basic>}] [-Credential <PSCredential>]

[-Partition <string>] [-PassThru <switch>] [-Server <string>] [-Confirm] [-WhatIf] [<CommonParameters>]

• Identity
  
  
• Members
  
  
• AuthType
  
  
• Credential
  
  
• Partition
  
  
• PassThru
  
  
• Server
  
  
• Confirm
  
  
• WhatIf
  
  

Specifies the authentication method to use. Possible values for this parameter include:
Negotiate or 0
Basic or 1

The default authentication method is Negotiate.

A Secure Sockets Layer (SSL) connection is required for the Basic authentication method.

The following example shows how to set this parameter to Basic.
-AuthType Basic

The following lists the acceptable values for this parameter:

• Negotiate
  
  
• Basic
  
  

Default Value: Microsoft.ActiveDirectory.Management.AuthType.Negotiate

Data Type: ADAuthType

Attributes

Value Attributes

Specifies the user account credentials to use to perform this task. The default credentials are the credentials of the currently logged on user unless the cmdlet is run from an Active Directory PowerShell provider drive. If the cmdlet is run from such a provider drive, the account associated with the drive is the default.

To specify this parameter, you can type a user name, such as "User1" or "Domain01\User01" or you can specify a PSCredential object. If you specify a user name for this parameter, the cmdlet prompts for a password.

You can also create a PSCredential object by using a script or by using the Get-Credential cmdlet. You can then set the Credential parameter to the PSCredential object The following example shows how to create credentials.
$AdminCredentials = Get-Credential "Domain01\User01"

The following shows how to set the Credential parameter to these credentials.
-Credential $AdminCredentials

If the acting credentials do not have directory-level permission to perform the task, Active Directory PowerShell returns a terminating error.

Default Value:

Data Type: PSCredential

Attributes

Value Attributes

Specifies an Active Directory group object by providing one of the following values. The identifier in parentheses is the LDAP display name for the attribute.

Distinguished Name
Example: CN=saradavisreports,OU=europe,CN=users,DC=corp,DC=contoso,DC=com
GUID (objectGUID)
Example: 599c3d2e-f72d-4d20-8a88-030d99495f20
Security Identifier (objectSid)
Example: S-1-5-21-3165297888-301567370-576410423-1103
Security Accounts Manager (SAM) Account Name (sAMAccountName)
Example: saradavisreports

The cmdlet searches the default naming context or partition to find the object. If two or more objects are found, the cmdlet returns a non-terminating error.

This parameter can also get this object through the pipeline or you can set this parameter to an object instance.

This example shows how to set the parameter to a distinguished name.
-Identity "CN=saradavisreports,OU=europe,CN=users,DC=corp,DC=contoso,DC=com"

This example shows how to set this parameter to a group object instance named "ADGroupInstance".
-Identity $ADGroupInstance

Default Value:

Data Type: ADGroup

Attributes

Value Attributes

Specifies a set of user, group, and computer objects in a comma-separated list to add to a group. To identify each object, use one of the following property values. Note: The identifier in parentheses is the LDAP display name.

Distinguished Name
Example: CN=SaraDavis,CN=Europe,CN=Users,DC=corp,DC=contoso,DC=com
GUID (objectGUID)
Example: 599c3d2e-f72d-4d20-8a88-030d99495f20
Security Identifier (objectSid)
Example: S-1-5-21-3165297888-301567370-576410423-1103
SAM Account Name (sAMAccountName)
Example: saradavis

You can also provide objects to this parameter directly.

The following examples show how to specify this parameter.

This example specifies a user and group to add by specifying the distinguished name and the SAM Account Name properties.
-Members "CN=SaraDavis,CN=employees,CN=Users,DC=contoso,DC=com", "saradavisreports"

This example specifies a user and a group object that are defined in the current Windows PowerShell session as input for the parameter.

-Members $userObject, $groupObject

The objects specified for this parameter are processed as Microsoft.ActiveDirectory.Management.ADPrincipal objects. Derived types, such as the following are also received by this parameter.
Microsoft.ActiveDirectory.Management.ADUser
Microsoft.ActiveDirectory.Management.ADComputer
Microsoft.ActiveDirectory.Management.ADServiceAccount
Microsoft.ActiveDirectory.Management.ADGroup

You cannot pass objects through the pipeline to this parameter.

Default Value:

Data Type: ADPrincipal[]

Attributes

Value Attributes

Specifies the distinguished name of an Active Directory partition. The distinguished name must be one of the naming contexts on the current directory server. The cmdlet searches this partition to find the object defined by the Identity parameter.
The following two examples show how to specify a value for this parameter.
-Partition "CN=Configuration,DC=EUROPE,DC=TEST,DC=CONTOSO,DC=COM"

-Partition "CN=Schema,CN=Configuration,DC=EUROPE,DC=TEST,DC=CONTOSO,DC=COM"

In many cases, a default value will be used for the Partition parameter if no value is specified. The rules for determining the default value are given below. Note that rules listed first are evaluated first and once a default value can be determined, no further rules will be evaluated.

