Automated Active Directory User Creation

I have been working on this for quite a while due to our domain restraints. I’ve added in some error checking in order to help things move along smoothly for our Help Desk people.

This script will pull information from whatever .CSV file you tell it to and filter the information line by line. You can setup your .CSV accordingly or change the variables to match your own, your choice. There may be certain variables you don’t need whatsoever, you should be able to remove them as needed. The script WILL add all proper Group Memberships from your selected template too!

This first script iteration will allow manual selection of user template to use. Due to having multiple subcontractors on a single domain, I needed this to be a manual option for each user that may be working for a separate employer, or even for those who work for a certain department; requiring standard access to department specific Network Shares, etc. (Second iteration below is completely automated). It also allows for manual SAM account name entry. This was also another requirement for me due to our account names being generated by some random program during HR processing. It also includes an error-check during this portion to throw a warning message if that SAM account name already exists and requires you to enter a new one until you find an open one. It will also set the Manager portion based on their Supervisor’s Email address (includes a check and warning message if the email address has no association to any user account in AD; maybe someone fat fingered it or forgot to add it before?).

The $params array can be modified to include any property you wish to assign a value. Currently, I just use the pre-assigned values in my selected template for things such as StreetAddress, State, PostalCode, etc. You’ll find those values under $AddressPropertyNames :

