Active Directory user accounts have a special thumbnailPhoto attribute in which a user’s photo can be stored as binary data. Outlook, OWA, Lync/Skype for Business, SharePoint (and other apps) can use the photo stored in this AD attribute as the user’s avatar in their interface. In addition, these photos can be used as Windows user account picture.

In this article, we will show you how to add (upload) a user’s photo to Active Directory using PowerShell, OWA or the Active Directory Users and Computers snap-in, as well as how to save (export) the thumbnailPhoto attribute value to a jpeg file.

ThumbnailPhoto Attribute in Active Directory

The main aspects and restrictions of using user photos in AD:

• The maximum photo size in the thumbnailPhoto attribute of the user object is 100 KB. However, there is a general recommendation to use a graphic JPEG/BMP file format up to 10 KB and 96×96 pixels in size as user’s photo in AD;
• To display a photo in Outlook 2010 or newer, at least a version of the Windows Server 2008 Active Directory schema is required;
• If there are a lot of user photos in Active Directory, the replication traffic between domain controllers increases due to the growth of the NTDS.DIT file (AD database);
• Users can change their own photo in AD. If you need to delegate the ability to upload photos to other users (e. g., HR department), you need to use the AD delegation wizard to grant the group the “Write thumbnailPhoto” permission to the OU with user accounts.

How to Add/Update a User Photo in AD Using PowerShell?

To add (upload) a user photo to Active Directory using PowerShell, you need to use the Active Directory Module for Windows PowerShell (which is part of the RSAT administration tools). First, you need to convert the image file to a byte array, and then use the Set-ADUser cmdlet to set it as the value of the thumbnailPhoto attribute.

Import-Module ActiveDirectory
$photo = [byte[]](Get-Content C:\PS\jkuznetsov_photo.jpg -Encoding byte)
Set-ADUser jkuznetsov -Replace @{thumbnailPhoto=$photo}

The same thing in PowerShell one-liner:

Set-ADUser jkuznetsov -Replace @{thumbnailPhoto=([byte[]](Get-Content "C:\ps\jkuznetsov_photo.jpg" -Encoding byte))}

After these commands have been executed, the user photo stored in Active Directory database will be displayed in Outlook, Lync/Skype, OWA, etc. (it may take some time till the end of AD replication and GAL update).

You can open the user’s properties in the Active Directory Users and Computers (ADUC) console, go to the Attribute Editor tab, and make sure the thumbnailPhoto attribute now contains a value.

User Photos Management in Exchange and Outlook Web Access

Exchange Management Shell supports the same feature of importing AD user photos. To do it, you can use Import-RecipientDataProperty cmdlet.

The EMS command to update a photo of the user jkuznetsov will look like this:

Import-RecipientDataProperty -Identity “jkuznetsov” -Picture -FileData ([Byte[]] $(Get-Content -Path “C:\PS\jkuznetsov_photo.jpg” -Encoding Byte -ReadCount 0))

EMS in Exchange 2013/2016 uses another cmdlet to manage user photos – Set-UserPhoto. The following commands are used to add a user’s photo in these versions of Exchange:

Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn
$usrphotofile = ([Byte[]] $(Get-Content -Path "C:\PS\jkuznetsov_photo.jpg" -Encoding Byte -ReadCount 0))
Set-UserPhoto -Identity jkuznetsov -PictureData $usrphotofile -Confirm:$False
Set-UserPhoto -Identity jkuznetsov -Save -Confirm:$False

Users can also change their profile photo themselves through Outlook Web Access (OWA). Click on your account in the upper right corner, select Edit information -> photo -> click the change button and specify the path to the jpeg file with the user photo.

How to Import User Photos to AD in Bulk with PowerShell?

You can bulk upload and manage users’ photos to Active Directory with PowerShell. Create a CSV file that contains a list of user accounts and the corresponding photo filenames. You can use the coma-separeted format of the import.csv file:

AD_username, Photo
asmith, C:\PS\asmith.jpg
klinton@adatum.com, C:\PS\klinton.jpg
jkuznetsov, C:\PS\jkuznetsov.png

The following PowerShell one-liner command will get the list of users from a CSV file and update (upload) their photos to Active Directory:

Import-Csv C:\PS\import.csv |%{Set-ADUser -Identity $_.AD_username -Replace @{thumbnailPhoto=([byte[]](Get-Content $_.Photo -Encoding byte))}}

How to Export a User Photo from Active Directory to a JPG File?

You can save an AD user photo to a graphic file. To do it, select the user using the Get-ADUser cmdlet:
$ADuser = Get-ADUser jkuznetsov-Properties thumbnailPhoto

And save the contents of thumbnailPhoto attribute to a JPG file:

$ADuser.thumbnailPhoto | Set-Content c:\PS\jkuznetsov.jpg -Encoding byte