In AD DS environments, a default value for Partition will be set in the following cases: - If the Identity parameter is set to a distinguished name, the default value of Partition is automatically generated from this distinguished name.
- If running cmdlets from an Active Directory provider drive, the default value of Partition is automatically generated from the current path in the drive.
- If none of the previous cases apply, the default value of Partition will be set to the default partition or naming context of the target domain.

In AD LDS environments, a default value for Partition will be set in the following cases:
- If the Identity parameter is set to a distinguished name, the default value of Partition is automatically generated from this distinguished name.
- If running cmdlets from an Active Directory provider drive, the default value of Partition is automatically generated from the current path in the drive.
- If the target AD LDS instance has a default naming context, the default value of Partition will be set to the default naming context. To specify a default naming context for an AD LDS environment, set the msDS-defaultNamingContext property of the Active Directory directory service agent (DSA) object (nTDSDSA) for the AD LDS instance.
- If none of the previous cases apply, the Partition parameter will not take any default value.

Default Value:

Data Type: string

Attributes

Value Attributes

Returns the new or modified object. By default (i.e. if -PassThru is not specified), this cmdlet does not generate any output.

Default Value:

Data Type: switch

Attributes

Value Attributes

Specifies the Active Directory Domain Services instance to connect to, by providing one of the following values for a corresponding domain name or directory server. The service may be any of the following: Active Directory Lightweight Domain Services, Active Directory Domain Services or Active Directory Snapshot instance.
Domain name values:
Fully qualified domain name
Examples: corp.contoso.com
NetBIOS name
Example: CORP

Directory server values:
Fully qualified directory server name
Example: corp-DC12.corp.contoso.com
NetBIOS name
Example: corp-DC12
Fully qualified directory server name and port
Example: corp-DC12.corp.contoso.com:3268

The default value for the Server parameter is determined by one of the following methods in the order that they are listed:
-By using Server value from objects passed through the pipeline.
-By using the server information associated with the Active Directory PowerShell provider drive, when running under that drive.
-By using the domain of the computer running Powershell.

The following example shows how to specify a full qualified domain name as the parameter value.
-Server "corp.contoso.com"

Default Value:

Data Type: string

Attributes

Value Attributes

Prompts you for confirmation before executing the command.

Default Value:

Data Type: SwitchParameter

Attributes

Value Attributes

Describes what would happen if you executed the command without actually executing the command.

Default Value:

Data Type: SwitchParameter

Attributes

Value Attributes

A group object is received by the Identity parameter.

Returns the modified group object when the PassThru parameter is specified. By default, this cmdlet does not generate any output.

Add-ADGroupMember SvcAccPSOGroup SQL01,SQL02

Adds the user accounts with SamAccountNames SQL01,SQL02 to the group SvcAccPSOGroup.

Add-ADGroupMember

cmdlet Add-ADGroupMember at command pipeline position 1
Supply values for the following parameters:
Identity: RodcAdmins
Members[0]: JohnSmith
Members[1]: JeffPrice
Members[2]:

Description

-----------

Demonstrates default behavior for this cmdlet (no parameters specified). Adds user accounts with SamAccountNames JohnSmith and JeffPrice to the group RodcAdmins.

Get-ADGroup -Server localhost:60000 -SearchBase "OU=AccountDeptOU,DC=AppNC" -filter { name -like "AccountLeads" } | Add-ADGroupMember -Members "CN=SanjayPatel,OU=AccountDeptOU,DC=AppNC"

Gets a group from the Organizational Unit "OU=AccountDeptOU,DC=AppNC" in the AD LDS instance localhost:60000 that has the name "AccountLeads" and then pipes it to Add-ADGroupMember, which then adds the user account with DistinguishedName "CN=SanjayPatel,OU=AccountDeptOU,DC=AppNC" to it.

$user = Get-ADUser "CN=Glen John,OU=UserAccounts,DC=NORTHAMERICA,DC=FABRIKAM,DC=COM" –Server "northamerica.fabrikam.com";
$group = Get-ADGroup "CN=AccountLeads,OU=UserAccounts,DC=EUROPE,DC=FABRIKAM,DC=COM" –Server "europe.fabrikam.com";
Add-ADGroupMember $group –Member $user –Server "europe.fabrikam.com"

Adds the user "CN=Glen John,OU=UserAccounts" from the North America domain to the group "CN=AccountLeads,OU=UserAccounts" in the Europe domain.

Add-ADPrincipalGroupMembership [-Identity] <ADPrincipal> [-MemberOf] <ADGroup[]>

[-AuthType {<Negotiate> | <Basic>}] [-Credential <PSCredential>]

[-Partition <string>] [-PassThru <switch>] [-Server <string>] [-Confirm] [-WhatIf] [<CommonParameters>]

• Identity
  
  
• MemberOf
  
  
• AuthType
  
  
• Credential
  
  
• Partition
  
  
• PassThru
  
  
• Server
  
  
• Confirm
  
  
• WhatIf
  
  

Specifies the authentication method to use. Possible values for this parameter include:
Negotiate or 0
Basic or 1

The default authentication method is Negotiate.

