New-ADUser and Set-ADUser in PowerShell - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the output of this New-ADUser command?

You run this PowerShell command to create a new Active Directory user:

New-ADUser -Name "John Doe" -GivenName "John" -Surname "Doe" -SamAccountName "jdoe" -AccountPassword (ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force) -Enabled $true -PassThru

What does the command output?

PowerShell

New-ADUser -Name "John Doe" -GivenName "John" -Surname "Doe" -SamAccountName "jdoe" -AccountPassword (ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force) -Enabled $true -PassThru

A An error message about missing required parameters

B No output is shown because New-ADUser does not return anything by default

C A confirmation message: "User John Doe created successfully"

D An object representing the newly created user with properties like Name, SamAccountName, and DistinguishedName

💡 Hint

The -PassThru parameter makes the command output the created user object.

By default, New-ADUser does not output anything. Using -PassThru returns the user object created, showing details like Name and SamAccountName.

💻 Command Output

intermediate

What happens when you run this Set-ADUser command?

You want to update the title of an existing user with SamAccountName 'jdoe'. You run:

Set-ADUser -Identity jdoe -Title "Senior Developer"

What is the output of this command?

PowerShell

Set-ADUser -Identity jdoe -Title "Senior Developer"

A No output is shown; the user's Title attribute is updated silently

B The updated user object is returned showing the new Title

C An error saying the Title parameter is invalid

D A confirmation message: "User jdoe updated successfully"

💡 Hint

Set-ADUser updates attributes silently unless you request output.

Set-ADUser does not output anything by default. It updates the user attribute silently.

📝 Syntax

advanced

Which option correctly creates a new AD user with a secure password?

You want to create a new AD user with username 'asmith' and password 'Secret123!'. Which command is syntactically correct?

A New-ADUser -Name "Alice Smith" -SamAccountName "asmith" -AccountPassword ConvertTo-SecureString "Secret123!" -AsPlainText -Force -Enabled $true

B New-ADUser -Name "Alice Smith" -SamAccountName "asmith" -AccountPassword (ConvertTo-SecureString "Secret123!" -AsPlainText -Force) -Enabled $true

C New-ADUser -Name "Alice Smith" -SamAccountName "asmith" -AccountPassword "Secret123!" -Enabled $true

D New-ADUser -Name "Alice Smith" -SamAccountName "asmith" -AccountPassword ConvertTo-SecureString("Secret123!", -AsPlainText, -Force) -Enabled $true

💡 Hint

AccountPassword expects a secure string, so use parentheses to convert the plain text password.

Option B correctly uses parentheses to convert the plain text password to a secure string. Option B misses parentheses, causing a syntax error. Option B passes a plain string, which is invalid. Option B uses incorrect syntax for the ConvertTo-SecureString cmdlet.

🚀 Application

advanced

How to change multiple attributes of an AD user in one command?

You want to update the user 'jdoe' to have Title 'Manager' and Office 'HQ-101'. Which command achieves this?

A Set-ADUser -Identity jdoe -Title "Manager" -Office "HQ-101"

B Set-ADUser -Identity jdoe -Title "Manager"; Set-ADUser -Identity jdoe -Office "HQ-101"

C Set-ADUser -Identity jdoe -Replace @{Title="Manager"; Office="HQ-101"}

D Set-ADUser -Identity jdoe -Add @{Title="Manager"; Office="HQ-101"}

💡 Hint

Set-ADUser supports multiple attribute parameters directly.

Option A correctly updates multiple attributes in one command. Option A works but uses two commands, not one. Option A uses -Replace which is valid but less straightforward here. Option A uses -Add which is for multi-valued attributes and will cause an error for single-valued attributes.

🔧 Debug

expert

Why does this New-ADUser command fail with an error?

You run:

New-ADUser -Name "Bob Lee" -SamAccountName "blee" -AccountPassword (ConvertTo-SecureString "Pass123" -AsPlainText) -Enabled $true

and get an error about missing parameters. What is the cause?

PowerShell

New-ADUser -Name "Bob Lee" -SamAccountName "blee" -AccountPassword (ConvertTo-SecureString "Pass123" -AsPlainText) -Enabled $true

A The SamAccountName must be the same as the Name parameter

B The -Enabled parameter cannot be used with New-ADUser

C The ConvertTo-SecureString command is missing the -Force parameter, causing an error

D The AccountPassword parameter must be a plain string, not a secure string

💡 Hint

ConvertTo-SecureString requires -Force when using -AsPlainText.

Without the -Force flag, ConvertTo-SecureString with -AsPlainText throws an error. This causes New-ADUser to fail because the password is not properly converted.

Practice

1. What is the primary purpose of the New-ADUser cmdlet in PowerShell?

easy

A. To list all users in Active Directory

B. To delete an existing user account

C. To reset a user's password

D. To create a new user account in Active Directory

Solution

1. Step 1: Understand the cmdlet purpose

   New-ADUser is designed to create new user accounts in Active Directory.

2. Step 2: Compare with other options

   Deleting users, resetting passwords, or listing users are done by other cmdlets like Remove-ADUser, Set-ADAccountPassword, or Get-ADUser.