 <# .SYNOPSIS Creates a new active directory user from a template. Purpose of script to assist Help Desk with the creation of End-User accounts in Active Directory. #> #Script requires ActiveDirectory Module to be loaded Import-Module ActiveDirectory #Import all User information from CSV generated from ConvertSAAR program $Users = Import-Csv -Path "C:FooNewEmployees.csv" #Filter each line of Output.csv individually ForEach ($User in $Users) { #User account information variables $Displayname = $( If($User.MiddleIn -EQ $Null){ $User.LastName + ", " + $User.FirstName } ElseIf(!($User.MiddleIn -EQ $Null)){ $User.LastName + ", " + $User.FirstName + " " + $User.MiddleIn }) $UserFirstname = $User.FirstName $UserInitial = $User.MiddleIn $UserLastname = $User.LastName $SupervisorEmail = $User.SupervisorEmail $UserCompany = $User.Company $UserDepartment = $User.Department $UserJobTitle = $User.JobTitle $OfficePhone = $User.Phone $Description = $( If($User.Citizenship -eq 2){ "Domain User (Canada)" } ElseIf($User.Citizenship -eq 3){ "Domain User (United Kingdom)" } Else{ "Domain User (United States)" }) $Email = $User.Email $Info = $( $Date = Get-Date "Account Created: " + $Date.ToShortDateString() + " " + $Date.ToShortTimeString() + " - " + [Environment]::UserName ) #Get Supervisors SAM Account Name based on email address supplied in .csv $FindSuperV = Get-ADUser -Filter * -Properties EmailAddress $FindSuperV = $FindSuperV | ? { ($_.EmailAddress | Out-String) -Like "*" + $User.SupervisorEmail + "*"} $FindSuperV = $FindSuperV | select -First "1" -ExpandProperty SamAccountName $Password = 'B@dP@S$wORD234' #Prompt header and message display $Caption = "Choose Employer Template"; $Message = "Please Select The Proper User Template for $Displayname"; $Caption2 = "Are you sure?" $Message2 = "You have selected $Template for $Displayname :" #Prompt options for user templates $Template1 = New-Object System.Management.Automation.Host.ChoiceDescription "&Template1","Template1"; $Template2 = New-Object System.Management.Automation.Host.ChoiceDescription "&Template2","Template2"; $Template3 = New-Object System.Management.Automation.Host.ChoiceDescription "&Template3","Template3"; $Template4 = New-Object System.Management.Automation.Host.ChoiceDescription "&Template4","Template4"; $Template5 = New-Object System.Management.Automation.Host.ChoiceDescription "&Template5","Template5"; $Template6 = New-Object System.Management.Automation.Host.ChoiceDescription "&Template6","Template6"; $Template7 = New-Object System.Management.Automation.Host.ChoiceDescription "&Template7","Template7"; $Template8 = New-Object System.Management.Automation.Host.ChoiceDescription "&Template8","Template8"; $Yes = New-Object System.Management.Automation.Host.ChoiceDescription "&Yes","Yes"; $No = New-Object System.Management.Automation.Host.ChoiceDescription "&No","No"; #Array of choices $Choices = ([System.Management.Automation.Host.ChoiceDescription[]]( $Template1,$Template2,$Template3,$Template4,$Template5,$Template6,$Template7,$Template8)); $Choices2 = ([System.Management.Automation.Host.ChoiceDescription[]]( $Yes,$No)); #Display template choices while($true) { $Answer = $host.ui.PromptForChoice($Caption,$Message,$Choices,5); #Set $Answer variable based on user selection switch ($Answer) { #Values are SAM names of Templates 0 { $Template = ("Template1SAM"); $Answer2 } 1 { $Template = ("Template2SAM"); $Answer2 } 2 { $Template = ("Template3SAM"); $Answer2 } 3 { $Template = ("Template4SAM"); $Answer2 } 4 { $Template = ("Template5SAM"); $Answer2 } 5 { $Template = ("Template6SAM"); $Answer2 } 6 { $Template = ("Template7SAM"); $Answer2 } 7 { $Template = ("Template8SAM"); $Answer2 } }#Switch #Confirm selected choice $Message2 = "You have selected $Template for $Displayname :" $Answer2 = $host.ui.PromptForChoice($Caption2,$Message2,$Choices2,1); #Loop back to $Answer, if No; continue, if Yes if($Answer2 -eq 0) { break; }#If }#While #Load Visual Basic .NET Framework [System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic') | Out-Null #Do{ process } Until( ) Do{ #Continue if $True While($True) { $SAM = [Microsoft.VisualBasic.Interaction]::InputBox("Enter desired Username for $Displayname :", "Create Username", "") #Will loop if no value is supplied for $SAM If($SAM -ne "$Null"){ #If AD user exists, throw error warning; loop back to $SAM input Try { #On error, jump to Catch { } $FindSAM = Get-ADUser $SAM -ErrorAction Stop $SAMError = [Microsoft.VisualBasic.Interaction]::MsgBox("Username [$SAM] already in use by: " + $FindSAM.Name + "`nPlease try again...", "OKOnly,SystemModal", "Error") }#Try #On -EA Stop, specified account doesn't exist; continue with creation Catch { $SAMFound = $False Break; }#Catch }#If }#While }#Do #Break from Do { } when $SAMFound is $False Until($SAMFound -eq $False) #Parameters from Template User Object $AddressPropertyNames = @("StreetAddress","State","PostalCode","POBox","Office","Country","City") $SchemaNamingContext = (Get-ADRootDSE).schemaNamingContext $PropertiesToCopy = Get-ADObject -Filter "objectCategory -eq 'CN=Attribute-Schema,$SchemaNamingContext' -and searchflags -eq '16'" -SearchBase $SchemaNamingContext -Properties * | Select -ExpandProperty lDAPDisplayname $PropertiesToCopy += $AddressPropertyNames $Password_SS = ConvertTo-SecureString -String $Password -AsPlainText -Force $Template_Obj = Get-ADUser -Identity $Template -Properties $PropertiesToCopy $OU = $Template_Obj.DistinguishedName -replace '^cn=.+?(?<!\),' #Replace SAMAccountName of Template User with new account for properties like the HomeDrive that need to be dynamic $Template_Obj.PSObject.Properties | where { $_.Value -match ".*$($Template_Obj.SAMAccountName).*" -and $_.Name -ne "SAMAccountName" -and $_.IsSettable -eq $True } | ForEach { Try{ $_.Value = $_.Value -replace "$($Template_Obj.SamAccountName)","$SAM" }#Try Catch { #DoNothing }#Catch }#ForEach #ADUser parameters $params = @{ "Instance"=$Template_Obj "Name"=$DisplayName "DisplayName"=$DisplayName "GivenName"=$UserFirstname "SurName"=$UserLastname "Initials"=$UserInitial "AccountPassword"=$Password_SS "Enabled"=$True "ChangePasswordAtLogon"=$True "UserPrincipalName"=$UserPrincipalName "SAMAccountName"=$SAM "Path"=$OU "OfficePhone"=$OfficePhone "EmailAddress"=$Email "Company"=$UserCompany "Department"=$UserDepartment "Description"=$Description "Title"=$UserJobTitle }#params $AddressPropertyNames | foreach {$params.Add("$_","$($Template_obj."$_")")} New-ADUser @params Set-AdUser "$SAM" -Manager $FindSuperV -Replace @{Info="$Info"} $TempMembership = Get-ADUser -Identity $Template -Properties MemberOf $TempMembership = $TempMembership | Select -ExpandProperty MemberOf $TempMembership | Add-ADGroupMember -Members $SAM If($FindSuperV -EQ $Null){ $NoEmail = [Microsoft.VisualBasic.Interaction]::MsgBox("Please add Manager's Email Address to their User Account!`n" + $User.SupervisorEmail, "OKOnly,SystemModal", "Error") } } 

