---
title: "Set-VBRADContainer"
description: "Modifies a scope of Active Directory objects. Product Edition: Community, Standard, Enterprise, Enterprise Plus, Veeam Universal License This cmdlet modifies the VBRADContainer object."
canonical: "https://helpcenter.veeam.com/docs/vbr/powershell/set-vbradcontainer.html"
breadcrumb: "Veeam PowerShell Reference > Veeam PowerShell Reference > Veeam Agent Management > Working with Protection Groups > Veeam Agent Management Protection Scope > Set-VBRADContainer"
dateModified: "2026-08-19"
---

# Set-VBRADContainer

## Short Description
Modifies a scope of Active Directory objects.

**Product Edition**: Community, Standard, Enterprise, Enterprise Plus, Veeam Universal License

## Syntax
```
Set-VBRADContainer -Container <VBRADContainer> [-Domain <VBRADDomain>] [-Entity <VBRADEntity[]>] [-ExcludeVMs]
 [-ExcludeOfflineComputers] [-ExcludeComputers] [-ExcludedEntity <VBRADEntity[]>]
 [-MasterCredentials <CCredentials>] [-UseTemporaryCertificate] [-UseCustomCredentials]
 [-CustomCredentials <VBRADCustomCredentials[]>] [<CommonParameters>]
```

## Detailed Description
This cmdlet modifies the [`VBRADContainer`](vbradcontainer.md) object. This object contains a scope of Active Directory objects you want to add to a protection group.

::: note

To modify settings, specify new values for the necessary parameters. The cmdlet will overwrite the previous parameter values with new values. The parameters that you omit will remain unchanged.

:::

## Parameters

<table style="width:100%;" class="Blue_Table">
      <tr style="vertical-align:top">
        <th style="width:20%;">
          <p>Parameter</p>
        </th>
        <th style="width:20%;">
          <p>Description</p>
        </th>
        <th style="width:20%;">
          <p>Type</p>
        </th>
        <th style="width:10%;">
          <p>Required</p>
        </th>
        <th style="width:10%;">
          <p>Position</p>
        </th>
        <th style="width:10%;">
          <p>Accept Pipeline Input</p>
        </th>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">Container</span></p>
        </td>
        <td>
          <p>Specifies the scope of Active Directory objects you want to add to a protection group.</p><p>Accepts the <a href="vbradcontainer.md"><code>VBRADContainer</code></a> object. To get this object, use the <code>Container</code> parameter of the <a href="get-vbrprotectiongroup.md"><code>Get-VBRProtectionGroup</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><a href="vbradcontainer.md"><code>VBRADContainer</code></a></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName, ByValue)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">CustomCredentials</span></p>
        </td>
        <td>
          <p>Specifies custom credentials for authenticating with associated Active Directory objects.</p><p>Accepts the <a href="vbradcustomcredentials.md"><code>VBRADCustomCredentials</code></a><code>[]</code> object. To create this object, run the <a href="new-vbradcustomcredentials.md"><code>New-VBRADCustomCredentials</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><a href="vbradcustomcredentials.md"><code>VBRADCustomCredentials[]</code></a></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">Domain</span></p>
        </td>
        <td>
          <p>Specifies the Active Directory domain connection object.</p><p>Accepts the <a href="vbraddomain.md"><code>VBRADDomain</code></a> object. To get this object, run the <a href="get-vbraddomain.md"><code>Get-VBRADDomain</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><a href="vbraddomain.md"><code>VBRADDomain</code></a></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">Entity</span></p>
        </td>
        <td>
          <p>Specifies the array of the Active Directory objects from the same domain. The cmdlet will add these objects to the protection scope.</p><p>You can add the following types of Active Directory objects:</p><ul><li>Domain</li><li>Cluster</li><li>Organization unit</li><li>Global group</li><li>Folder</li><li>Computer</li></ul><p><strong>Note</strong>: You cannot add Domain Local or Universal groups.</p><p>Accepts the <a href="vbradentity.md"><code>VBRADEntity</code></a><code>[]</code> object. To get this object, run the<a href="find-vbradentity.md"><code> Find-VBRADEntity</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><a href="vbradentity.md"><code>VBRADEntity[]</code></a></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">ExcludeComputers</span></p>
        </td>
        <td>
          <p>Defines that you want to exclude some Active Directory objects from the protection scope.</p><p>Use the <code>ExcludeEntity</code> parameter to specify objects you want to exclude from the protection scope.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">ExcludedEntity</span></p>
        </td>
        <td>
          <p>Specifies Active Directory objects you want to exclude from the protection scope.</p><p><strong>Note</strong>: You cannot exclude Domain Local or Universal groups.</p><p>Accepts the <a href="vbradentity.md"><code>VBRADEntity</code></a><code>[]</code> object. To get this object, run the<a href="find-vbradentity.md"><code> Find-VBRADEntity</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><a href="vbradentity.md"><code>VBRADEntity[]</code></a></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">ExcludeOfflineComputers</span></p>
        </td>
        <td>
          <p>Defines that the cmdlet will exclude computers that have been offline for over 30 days.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">ExcludeVMs</span></p>
        </td>
        <td>
          <p>Defines that the cmdlet will exclude all VMs from the protection scope.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">MasterCredentials</span></p>
        </td>
        <td>
          <p>Specifies Master account credentials for authenticating with all Active Directory objects in a protection scope.</p><p>For authenticating with Active Directory objects that require different credentials, Veeam Backup & Replication uses custom credentials. If you want to use custom credentials for some Active Directory objects, set the <code>UseCustomCredentials</code> parameter.</p>
        </td>
        <td style="width:10%;">
          <p><code>CCredentials</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">UseCustomCredentials</span></p>
        </td>
        <td>
          <p>Defines that you want to use custom credentials for authenticating with some Active Directory objects.</p><p>To specify custom credentials, use the <code>CustomCredentials</code> parameter.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">UseTemporaryCertificate</span></p>
        </td>
        <td>
          <p>Defines that the cmdlet will use a temporary certificate to connect to the Active Directory objects instead of authenticating with credentials.</p><p><strong>Note</strong>: You cannot use this parameter together with the <code>MasterCredentials</code> parameter.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName)</p>
        </td>
      </tr>
    </table>