A Secure Sockets Layer (SSL) connection is required for the Basic authentication method.

The following example shows how to set this parameter to Basic.
-AuthType Basic

The following lists the acceptable values for this parameter:

• Negotiate
  
  
• Basic
  
  

Default Value: Microsoft.ActiveDirectory.Management.AuthType.Negotiate

Data Type: ADAuthType

Attributes

Value Attributes

Specifies the user account credentials to use to perform this task. The default credentials are the credentials of the currently logged on user unless the cmdlet is run from an Active Directory PowerShell provider drive. If the cmdlet is run from such a provider drive, the account associated with the drive is the default.

To specify this parameter, you can type a user name, such as "User1" or "Domain01\User01" or you can specify a PSCredential object. If you specify a user name for this parameter, the cmdlet prompts for a password.

You can also create a PSCredential object by using a script or by using the Get-Credential cmdlet. You can then set the Credential parameter to the PSCredential object The following example shows how to create credentials.
$AdminCredentials = Get-Credential "Domain01\User01"

The following shows how to set the Credential parameter to these credentials.
-Credential $AdminCredentials

If the acting credentials do not have directory-level permission to perform the task, Active Directory PowerShell returns a terminating error.

Default Value:

Data Type: PSCredential

Attributes

Value Attributes

Specifies an Active Directory principal object by providing one of the following property values. The identifier in parentheses is the LDAP display name for the attribute.

Distinguished Name
Example: CN=SaraDavis,CN=Users,DC=corp,DC=contoso,DC=com
GUID (objectGUID)
Example: 599c3d2e-f72d-4d20-8a88-030d99495f20
Security Identifier (objectSid)
Example: S-1-5-21-3165297888-301567370-576410423-1103
SAM Account Name (sAMAccountName)
Example: saradavis

The cmdlet searches the default naming context or partition to find the object. If two or more objects are found, the cmdlet returns a non-terminating error.

This parameter can also get this object through the pipeline or you can set this parameter to an object instance.

Derived types, such as the following are also accepted:
- Microsoft.ActiveDirectory.Management.ADGroup
- Microsoft.ActiveDirectory.Management.ADUser
- Microsoft.ActiveDirectory.Management.ADComputer
- Microsoft.ActiveDirectory.Management.ADServiceAccount

This example shows how to set the parameter to a distinguished name.
-Identity "CN=saradavis,CN=Users,DC=corp,DC=contoso,DC=com"

This example shows how to set this parameter to a principal object instance named "principalInstance".
-Identity $principalInstance

Default Value:

Data Type: ADPrincipal

Attributes

Value Attributes

Specifies the Active Directory groups to add a user, computer, or group to as a member. You can identify a group by providing one of the following values. Note: The identifier in parentheses is the LDAP display name for the attribute.

Distinguished Name
Example: CN=saradavisreports,CN=europe,CN=users,DC=corp,DC=contoso,DC=com
GUID (objectGUID)
Example: 599c3d2e-f72d-4d20-8a88-030d99495f20
Security Identifier (objectSid)
Example: S-1-5-21-3165297888-301567370-576410423-1103
Security Accounts Manager (SAM) Account Name (sAMAccountName)
Example: saradavisreports

If you are specifying more than one group, use commas to separate the groups in the list.

The following example shows how to specify this parameter by using SAM account name values.
-MemberOf "SaraDavisGroup", "JohnSmithGroup"

Default Value:

Data Type: ADGroup[]

Attributes

Value Attributes

Specifies the distinguished name of an Active Directory partition. The distinguished name must be one of the naming contexts on the current directory server. The cmdlet searches this partition to find the object defined by the Identity parameter.
The following two examples show how to specify a value for this parameter.
-Partition "CN=Configuration,DC=EUROPE,DC=TEST,DC=CONTOSO,DC=COM"

-Partition "CN=Schema,CN=Configuration,DC=EUROPE,DC=TEST,DC=CONTOSO,DC=COM"

In many cases, a default value will be used for the Partition parameter if no value is specified. The rules for determining the default value are given below. Note that rules listed first are evaluated first and once a default value can be determined, no further rules will be evaluated.

In AD DS environments, a default value for Partition will be set in the following cases: - If the Identity parameter is set to a distinguished name, the default value of Partition is automatically generated from this distinguished name.
- If running cmdlets from an Active Directory provider drive, the default value of Partition is automatically generated from the current path in the drive.
- If none of the previous cases apply, the default value of Partition will be set to the default partition or naming context of the target domain.

In AD LDS environments, a default value for Partition will be set in the following cases:
- If the Identity parameter is set to a distinguished name, the default value of Partition is automatically generated from this distinguished name.
- If running cmdlets from an Active Directory provider drive, the default value of Partition is automatically generated from the current path in the drive.
- If the target AD LDS instance has a default naming context, the default value of Partition will be set to the default naming context. To specify a default naming context for an AD LDS environment, set the msDS-defaultNamingContext property of the Active Directory directory service agent (DSA) object (nTDSDSA) for the AD LDS instance.
- If none of the previous cases apply, the Partition parameter will not take any default value.

