Replace AD attribute value with csv file header values

Question

I want to replace AD attribute "userPrincipalName" value according to CSV file header value here is what csv file(group.csv) contains

sAMAccountName
--------------
test.user1    
test.user2    

below the script

$data = Import-Csv -Path .\group.csv -Header 'sAMAccountName'
foreach($user in $data){
    Get-ADUser -Filter {sAMAccountName -eq "$($user.sAMAccountName)"} | Set-ADUser -Replace @{userPrincipalName="$($user.sAMAccountName)@RES.GROUP"}
}

here I want to replace AD attribute "userPrincipalName" with the value of sAMAccountName from csv file, something like sAMAccountName@RES.GROUP

this script does not work, can anyone please correct it?

Answer 1

Ok, since your comment shows the CSV file indeed does not have a header, I would suggest changing the code to:

$data = Import-Csv -Path .\group.csv -Header 'sAMAccountName'
foreach($user in $data) {
    $adUser = Get-ADUser -Filter "SamAccountName -eq '$($user.sAMAccountName)'" -ErrorAction SilentlyContinue
    if ($adUser) {
        $newUPN = '{0}@res.group' -f $user.sAMAccountName
        $adUser | Set-ADUser -UserPrincipalName $newUPN
    }
    else {
        Write-Warning "No user with SamAccountName '$($user.sAMAccountName)' could be found.."
    }
}

This way, any mistakes in the file will not make the code quit when a user with that samaccountname cannot be found. Instead, in that case you will see a warning about it and the code will continue with the rest of the data.

---

It might be worth mentioning that you can use parameter -Server on both the Get-ADUser and Set-ADUser cmdlets to make sure you use the same domain server (DC) to set the new UPN. Otherwise, you can set it on one DC, but are looking at another which doesn't show the change immediately because the servers need time to synchronize..

---

---

Now that we have cleared up the question about the CSV and to answer your comment:

If you want to do this as a two-script solution, here's how you can do that

step 1: get all users in the search OU that have a UserPrincipalName ending in '*@test.group'

$searchBase = "OU=Teams,OU=Prod,DC=RES,DC=TEST,DC=GROUP"
Get-ADUser -SearchBase $searchBase -Filter "UserPrincipalName -like '*@test.group'" | 
# select ony the SamAccountName and write to CSV with column header
Select-Object SamAccountName | Export-Csv -Path .\group.csv -NoTypeInformation

step 2: read the csv created above and

$searchBase = "OU=Teams,OU=Prod,DC=RES,DC=TEST,DC=GROUP"
$data = Import-Csv -Path .\group.csv
$result = foreach($user in $data) {
    $adUser = Get-ADUser -SearchBase $searchBase -Filter "SamAccountName -eq '$($user.sAMAccountName)'" -ErrorAction SilentlyContinue
    # if we have a user object AND its UserPrincipalName is not as desired go ahead and change that
    if ($adUser) {
        if ($adUser.UserPrincipalName -notlike '*@res.test.group') {
            $newUPN = '{0}@res.test.group' -f $user.sAMAccountName
            $adUser | Set-ADUser -UserPrincipalName $newUPN
            # output this user object to be collected in variable $result
            $adUser
        }
        else {
            Write-Host "User $($user.sAMAccountName) already has UPN '$($adUser.UserPrincipalName)'"
        }
    }
    else {
        Write-Warning "User with SamAccountName '$($user.sAMAccountName)' not found.."
    }
}

# now that we have changed some users, create a second csv with all users that were actually changed
if (@($result).Count) {
    $result | Select-Object SamAccountName | Export-Csv -Path .\Updatedgroup.csv -NoTypeInformation
}
else {
    Write-Host 'No users needed updating'
}

^{It seems a waste writing only the users SamAccountName property to the csv files.. Especially since Get-ADUser by default already returns these properties: DistinguishedName, Enabled, GivenName, Name, ObjectClass, ObjectGUID, SamAccountName, SID, Surname, UserPrincipalName}