During the deployment of a system that supports LDAP synchronization, I noticed that many users were successfully synced but had no email address associated with their accounts.

After checking Active Directory, I found that the issue wasn’t with the LDAP configuration at all. Instead, many user objects simply had an empty mail attribute.

This turned out to be a historical issue. Over the years, AD accounts had been created manually by different IT staff members. Since neither Windows logon nor Exchange depends on the mail attribute, users could work normally even if it was left blank, so the missing values went unnoticed for a long time.

Fortunately, our organization follows a consistent email naming convention, for example:

1
<sAMAccountName>@yourdomain.com

With a predictable naming convention, it’s easy to populate the missing mail attributes automatically using PowerShell.

1
# Load Active Directory module if not already loaded
2
Import-Module ActiveDirectory
3

4
# Define the group name
5
$groupName = "changeme"
6

7
# Process users and update missing emails
8
Get-ADGroupMember -Identity $groupName -Recursive |
9
    Where-Object { $_.objectClass -eq 'user' } |
10
    ForEach-Object {
11
        $user = Get-ADUser -Identity $_ -Properties mail
12

13
        if (-not $user.mail) {
14
            $email = "$($user.SamAccountName)@yourdomain.com"
15
            Set-ADUser -Identity $user.SamAccountName -EmailAddress $email
16
            Write-Host "Set email for $($user.SamAccountName): $email" -ForegroundColor Green
17
        }
18
        else {
19
            Write-Host "Email already set for $($user.SamAccountName): $($user.mail)" -ForegroundColor Yellow
20
        }
21
    }