Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My goal is to copy an existing user, including OU placement in the AD tree.

So far i have this:

$SName = Read-Host "Please Enter the login initials of the source user "
$U = Get-ADUser -Identity $SName -Properties streetaddress,homepage,POBox,postalcode,city,country,company,department,office,fax
$FirstName = read-host -Prompt "Enter first name of new user: "
$LastName = read-host -Prompt "Enter last name of new user: "
$DisplayName = "$Firstname $LastName"
$DName = Read-Host "Please Enter logon initials of the new user "
$UPN = $DName+""
$TempPassword = read-host -AsSecureString -Prompt "Enter temporary password (min. 8 characters)"
$Path = Get-User -Identity $SName|Select "OrganizationalUnit"
New-ADUser -Instance $u -Name $DisplayName -SamAccountName $DName -Path $Path -UserPrincipalName $UPN -DisplayName $DisplayName -givenname $FirstName -surname $LastName -AccountPassword $TempPassword -ChangePasswordAtLogon $True

As you may notice, i am trying to use the Get-User selecting the OrganizationalUnit, but it gives me the error: No superior reference has been configured for the directory service. The directory service is therefore unable to issue referrals to objects outside this forest.

Any suggestions how to copy the OU placement, or could it be that it is simply not possible to copy this user property?

share|improve this question

The organizational unit (or container) an object resides in is not a property of the object, so you can't easily read it; but you can retrieve by parsing the object's distinguished name (splitting it at the first comma):

$DN = $U.DistinguishedName
$Path = $DN.Substring($dn.IndexOf(',') + 1)
New-ADUser [...] -Path $Path

The Get-User cmdlet is not an Active Directory one, it's from the Exchange Management Shell; its OrganizationalUnit property is not a valid LDAP path, so it can't be used in a New-ADUser command.

If the DN of the object is CN=User Name,OU=SomeOU,DC=domain,DC=com, my code would return OU=SomeOU,DC=domain,DC=com (which is the actual LDAP path of the OU), while Get-User.OrganizationalUnit would return, a completely different thing.

share|improve this answer
Thank you very much, Massimo. Works just as i wanted. – Jens Svendsen Sep 20 '12 at 14:13
Glad to be of help... if the answer is helpful, please upvote and accept it :-) – Massimo Sep 20 '12 at 14:22

Copy user, then move from the default OU the copy is created in to the desired one. Simple as that. Like Massimo pointed out, the OU/container an object is in is not part of the object.

If you think of this like a file operation, you'll probably be better off. The user would be like a file, and the OU or a container would be like a folder - you don't add the folder into the file, you copy the file into the location you want it to reside at. Same thing with AD, but in a Windows domain, there's a default container/OU for all object types, where new objects of that type are automatically created.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.