Modify an Active Directory service account.
Syntax
Set-ADServiceAccount [-Identity] ADServiceAccount
[-AccountExpirationDate DateTime] [-AccountNotDelegated bool]
[-Add hashtable] [-Certificates string[]] [-Clear string[]]
[-Description string] [-DisplayName string] [-Enabled bool]
[-HomePage string] [-Remove hashtable] [-Replace hashtable]
[-SamAccountName string] [-ServicePrincipalNames hashtable]
[-TrustedForDelegation bool] [-AuthType {Negotiate | Basic}]
[-Credential PSCredential] [-Partition string] [-PassThru]
[-Server string] [-Confirm] [-WhatIf] [CommonParameters]
Set-ADServiceAccount -Instance ADServiceAccount
[-AuthType {Negotiate | Basic}] [-Credential PSCredential]
[-Partition string] [-PassThru] [-Server string]
[-Confirm] [-WhatIf] [CommonParameters]
Key
-AccountExpirationDate [System.DateTime]
The expiry date for the account. (0=never expires)
Use PowerShell DateTime syntax
Time is assumed to be local time unless otherwise specified.
The default time is 12:00 (Midday) local time.
The default date is the current date.
Examples using GMT, UTC and local time:
-AccountExpirationDate "Mon, 17 Apr 2011 21:22:48 GMT"
-AccountExpirationDate "2011-04-17T14:22:48.0000000"
-AccountExpirationDate "04/17/2011 2:22:48 PM"
The LDAP Display name (ldapDisplayName) for this property is accountExpires.
-AccountNotDelegated bool
Security delegation. When True, the security context of the user is not
delegated to a service even when the service account is set as trusted for
Kerberos delegation. Sets the AccountNotDelegated property for an AD account.
This parameter also sets the ADS_UF_NOT_DELEGATED flag of the AD User Account
Control (UAC) attribute.
Values for this parameter: $false or 0, $true or 1
-Add hashtable
Specify values to add to an object property.
Use this parameter to add one or more values to a property that cannot be modified
using a cmdlet parameter. To modify an object property, you must use the LDAP display name.
Specify multiple values to a property by specifying a comma-separated list of values
and more than one property by separating them using a semicolon.
The format for this parameter is
-Add @{Attribute1LDAPDisplayName=value1, value2, ...;
Attribute2LDAPDisplayName=value1, value2, ...; AttributeNLDAPDisplayName=value1, value2, ...}
For example, to remove the value "555-222-2222" and add the values "555-222-1111" and "555-222-3333
" to Phone-Office-Other attribute (LDAP display name 'otherTelephone'), and add the value "555-222-9999" to Pho
ne-Mobile-Other (LDAP display name 'otherMobile'), set the Add and Remove parameters as follows.
-Add @{otherTelephone='555-222-1111', '555-222-3333'; otherMobile='555-222-9999' } -Remove @{otherTelephone='
555-222-2222'}
When you use the -Add, -Remove, -Replace and -Clear parameters together, the operations will be
performed in the order: Remove, then Add, then Replace, then clear.
-AuthType {Negotiate | Basic}
The authentication method to use: Negotiate (or 0), Basic (or 1)
A Secure Sockets Layer (SSL) connection is required for Basic authentication.
-Certificates X509Certificate[]
Modifies the DER-encoded X.509v3 certificates of the account.
These certificates include the public key certificates issued to
this account by the Microsoft Certificate Service.
Sets the Certificates property of the account object.
The LDAP Display Name for this property is "userCertificate".
Syntax to add/remove/replace/clear:
-Certificates @{Add=value1,value2,...}
-Certificates @{Remove=value3,value4,...}
-Certificates @{Replace=value1,value2,...}
-Certificates $null
Multiple operations may be specified by using a list separated by semicolons.
-Certificates @{Add=value1,value2,...};@{Remove=value3,value4,...}
-Clear string[]
An array of object properties that will be cleared in the directory.
Use this parameter to clear one or more values of a property that cannot be modified
using a cmdlet parameter. To modify an object property, you must use the LDAP display name.
