Bulk Modify AD User Attributes with AD Pro Toolkit

To open it, go to Tools > Users > Bulk update. You need a role that can manage users.

Bulk update users changes existing Active Directory accounts from a CSV file. Use it to apply an HR export, fix job titles and departments after a reorganization, set managers, or fill in phone numbers for hundreds of accounts at once.

Tips

This tool is powerful. It can change settings on many accounts at once.

• Existing values are overwritten. If an attribute already has a value, the tool replaces it. If the cell is blank in your CSV, that attribute is left alone.
• Values can be removed. Put {remove} in the CSV to clear an attribute. You can update and remove attributes in the same run.
• Start small. Try the file on two or three accounts first, check the result in AD, then run the full file.
• Only include what you want to change. Every non-blank cell is written, even if it is the same as the current value.
• Blank cells can't clear a value. A blank cell always means "leave it alone".
• Watch for spreadsheet formatting. Excel can drop leading zeros from employee IDs and phone numbers, or turn long numbers into scientific notation. Format those columns as text before you save the CSV.

Step 1: Prepare and upload the CSV file

Start from one of these:

• The template. On the Bulk update page, select Download template. It has the most used columns and two example rows.
• An export. Export the users you want to change from a report in AD Pro Toolkit, your HR system or PowerShell. This is the quickest way when you are changing many accounts, because the match column is already filled in.
• A file you used before with the desktop AD Pro Toolkit's Bulk update. It works here unchanged, including {clear} and {remove}.

Fill it in

Open the file in Excel or any spreadsheet program.

1. Keep a column that identifies each account. This is usually Logon Name (sAMAccountName), but it can be the UPN, email address, employee ID or employee number. See Match accounts by.
2. Keep only the columns you want to change, and delete the rest. Every filled-in cell is compared with the account and written if it differs, so a column you didn't mean to change can put back an old value. Select Supported columns on the page, or see Supported columns, for every column you can use.
3. Add one row per account. Fill in the identifying column, then the new values.
   • Leave a cell blank to leave that value as it is.
   • Enter {clear} to clear a value.
   • Separate several values with semicolons, for example groups in Member Of (Sales;All Staff) or addresses in Proxy Addresses.
4. Save it as CSV. In Excel, choose File > Save As and pick CSV UTF-8 (Comma delimited). Plain CSV works too, but UTF-8 keeps accented names intact.

For example, this file changes two people's job details, gives the first a manager and adds them to two groups, and clears the second person's telephone number:

Logon Name (sAMAccountName),Job Title,Department,Manager,Telephone Number,Member Of
jsmith,Sales Manager,Sales,dreyes,,Sales;All Staff
adietrich,Attorney,Legal,,{clear},

The blank Telephone Number for jsmith and the blank Manager for adietrich leave those values as they are.

Column headings are matched without regard to case, and both the friendly names and the AD attribute names work. For example, Job Title, Title and title all set the job title, and Member Of, memberOf and Groups all set group membership.

Upload it

Select Choose CSV… and pick your file. The page reads it straight away and checks each account (see Step 3). Nothing is changed until you select Update.

Columns the page doesn't recognize are ignored, and listed above the preview so you can check nothing you meant to update was skipped. To use a different file, select Remove next to the file name.

Step 2: Options

Match accounts by

Choose the column that identifies which account each row is about:

Matching on Email or Employee ID is useful for HR exports, which usually don't contain logon names.

If the file doesn't have the column you chose but does have one of the others, the page switches to that one for you. The match column's value is only used to find the account and is never written.

Also change

These apply to every row in the file, on top of what the file's columns change. Each one defaults to Do not change.

For example, to disable every account in a list of leavers, upload a file with just a Logon Name (sAMAccountName) column and set Account status to Disable.

Step 3: Review the changes

As soon as the file is loaded, the page looks up every account and compares the file with what is in Active Directory. Nothing is written yet.

The table has one line for each value the file sets on each account, grouped by user:

Lines marked No change and Not found are not written. The rest of the account's lines still are.

Other things the table can show:

• No account matched "...": no account in the domain has that value in the match column.
• No value in the match column: the row's match cell is empty.
• No new value set: every cell in that row is blank, so the account is skipped.

The line above the table sums it up, for example "250 rows · matching on logon name · 37 accounts to change (52 changes) · 210 already up to date · 3 not found".

Changing an Also change option updates the preview straight away. Changing Match accounts by checks every account again.

Step 4: Update

1. Select Update N accounts. Only accounts with changes are updated, and only the changes in the preview are written.
2. The Status of each line changes as its account is processed, to Updated or Failed. When something fails, the reason Active Directory gave, such as a permission error, appears in red under the user's name. Hover over Failed to see it for that line.
3. A summary next to the button shows how many accounts were updated, failed, partly updated, or were already up to date.

A failed account doesn't stop the run. For each account, the attributes are written first, then the group changes, then the move to a new OU. Each part is tried on its own, so a group the service account can't change doesn't stop the job title being written.

After the run, select Check again to look up every account again. The preview then shows anything that still differs, such as the rows that failed. Fix the cause and update again.

Each account is looked up and updated directly on a domain controller, so accounts created since AD Pro Toolkit last synced the directory are found too. Reports show the changes after the next sync.

Groups, OUs, managers and clearing values

Member Of

Lists groups to add the user to, separated by semicolons, for example Sales;All Staff. Each group can be its name, its pre-Windows 2000 name, or its distinguished name. If the cell uses distinguished names, separate them with semicolons only, since a distinguished name contains commas. Otherwise a comma works too.

• Groups are only added. The user stays in any groups they are already in. A group they are already in is left out of the preview.
• {clear} removes the user from all of their groups, except their primary group (usually Domain Users), which Active Directory requires.
• A group that can't be found shows as a warning, and the other groups are still added.

To remove users from specific groups, use Tools > Users > Bulk group membership.

OU

The distinguished name of the OU to move the account to, for example OU=Sales,OU=Staff,DC=contoso,DC=com. Accounts already in that OU are left out of the preview. {clear} doesn't apply to the OU, because an account always has to be in one.

Manager

The manager's logon name, UPN or distinguished name. If no account matches, the manager isn't changed and the row shows a warning. {clear} removes the manager.

Clearing values

Put {clear} or {remove} in any cell to clear that value: an attribute, the manager, the proxy addresses, an extension attribute or the groups. Accounts where the value is already empty are left out of the preview.

Supported columns

The Password column from Bulk create files is ignored. Bulk update doesn't set passwords.