`<CommonParameters>`

This cmdlet supports Microsoft PowerShell common parameters. For more information on common parameters, see [ Microsoft Docs](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_commonparameters?view=powershell-7).

## Output Object
[`VBRADContainer`](vbradcontainer.md)

## Examples

::: example
### Example 1. Excluding VMs from Protection Group

This example shows how to exclude VMs from the existing protection group.

```
$group = Get-VBRProtectionGroup -Name "Support PG"
$ad = $group.Container
$newad = Set-VBRADContainer -Container $ad -ExcludeVMs
Set-VBRProtectionGroup -ProtectionGroup $group -Container $newad
```

Perform the following steps:

1. Run the [`Get-VBRProtectionGroup`](get-vbrprotectiongroup.md) cmdlet. Specify the `Name` parameter value. Save the result to the `$group` variable.
2. Get the scope of Active Directory objects. Use the `Container` property of the `$group` variable. Save the result to the `$ad` variable.
3. Run the `Set-VBRADContainer` cmdlet. Set the `$ad` variable as the `Container` parameter value. Provide the `ExcludeVMs` parameter. Save the result to the `$newad` variable.
4. Run the [`Set-VBRProtectionGroup`](set-vbrprotectiongroup.md) cmdlet. Set the `$group` variable as the `ProtectionGroup` parameter value. Set the `$newad` variable as the `Container` parameter value.

:::

::: example
### Example 2. Configuring Protection Group to Use Temporary Certificate

This example shows how to modify a scope of Active Directory objects so that Veeam Backup & Replication uses a temporary certificate to connect to the objects instead of authenticating with credentials.

```
$group = Get-VBRProtectionGroup -Name "Support PG"
$ad = $group.Container
$newad = Set-VBRADContainer -Container $ad -UseTemporaryCertificate
Set-VBRProtectionGroup -ProtectionGroup $group -Container $newad
```

Perform the following steps:

1. Run the [`Get-VBRProtectionGroup`](get-vbrprotectiongroup.md) cmdlet. Specify the `Name` parameter value. Save the result to the `$group` variable.
2. Get the scope of Active Directory objects. Use the `Container` property of the `$group` variable. Save the result to the `$ad` variable.
3. Run the `Set-VBRADContainer` cmdlet. Set the `$ad` variable as the `Container` parameter value. Provide the `UseTemporaryCertificate` parameter. Save the result to the `$newad` variable.
4. Run the [`Set-VBRProtectionGroup`](set-vbrprotectiongroup.md) cmdlet. Set the `$group` variable as the `ProtectionGroup` parameter value. Set the `$newad` variable as the `Container` parameter value.

:::

## Related Commands

- [`Get-VBRProtectionGroup`](get-vbrprotectiongroup.md)
- [`Set-VBRProtectionGroup`](set-vbrprotectiongroup.md)