Default Value:

Data Type: string

Attributes

Value Attributes

Returns the new or modified object. By default (i.e. if -PassThru is not specified), this cmdlet does not generate any output.

Default Value:

Data Type: switch

Attributes

Value Attributes

Specifies the Active Directory Domain Services instance to connect to, by providing one of the following values for a corresponding domain name or directory server. The service may be any of the following: Active Directory Lightweight Domain Services, Active Directory Domain Services or Active Directory Snapshot instance.
Domain name values:
Fully qualified domain name
Examples: corp.contoso.com
NetBIOS name
Example: CORP

Directory server values:
Fully qualified directory server name
Example: corp-DC12.corp.contoso.com
NetBIOS name
Example: corp-DC12
Fully qualified directory server name and port
Example: corp-DC12.corp.contoso.com:3268

The default value for the Server parameter is determined by one of the following methods in the order that they are listed:
-By using Server value from objects passed through the pipeline.
-By using the server information associated with the Active Directory PowerShell provider drive, when running under that drive.
-By using the domain of the computer running Powershell.

The following example shows how to specify a full qualified domain name as the parameter value.
-Server "corp.contoso.com"

Default Value:

Data Type: string

Attributes

Value Attributes

Prompts you for confirmation before executing the command.

Default Value:

Data Type: SwitchParameter

Attributes

Value Attributes

Describes what would happen if you executed the command without actually executing the command.

Default Value:

Data Type: SwitchParameter

Attributes

Value Attributes

A principal object (Microsoft.ActiveDirectory.Management.ADPrincipal) that represents a user, computer or group is received by the Identity parameter. Derived types, such as the following are also received by this parameter.
Microsoft.ActiveDirectory.Management.ADUser
Microsoft.ActiveDirectory.Management.ADComputer
Microsoft.ActiveDirectory.Management.ADServiceAccount
Microsoft.ActiveDirectory.Management.ADGroup

Returns a principal object that represents the modified user, computer or group object when the PassThru parameter is specified. By default, this cmdlet does not generate any output.

Add-ADPrincipalGroupMembership -Identity SQLAdmin1 -MemberOf DlgtdAdminsPSOGroup

Adds the user with SamAccountName "SQLAdmin1" to the group "DlgtdAdminsPSOGroup".

Get-ADUser -Filter 'Name -like "*SvcAccount*"' | Add-ADPrincipalGroupMembership -MemberOf SvcAccPSOGroup

Gets all users with "SvcAccount" in their name and adds it to the group "SvcAccPSOGroup".

Add-ADPrincipalGroupMembership

cmdlet Add-ADPrincipalGroupMembership at command pipeline position 1
Supply values for the following parameters:
Identity: JeffPrice
MemberOf[0]: RodcAdmins
MemberOf[1]: Allowed RODC Password Replication Group
MemberOf[2]:

Description

-----------

Demonstrates the default behavior of this cmdlet (no parameters specified).

Get-ADUser -Server localhost:60000 -SearchBase "DC=AppNC" -filter { Title -eq "Account Lead" -and Office -eq "Branch1" } |

Add-ADPrincipalGroupMembership -MemberOf "CN=AccountLeads,OU=AccountDeptOU,DC=AppNC"

Adds all employees in "Branch1" in the AD LDS instance "localhost:60000" whose title is "Account Lead" to the group with the DistinguishedName "CN=AccountLeads,OU=AccountDeptOU,DC=AppNC".

Windows Server 2012 對「適用於 Windows PowerShell 的 Active Directory 模組」擴充了 25 個新的 Cmdlet 來管理複寫和樹系拓撲。 在此之前，您只能使用一般的 *-AdObject 名詞或呼叫 .NET 函式。

就像所有 Active Directory Windows PowerShell Cmdlet 一樣，此功能必須至少在一部網域控制站 (或者最好在所有網域控制站) 安裝 Active Directory 管理閘道服務。

下表列出 Active Directory Windows PowerShell 模組新增的複寫和拓撲 Cmdlet。

大部分這些 Cmdlet 在 Repadmin.exe 中都有自己的基礎。 其他 (未列出) 的 Cmdlet 則處理如「動態存取控制」與「群組受管理的服務帳戶」等功能。

如需所有 Active Directory Windows PowerShell Cmdlet 的完整清單，請執行：

Get-command -module ActiveDirectory

如需所有 Active Directory Windows PowerShell Cmdlet 引數的完整清單，請參閱說明。 例如：

Get-help New-ADReplicationSite

使用 Update-Help Cmdlet 來下載並安裝說明檔

複寫和中繼資料

---

Get-ADReplicationAttributeMetadata

---

此 Cmdlet 類似 repadmin.exe /showobjmeta。 它可以傳回複寫中繼資料，例如當屬性變更時的來源網域控制站、版本和 USN 資訊與屬性資料。 此 Cmdlet 可用來稽核變更的位置與時間。

Windows PowerShell 與 Repadmin 不同的地方在於，可提供彈性的搜尋與輸出控制。 例如，您可以將 Domain Admins 物件的中繼資料輸出成排列過而方便讀取的清單：

