Copy a user's organizational unit to a new user

Question

My goal is to copy an existing user, including OU placement in the AD tree.

So far i have this:

$SName = Read-Host "Please Enter the login initials of the source user "
$U = Get-ADUser -Identity $SName -Properties streetaddress,homepage,POBox,postalcode,city,country,company,department,office,fax
$FirstName = read-host -Prompt "Enter first name of new user: "
$LastName = read-host -Prompt "Enter last name of new user: "
$DisplayName = "$Firstname $LastName"
$DName = Read-Host "Please Enter logon initials of the new user "
$UPN = $DName+"@scangl.com"
$TempPassword = read-host -AsSecureString -Prompt "Enter temporary password (min. 8 characters)"
$Path = Get-User -Identity $SName|Select "OrganizationalUnit"
New-ADUser -Instance $u -Name $DisplayName -SamAccountName $DName -Path $Path -UserPrincipalName $UPN -DisplayName $DisplayName -givenname $FirstName -surname $LastName -AccountPassword $TempPassword -ChangePasswordAtLogon $True

As you may notice, i am trying to use the Get-User selecting the OrganizationalUnit, but it gives me the error: No superior reference has been configured for the directory service. The directory service is therefore unable to issue referrals to objects outside this forest.

Any suggestions how to copy the OU placement, or could it be that it is simply not possible to copy this user property?

Answer 1

The organizational unit (or container) an object resides in is not a property of the object, so you can't easily read it; but you can retrieve by parsing the object's distinguished name (splitting it at the first comma):

$DN = $U.DistinguishedName
$Path = $DN.Substring($dn.IndexOf(',') + 1)
New-ADUser [...] -Path $Path

---

The Get-User cmdlet is not an Active Directory one, it's from the Exchange Management Shell; its OrganizationalUnit property is not a valid LDAP path, so it can't be used in a New-ADUser command.

If the DN of the object is CN=User Name,OU=SomeOU,DC=domain,DC=com, my code would return OU=SomeOU,DC=domain,DC=com (which is the actual LDAP path of the OU), while Get-User.OrganizationalUnit would return domain.com/SomeOU, a completely different thing.

Answer 2

Copy user, then move from the default OU the copy is created in to the desired one. Simple as that. Like Massimo pointed out, the OU/container an object is in is not part of the object.

If you think of this like a file operation, you'll probably be better off. The user would be like a file, and the OU or a container would be like a folder - you don't add the folder into the file, you copy the file into the location you want it to reside at. Same thing with AD, but in a Windows domain, there's a default container/OU for all object types, where new objects of that type are automatically created.