Modify more than one property by specifying a comma-separated list.
The format for this parameter is
-Clear Attribute1LDAPDisplayName, Attribute2LDAPDisplayName
For example, to clear the value for the Phone-Office-Other attribute
(LDAP display name 'otherTelephone') set the Clear parameter as follows.
-Clear otherTelephone
-Credential PSCredential
A user account that has permission to perform this action.
The default is the current user unless the cmdlet is run from an AD PowerShell provider drive
in which case the account associated with the drive is the default.
"MSAccount64" or "Domain01\MSAccount64" or a PSCredential object.
-Description string
A description of the object.
The LDAP Display Name for this property is "description".
-DisplayName string
The display name of the object.
The LDAP Display Name for this property is "displayName".
-Enabled bool
Is the account enabled.
An enabled account requires a password.
This parameter sets the Enabled property for an account object.
Also sets the ADS_UF_ACCOUNTDISABLE flag of the AD User Account Control (UAC) attribute.
Values for this parameter: $false or 0, $true or 1
-HomePage string
The URL of the home page of the object.
The LDAP Display Name for this property is "wWWHomePage".
-Identity ADAccount
Specify an AD domain object by providing one of the following values.
(The identifier in parentheses is the LDAP display name for the attribute.)
Distinguished Name
Example: DC=Helvetia,DC=corp,DC=SS64,DC=com
GUID (objectGUID)
Example: 9abd016a-31af-470a-af5a-be175343f9c3
Security Identifier (objectSid)
Example: S-1-5-21-5165297888-301467370-576410423-1803
Security Accounts Manager (SAM) Account Name (sAMAccountName)
Example: Helvetia
The cmdlet searches the default naming context or partition to find the object.
If two or more objects are found, the cmdlet returns a non-terminating error.
This parameter can also get this object through the pipeline or you can set this
parameter to an object instance.
-Instance ADServiceAccount
An instance of a service account object to use as a template for updating a service account object.
When this parameter is used, any modifications made to the modified copy of the object are also
made to the corresponding Active Directory object.
Only the object properties that have changed will be updated.
The -Instance parameter can only update service account objects that have been retrieved
with Get-ADServiceAccount. Do not also specify other parameters that set properties on the object.
Example of modifying an instance:
# Retrieve a local instance of the object.
$holly = Get-ADServiceAccount -Identity ADServiceAdmin
# Modify one or more properties of the instance.
$holly.Description = "default"
# Save changes
Set-ADServiceAccount -Instance $holly
-Partition string
The distinguished name of an AD partition.
The distinguished name must be one of the naming contexts on the current
directory server. The cmdlet searches this partition to find the object defined by
the -Identity parameter.
The following two examples show how to specify a value for this parameter.
-Partition "CN=Configuration,DC=Europe,DC=Test,DC=SS64,DC=com"
-Partition "CN=Schema,CN=Configuration,DC=Europe,DC=Test,DC=SS64,DC=com"
In many cases, a default value will be used for the Partition parameter if no value
is specified.
-PassThru
Returns the new or modified object.
By default (i.e. if -PassThru is not specified), this cmdlet does not generate any output.
-Remove hashtable
Remove values of an object property.
Use this parameter to remove one or more values of a property that cannot be modified
using a cmdlet parameter. To remove an object property, you must use the LDAP display name.
You can remove more than one property by specifying a semicolon-separated list.
The format for this parameter is
-Remove @{Attribute1LDAPDisplayName=value[]; Attribute2LDAPDisplayName=value[]}
For example, to add the values blue and green and remove the value pink from a property with a LDAP
display name of FavColors, set the Add and Remove parameters as follows.
-Add @{FavColors=Blue,Green} -Remove {FavColors=Pink}
When you use the -Add, -Remove, -Replace and -Clear parameters together, the operations will be
performed in the order: Remove, then Add, then Replace, then clear.
-Replace hashtable
Specify values for an object property that will replace the current values.
Use this parameter to replace one or more values of a property that cannot be modified
using a cmdlet parameter. To modify an object property, you must use the LDAP display name.