Get-ADReplicationAttributeMetadata -object "cn=domain admins,cn=users,dc=corp,dc=contoso,dc=com" -server dc1.corp.contoso.com -showalllinkedvalues | format-list

或者，您也可以將資料排列成表格，類似 repadmin：

Get-ADReplicationAttributeMetadata -object "cn=domain admins,cn=users,dc=corp,dc=contoso,dc=com" -server dc1.corp.contoso.com -showalllinkedvalues | format-table -wrap

或者，您可以搭配篩選條件 (例如所有群組，然後與特定日期結合) 以管線方式輸出 Get-Adobject Cmdlet，以取得整個物件類別的中繼資料。 管線是用來在多個 Cmdlet 之間傳送資料的通道。 若要查看在 2012 年 1 月 13 日因為某些原因修改過的所有群組：

get-adobject -filter 'objectclass -eq "group"' | Get-ADReplicationAttributeMetadata -server dc1.corp.contoso.com | where-object {$_.lastoriginatingchangetime -like "*1/13/2012*" -and $_.attributename -eq "name"} | format-table object

如需更多 Windows PowerShell 作業搭配管線的詳細資訊，請參閱 Windows PowerShell 中的管線處理與管線。

或者，想要找出成員有 Tong Wang 的每個群組，以及上次修改群組的時間：

get-adobject -filter 'objectclass -eq "group"' | Get-ADReplicationAttributeMetadata -server dc1.corp.contoso.com -showalllinkedvalues | where-object {$_.attributevalue -like "*tony wang*"} | format-table object,LastOriginatingChangeTime,version -auto

或者，若要根據人工方式的高版本，找出網域中使用系統狀態備份進行系統授權還原的所有物件：

get-adobject -filter 'objectclass -like "*"' | Get-ADReplicationAttributeMetadata -server dc1.corp.contoso.com | where-object {$_.version -gt "100000" -and $_.attributename -eq "name"} | format-table object,LastOriginatingChangeTime

或者，將所有使用者中繼資料都傳送到 CSV 檔案，以供稍後在 Microsoft Excel 中檢查：

get-adobject -filter 'objectclass -eq "user"' | Get-ADReplicationAttributeMetadata -server dc1.corp.contoso.com -showalllinkedvalues | export-csv allgroupmetadata.csv

Get-ADReplicationPartnerMetadata

---

此 Cmdlet 會傳回網域控制站之複寫設定與狀態的相關資訊，讓您監視、清查或疑難排解。 不像 Repadmin.exe，使用 Windows PowerShell 表示您只會以您想要的格式，看到對您重要的資料。

例如，單一網域控制站的可讀取複寫狀態：

Get-ADReplicationPartnerMetadata -target dc1.corp.contoso.com

或者，以表格格式查看上一次網域控制站內送複寫及其複寫協力電腦的資料：

Get-ADReplicationPartnerMetadata -target dc1.corp.contoso.com | format-table lastreplicationattempt,lastreplicationresult,partner -auto

或者，連絡樹系中的所有網域控制站並顯示最後一次嘗試複寫卻因任何原因而失敗的網域控制站：

Get-ADReplicationPartnerMetadata -target * -scope server | where {$_.lastreplicationresult -ne "0"} | ft server,lastreplicationattempt,lastreplicationresult,partner -auto

Get-ADReplicationFailure

---

此 Cmdlet 可用來傳回複寫時發生最近錯誤的相關資訊。 它類似 Repadmin.exe /showreplsum，不過同樣地，因為使用 Windows PowerShell 而能採取更多控制方式。

例如，您可以傳回網域控制站最近的失敗，以及其無法連絡的複寫協力電腦：

Get-ADReplicationFailure dc1.corp.contoso.com

或者，傳回特定 AD 邏輯站台中所有伺服器的表格檢視，因為經過排序，所以更容易檢視，而且只包含最重要的資料：

Get-ADReplicationFailure -scope site -target default-first-site-name | format-table server,firstfailuretime,failurecount,lasterror,partner -auto

Get-ADReplicationQueueOperation 和 Get-ADReplicationUpToDatenessVectorTable

---

Sync-ADObject

---

此 Cmdlet 類似執行 Repadmin.exe /replsingleobject。 當您進行需要頻外複寫的變更，尤其是修正問題時，它會非常有用。

例如，如果某人刪除了總裁的使用者帳戶，並使用 Active Directory 資源回收筒將它還原，您可能想要將它立即複寫到所有網域控制站。 您可能也想要執行此動作而不強制複寫所有其他物件的變更；畢竟，這就是為什麼要有複寫排程 (因為可以避免 WAN 連結超過負荷)。

Get-ADDomainController -filter * | foreach {Sync-ADObject -object "cn=tony wang,cn=users,dc=corp,dc=contoso,dc=com" -source dc1 -destination $_.hostname}