3. Final Answer:

   To create a new user account in Active Directory -> Option D

4. Quick Check:

   New-ADUser creates users = A [OK]

Hint: New-ADUser always creates, not modifies or deletes [OK]

Common Mistakes:

• Confusing New-ADUser with Set-ADUser
• Thinking it deletes users
• Assuming it lists users

2. Which of the following is the correct syntax to create a new AD user with username 'jdoe' and display name 'John Doe' using New-ADUser?

easy

A. New-ADUser -SamAccountName 'jdoe' -DisplayName 'John Doe'

B. New-ADUser -Name 'jdoe' -DisplayName 'John Doe'

C. New-ADUser -UserName 'jdoe' -Display 'John Doe'

D. New-ADUser -User 'jdoe' -Name 'John Doe'

Solution

1. Step 1: Identify correct parameters for New-ADUser

   The parameter for username is -SamAccountName, and for display name is -DisplayName.

2. Step 2: Check each option

   New-ADUser -SamAccountName 'jdoe' -DisplayName 'John Doe' uses -SamAccountName 'jdoe' and -DisplayName 'John Doe', which is correct syntax.

3. Final Answer:

   New-ADUser -SamAccountName 'jdoe' -DisplayName 'John Doe' -> Option A

4. Quick Check:

   SamAccountName sets username = A [OK]

Hint: Use -SamAccountName for username in New-ADUser [OK]

Common Mistakes:

• Using -UserName instead of -SamAccountName
• Using -Name instead of -DisplayName
• Mixing parameter names incorrectly

3. What will be the output of this PowerShell command sequence?

New-ADUser -SamAccountName 'asmith' -Name 'Alice Smith' -AccountPassword (ConvertTo-SecureString 'P@ssw0rd' -AsPlainText -Force) -Enabled $true
Set-ADUser -Identity 'asmith' -Title 'Manager'

What is the Title property of user 'asmith' after running these commands?

medium

A. No Title property set

B. Manager

C. Alice Smith

D. P@ssw0rd

Solution

1. Step 1: Create user with New-ADUser

   The user 'asmith' is created with name 'Alice Smith' and password set, enabled account.

2. Step 2: Update user with Set-ADUser

   The Set-ADUser command sets the Title property to 'Manager' for user 'asmith'.

3. Final Answer:

   Manager -> Option B

4. Quick Check:

   Set-ADUser updates Title = C [OK]

Hint: Set-ADUser changes properties after user creation [OK]

Common Mistakes:

• Assuming Title is set by New-ADUser without parameter
• Confusing password with Title property
• Thinking Title remains empty

4. You run this command to update a user's department:

Set-ADUser -Identity 'bwhite' -Department 'Sales'

But you get an error: "Cannot find an object with identity: 'bwhite'". What is the most likely cause?

medium

A. The Identity parameter requires an email address

B. The Department property cannot be set with Set-ADUser

C. User 'bwhite' does not exist in Active Directory

D. You must use New-ADUser to update users

Solution

1. Step 1: Analyze the error message

   The error says it cannot find an object with identity 'bwhite', meaning the user does not exist or the name is incorrect.

2. Step 2: Check other options

   Department can be set with Set-ADUser, New-ADUser is for creating users, and Identity accepts username or distinguished name, not necessarily email.

3. Final Answer:

   User 'bwhite' does not exist in Active Directory -> Option C

4. Quick Check:

   Identity error means user missing = D [OK]

Hint: Check user exists before Set-ADUser [OK]

Common Mistakes:

• Assuming Department can't be set
• Using New-ADUser to update existing users
• Using wrong Identity format without verifying user

5. You want to create a new user 'mjohnson' with the display name 'Mary Johnson' and then immediately set her office location to 'HQ-5'. Which sequence of commands correctly achieves this?

hard

A. New-ADUser -SamAccountName 'mjohnson' -DisplayName 'Mary Johnson'
Set-ADUser -Identity 'mjohnson' -Office 'HQ-5'

B. Set-ADUser -SamAccountName 'mjohnson' -DisplayName 'Mary Johnson'
New-ADUser -Identity 'mjohnson' -Office 'HQ-5'

C. New-ADUser -UserName 'mjohnson' -Name 'Mary Johnson' -Office 'HQ-5' -Enabled $true

D. New-ADUser -SamAccountName 'mjohnson' -DisplayName 'Mary Johnson' -Office 'HQ-5' -Enabled $true

Solution

1. Step 1: Create user with New-ADUser

   Use -SamAccountName and -DisplayName to create the user. Office location is not set here.

2. Step 2: Update office location with Set-ADUser

   Use Set-ADUser -Identity 'mjohnson' -Office 'HQ-5' to set the office property after creation.

3. Step 3: Evaluate other options

   Set-ADUser -SamAccountName 'mjohnson' -DisplayName 'Mary Johnson' New-ADUser -Identity 'mjohnson' -Office 'HQ-5' tries to update before creation, which fails. New-ADUser -UserName 'mjohnson' -Name 'Mary Johnson' -Office 'HQ-5' -Enabled $true uses wrong parameters. New-ADUser -SamAccountName 'mjohnson' -DisplayName 'Mary Johnson' -Office 'HQ-5' -Enabled $true fails because -Enabled $true requires -AccountPassword (e.g., (ConvertTo-SecureString 'P@ssw0rd' -AsPlainText -Force)), which is missing.

4. Final Answer:

   New-ADUser -SamAccountName 'mjohnson' -DisplayName 'Mary Johnson' Set-ADUser -Identity 'mjohnson' -Office 'HQ-5' -> Option A

5. Quick Check:

   Create then update properties = B [OK]

Hint: Create user first, then update extra properties with Set-ADUser [OK]

Common Mistakes:

• Trying to set unsupported properties in New-ADUser
• Running Set-ADUser before user exists
• Using wrong parameter names