You can modify more than one property by specifying a comma-separated list.
The format for this parameter is
-Replace @{Attribute1LDAPDisplayName=value[], Attribute2LDAPDisplayName=value[]}
-SamAccountName string
The Security Account Manager (SAM) account name of the user, group, computer, or service account.
The maximum length of the description is 256 characters.
For compatibility with older operating systems use 20 characters or less.
The LDAP Display Name of this property is "sAMAccountName".
If the value provided is not terminated with a '$' character, the system will add one if needed.
-Server string
The AD Domain Services instance to connect to, this may be a Fully qualified domain name,
NetBIOS name or Fully qualified directory server name (with or without port number).
Examples: demo.SS64.com demo demoDC02.demo.ss64.com demoDC02.demo.ss64.com:3268
-ServicePrincipalNames string[]
The service principal names for the account.
Use the following syntax to add remove, replace or clear service principal name values:
-ServicePrincipalNames @{Add=value1,value2,...}
-ServicePrincipalNames @{Remove=value3,value4,...}
-ServicePrincipalNames @{Replace=value1,value2,...}
-ServicePrincipalNames $null
Multiple operations may be specified by using a list separated by semicolons.
-ServicePrincipalNames @{Add=value1,value2,...};@{Remove=value3,value4,...}
Example:
-ServicePrincipalNames @{Add="SQLservice\NewService.ss64.com:1456"};{Remove="SQLservice\demo.ss64.com:1456"}
-TrustedForDelegation bool
Whether an account is trusted for Kerberos delegation.
A service that runs under an account that is trusted for Kerberos delegation can
assume the identity of a client requesting the service.
This value also sets the ADS_UF_TRUSTED_FOR_DELEGATION flag of the AD UAC attribute.
Values for this parameter: $false or 0, $true or 1
-Confirm
Prompt for confirmation before executing the command.
-WhatIf
Describe what would happen if you executed the command, without actually executing the command.
CommonParameters:
-Verbose, -Debug, -ErrorAction, -ErrorVariable, -WarningAction, -WarningVariable,
-OutBuffer -OutVariable.
Set-ADServiceAccount modifies the properties of an AD service account. Modify commonly used property values by using the cmdlet parameters. Property values that are not associated with cmdlet parameters can be modified by using the -Add, -Replace, -Clear and -Remove parameters.
The -Identity parameter specifies the AD service account to modify. Identify a service account
by its distinguished name (DN), GUID, security identifier (SID), or Security Accounts Manager (SAM) account name. Alternatively set the -Identity parameter to an object variable or by passing
an object through the pipeline. e.g. from Get-ADServiceAccount
The -Instance parameter provides a way to update a service account object by applying the changes made to a copy of
the object. If the Instance parameter is set to a copy of an AD service account object that has been modified, then Set-ADServiceAccount may be used to save the same changes to the original service account object.
Examples
Set the description of Service Account 'svc_firewall' to "Firewall Alert Service":
PS C:\> Set-ADServiceAccount svc_firewall -Description "Firewall Alert Service"
Replace the value of property ServicePrincipalNames with "ADAMwdb/a.SS64.com", "ADAMbdb/a.SS64.com":
PS C:\> Set-ADServiceAccount svc_SS64 -ServicePrincipalNames @{replace="ADAMwdb/a.SS64.com", "ADAMbdb/a.SS64.com"}
“Identity would seem to be the garment with which one covers the nakedness of the self, in which case, it is best that the garment be loose, a little like the robes of the desert, through which one's nakedness can always be felt, and, sometimes, discerned” ~ James Arthur Baldwin
Related PowerShell Cmdlets:
Get-adServiceAccount - Get one or more AD service accounts.
Add-adComputerServiceAccount - Add one or more service accounts to an AD computer.
Reset-adServiceAccountPassword - Reset the service account password for a computer
Active Directory Management Gateway Service - Required to manage AD Domain Services with PowerShell.
docs.microsoft.com - Configure Standalone and Group Managed Service Accounts.