拓撲

---

雖然 Repadmin.exe 擅長傳回如站台、站台連結、站台連結橋接器與連線等複寫拓撲的相關資訊，但是它並沒有一組完整的引數可進行變更。 事實上，也從來沒有任何專門設計可編寫指令碼、附隨的 Windows 公用程式，讓系統管理員建立及修改 AD DS 拓撲。 由於 Active Directory 在眾多客戶環境中已經非常成熟，因此大量修改 Active Directory 邏輯資訊的需求就變得很重要。

例如，新的分公司迅速擴編加上與其他分公司整併，根據實體位置、網路變更和新的容量需求，您可能會有上百個站台變更需要處理。 比起使用 Dssites.msc 和 Adsiedit.msc 進行變更，您可以進行自動化。 當您使用網路和設備團隊提供的試算表資料時，這樣會特別方便。

Get-Adreplication* Cmdlet 會傳回複寫拓撲的相關資訊，而且在以管線方式大量輸出到 Set-Adreplication* Cmdlet 時很好用。 Get Cmdlet 不會變更資料，它們只會顯示資料或建立能以管線方式輸出到 Set-Adreplication* Cmdlet 的 Windows PowerShell 工作階段物件。 New 和 Remove
Cmdlet 可用來建立或移除 Active Directory 拓撲物件。

例如，您可以使用 CSV 檔案建立新的站台：

import-csv -path C:\newsites.csv | new-adreplicationsite

或者，在兩具有自訂複寫間隔和站台成本的個現有站台之間建立新的站台連結：

new-adreplicationsitelink -name "chicago<-->waukegan" -sitesincluded chicago,waukegan -cost 50 -replicationfrequencyinminutes 15

或者，尋找樹系中的每個站台並以旗標取代其 Options 屬性來啟用站台間的變更通知，以便使用最大的壓縮速度複寫：

get-adreplicationsitelink -filter * | set-adobject –replace @{options=$($_.options –bor 1)}

重要事項
設定 -bor 5 可一併停用那些站台連結的壓縮。

或者，尋找缺少子網路指派的所有站台，以便與那些位置的實際子網路調解清單：

get-adreplicationsite -filter * -property subnets | where-object {!$_.subnets -eq "*"} | format-table name

New-ADOrganizationalUnit [-Name]  [-AuthType { | }]
[-City ] [-Country ] [-Credential ]
[-Description ] [-DisplayName ] [-Instance ]
[-ManagedBy ] [-OtherAttributes ] [-PassThru ]
[-Path ] [-PostalCode ] [-ProtectedFromAccidentalDeletion ]
[-Server ] [-State ] [-StreetAddress ] [-Confirm] [-WhatIf] []

• Name
  
  
• AuthType
  
  
• City
  
  
• Country
  
  
• Credential
  
  
• Description
  
  
• DisplayName
  
  
• Instance
  
  
• ManagedBy
  
  
• OtherAttributes
  
  
• PassThru
  
  
• Path
  
  
• PostalCode
  
  
• ProtectedFromAccidentalDeletion
  
  
• Server
  
  
• State
  
  
• StreetAddress
  
  
• Confirm
  
  
• WhatIf
  
  

Specifies the authentication method to use. Possible values for this parameter include:
Negotiate or 0
Basic or 1

The default authentication method is Negotiate.

A Secure Sockets Layer (SSL) connection is required for the Basic authentication method.

The following example shows how to set this parameter to Basic.
-AuthType Basic

The following lists the acceptable values for this parameter:

• Negotiate
  
  
• Basic
  
  

Default Value: Microsoft.ActiveDirectory.Management.AuthType.Negotiate

Data Type: ADAuthType

Attributes

Value Attributes

Specifies the user's town or city. This parameter sets the City property of a user. The LDAP display name (ldapDisplayName) of this property is "l".

The following example shows how set this parameter.
-City "Las Vegas"

Default Value:

Data Type: string

Attributes

Value Attributes

Specifies the country or region code for the user's language of choice. This parameter sets the Country property of a user object. The LDAP Display Name (ldapDisplayName) of this property is "c". This value is not used by Windows 2000.

The following example shows how set this parameter.
-Country "IN"

Default Value:

Data Type: string

Attributes

Value Attributes

Specifies the user account credentials to use to perform this task. The default credentials are the credentials of the currently logged on user unless the cmdlet is run from an Active Directory PowerShell provider drive. If the cmdlet is run from such a provider drive, the account associated with the drive is the default.

To specify this parameter, you can type a user name, such as "User1" or "Domain01\User01" or you can specify a PSCredential object. If you specify a user name for this parameter, the cmdlet prompts for a password.

You can also create a PSCredential object by using a script or by using the Get-Credential cmdlet. You can then set the Credential parameter to the PSCredential object The following example shows how to create credentials.
$AdminCredentials = Get-Credential "Domain01\User01"

The following shows how to set the Credential parameter to these credentials.
-Credential $AdminCredentials

If the acting credentials do not have directory-level permission to perform the task, Active Directory PowerShell returns a terminating error.

Default Value:

Data Type: PSCredential

Attributes

Value Attributes

Specifies a description of the object. This parameter sets the value of the Description property for the object. The LDAP Display Name (ldapDisplayName) for this property is "description".

The following example shows how to set this parameter to a sample description.
-Description "Description of the object"

Default Value:

Data Type: string

Attributes

Value Attributes

Specifies the display name of the object. This parameter sets the DisplayName property of the object. The LDAP Display Name (ldapDisplayName) for this property is "displayName".

The following example shows how to set this parameter.
-DisplayName "Sara Davis Laptop"

Default Value:

Data Type: string

Attributes

Value Attributes

Specifies an instance of an organizational unit object to use as a template for a new organizational unit object.

You can use an instance of an existing organizational unit object as a template or you can construct a new organizational unit object by using the Windows PowerShell command line or by using a script. The following examples show how to use these two methods to create organizational unit object templates.

Method 1: Use an existing organizational unit object as a template for a new object. To retrieve an instance of an existing organizational unit object use Get-ADOrganizationalUnit. Then provide this object to the Instance parameter of the New-ADOrganizationalUnit cmdlet to create a new organizational unit object. You can override property values of the new object by setting the appropriate parameters.

$organizationalUnitInstance = Get-ADOrganizationalUnit -Identity accountingAsia
New-ADOrganizationalUnit -Name accountingAustralia -Instance $OrganizationalUnitInstance -Country Australia

Method 2: Create a new ADOrganizationalUnit object and set the property values by using the Windows PowerShell command line interface. Then pass this object to the Instance parameter of the New-ADOrganizationalUnit cmdlet to create the new Active Directory organizational unit object.

$OrganizationalUnitInstance = new-object Microsoft.ActiveDirectory.Management.ADOrganizationalUnit
$OrganizationalUnitInstance.Country = Australia
New-ADOrganizationalUnit -Name accountingAustralia -Instance $OrganizationalUnitInstance

Note: Specified attributes are not validated, so attempting to set attributes that do not exist or cannot be set will raise an error.

Default Value:

Data Type: ADOrganizationalUnit

Attributes

Value Attributes

Specifies the user or group that manages the object by providing one of the following property values. Note: The identifier in parentheses is the LDAP display name for the property.
Distinguished Name
Example: CN=SaraDavis,OU=Europe,CN=Users,DC=corp,DC=contoso,DC=com
GUID (objectGUID)
Example: 599c3d2e-f72d-4d20-8a88-030d99495f20
Security Identifier (objectSid)
Example: S-1-5-21-3165297888-301567370-576410423-1103
SAM Account Name (sAMAccountName)
Example: saradavis

This parameter sets the Active Directory attribute with an LDAP Display Name of "managedBy".

The following example shows how to specify this parameter.
-ManagedBy ContosoAdmins

Default Value:

Data Type: ADPrincipal

Attributes

Value Attributes

Specifies the name of the object. This parameter sets the Name property of the Active Directory object. The LDAP Display Name (ldapDisplayName) of this property is "name".

The following example shows how to set this parameter to a name string.
-Name "SaraDavis"

Default Value:

Data Type: string

Attributes

Value Attributes

Specifies object attribute values for attributes that are not represented by cmdlet parameters. You can set one or more parameters at the same time with this parameter. If an attribute takes more than one value, you can assign multiple values. To identify an attribute, specify the LDAPDisplayName (ldapDisplayName) defined for it in the Active Directory schema.

Syntax:
To specify a single value for an attribute:
-OtherAttributes @{'AttributeLDAPDisplayName'=value}
To specify multiple values for an attribute
-OtherAttributes @{'AttributeLDAPDisplayName'=value1,value2,...}

You can specify values for more than one attribute by using semicolons to separate attributes. The following syntax shows how to set values for multiple attributes:
-OtherAttributes @{'Attribute1LDAPDisplayName'=value; 'Attribute2LDAPDisplayName'=value1,value2;...}

The following examples show how to use this parameter.

To set the value of a custom attribute called favColors that takes a set of Unicode strings, use the following syntax:
-OtherAttributes @{'favColors'="pink","purple"}

To set values for favColors and dateOfBirth simultaneously, use the following syntax:
-OtherAttributes @{'favColors'="pink","purple"; 'dateOfBirth'=" 01/01/1960"}

Default Value:

Data Type: hashtable

Attributes

Value Attributes

Returns the new or modified object. By default (i.e. if -PassThru is not specified), this cmdlet does not generate any output.

Default Value:

Data Type: switch

Attributes

Value Attributes

Specifies the X.500 path of the Organizational Unit (OU) or container where the new object is created.

In many cases, a default value will be used for the Path parameter if no value is specified. The rules for determining the default value are given below. Note that rules listed first are evaluated first and once a default value can be determined, no further rules will be evaluated.

In AD DS environments, a default value for Path will be set in the following cases:
- If the cmdlet is run from an Active Directory PowerShell provider drive, the parameter is set to the current path of the provider drive.
- If the cmdlet has a default path, this will be used. For example: in New-ADUser, the Path parameter would default to the Users container.
- If none of the previous cases apply, the default value of Path will be set to the default partition or naming context of the target domain.

In AD LDS environments, a default value for Path will be set in the following cases:
- If the cmdlet is run from an Active Directory PowerShell provider drive, the parameter is set to the current path of the provider drive.
- If the cmdlet has a default path, this will be used. For example: in New-ADUser, the Path parameter would default to the Users container.
- If the target AD LDS instance has a default naming context, the default value of Path will be set to the default naming context. To specify a default naming context for an AD LDS environment, set the msDS-defaultNamingContext property of the Active Directory directory service agent (DSA) object (nTDSDSA) for the AD LDS instance.
- If none of the previous cases apply, the Path parameter will not take any default value.

The following example shows how to set this parameter to an OU.

-Path "ou=mfg,dc=noam,dc=corp,dc=contoso,dc=com"

Note: The Active Directory Provider cmdlets, such New-Item, Remove-Item, Remove-ItemProperty, Rename-Item and Set-ItemProperty also contain a Path property. However, for the provider cmdlets, the Path parameter identifies the path of the actual object and not the container as with the Active Directory cmdlets.

Default Value:

Data Type: string

Attributes

Value Attributes

Specifies the user's postal code or zip code. This parameter sets the PostalCode property of a user. The LDAP Display Name (ldapDisplayName) of this property is "postalCode".

The following example shows how to set this parameter.
-PostalCode "28712"

Default Value:

Data Type: string

Attributes

Value Attributes

Specifies whether to prevent the object from being deleted. When this property is set to true, you cannot delete the corresponding object without changing the value of the property. Possible values for this parameter include:
$false or 0
$true or 1

The following example shows how to set this parameter to true.
-ProtectedFromAccidentalDeletion $true

Default Value: $true

Data Type: System.Nullable[bool]

Attributes

Value Attributes

Specifies the Active Directory Domain Services instance to connect to, by providing one of the following values for a corresponding domain name or directory server. The service may be any of the following: Active Directory Lightweight Domain Services, Active Directory Domain Services or Active Directory Snapshot instance.
Domain name values:
Fully qualified domain name
Examples: corp.contoso.com
NetBIOS name
Example: CORP

Directory server values:
Fully qualified directory server name
Example: corp-DC12.corp.contoso.com
NetBIOS name
Example: corp-DC12
Fully qualified directory server name and port
Example: corp-DC12.corp.contoso.com:3268

The default value for the Server parameter is determined by one of the following methods in the order that they are listed:
-By using Server value from objects passed through the pipeline.
-By using the server information associated with the Active Directory PowerShell provider drive, when running under that drive.
-By using the domain of the computer running Powershell.

The following example shows how to specify a full qualified domain name as the parameter value.
-Server "corp.contoso.com"

Default Value:

Data Type: string

Attributes

Value Attributes

Specifies the user's or Organizational Unit's state or province. This parameter sets the State property of a User or Organizational Unit object. The LDAP display name (ldapDisplayName) of this property is "st".

The following example shows how set this parameter.
-State "Nevada"

Default Value:

Data Type: string

Attributes

Value Attributes

Specifies the organizational unit's street address. This parameter sets the StreetAddress property of a organizational unit object. The LDAP display name (ldapDisplayName) of this property is "street".

The following example shows how to set this parameter.
-StreetAddress "1200 Main Street"

Default Value:

Data Type: string

Attributes

Value Attributes

Prompts you for confirmation before executing the command.

Default Value:

Data Type: SwitchParameter

Attributes

Value Attributes

Describes what would happen if you executed the command without actually executing the command.

Default Value:

Data Type: SwitchParameter

Attributes

Value Attributes

An organizational unit object that is a template for the new organizational unit object is received by the Instance parameter.

Returns the new organizational unit object when the PassThru parameter is specified. By default, this cmdlet does not generate any output.

New-ADOrganizationalUnit -Name UserAccounts -Path "DC=FABRIKAM,DC=COM"

Creates a new OrganizationalUnit named 'UserAccounts' which is protected from accidental deletion.

New-ADOrganizationalUnit -Name UserAccounts -Path "DC=FABRIKAM,DC=COM" -ProtectedFromAccidentalDeletion $false

Creates a new OrganizationalUnit named 'UserAccounts' which is not protected from deletion.

New-ADOrganizationalUnit -Name UserAccounts -Path "DC=FABRIKAM,DC=COM" -OtherAttributes @{seeAlso="CN=HumanResourceManagers,OU=Groups,OU=Managed,DC=Fabrikam,DC=com";managedBy="CN=TomC,DC=FABRIKAM,DC=COM"}

Creates an OrganizationalUnit name 'UserAccounts' which is protected from accidental deletion with properties 'seeAlso' and 'managedBy' set to the specified values.

$ouTemplate = Get-ADOrganizationalUnit "OU=UserAccounts,DC=Fabrikam,DC=com" -properties seeAlso,managedBy; New-ADOrganizationalUnit -name TomCReports -instance $ouTemplate

Uses the data from the OrganizationalUnit 'OU=UserAccounts,DC=Fabrikam,DC=com' as a template for another new OrganizationalUnit.

New-ADOrganizationalUnit -name "Managed" -path "DC=AppNC" -server "FABRIKAM-SRV1:60000"

Creates a new OrganizationalUnit named 'Managed' in an LDS instance.