You should be able to find the differences between #1 and this #2 iteration and make changes accordingly.

 <# .SYNOPSIS Creates a new active directory user from a template. Purpose of script to assist Help Desk with the creation of End-User accounts in Active Directory. #> #Script requires ActiveDirectory Module to be loaded Import-Module ActiveDirectory #Import all User information from CSV generated from ConvertSAAR program $Users = Import-Csv -Path "C:FooNewEmployees.csv" #Filter each line of Output.csv individually ForEach ($User in $Users) { #User account information variables $Displayname = $( If($User.MiddleIn -EQ $Null){ $User.LastName + ", " + $User.FirstName } ElseIf(!($User.MiddleIn -EQ $Null)){ $User.LastName + ", " + $User.FirstName + " " + $User.MiddleIn }) $UserFirstname = $User.FirstName $UserInitial = $User.MiddleIn $UserLastname = $User.LastName $SupervisorEmail = $User.SupervisorEmail $UserCompany = $User.Company $UserDepartment = $User.Department $Citizenship = $User.Citizenship $FileServer = $User.Location $UserJobTitle = $User.JobTitle $OfficePhone = $User.Phone $Description = $( If($User.Citizenship -eq 2){ "Domain User (Canada)" } ElseIf($User.Citizenship -eq 3){ "Domain User (United Kingdom)" } Else{ "Domain User (United States)" }) $Email = $User.Email $Info = $( $Date = Get-Date "Account Created: " + $Date.ToShortDateString() + " " + $Date.ToShortTimeString() + " - " + [Environment]::UserName ) #Get Supervisors SAM Account Name based on email address supplied in .csv $FindSuperV = Get-ADUser -Filter * -Properties EmailAddress $FindSuperV = $FindSuperV | ? { ($_.EmailAddress | Out-String) -Like "*" + $User.SupervisorEmail + "*"} $FindSuperV = $FindSuperV | select -First "1" -ExpandProperty SamAccountName $Password = 'B@dP@S$wORD234' #Parameters from Template User Object $AddressPropertyNames = @("StreetAddress","State","PostalCode","POBox","Office","Country","City") $SchemaNamingContext = (Get-ADRootDSE).schemaNamingContext $PropertiesToCopy = Get-ADObject -Filter "objectCategory -eq 'CN=Attribute-Schema,$SchemaNamingContext' -and searchflags -eq '16'" -SearchBase $SchemaNamingContext -Properties * | Select -ExpandProperty lDAPDisplayname $PropertiesToCopy += $AddressPropertyNames $Password_SS = ConvertTo-SecureString -String $Password -AsPlainText -Force $Template_Obj = Get-ADUser -Identity $Template -Properties $PropertiesToCopy $OU = $Template_Obj.DistinguishedName -replace '^cn=.+?(?<!\),' #Replace SAMAccountName of Template User with new account for properties like the HomeDrive that need to be dynamic $Template_Obj.PSObject.Properties | where { $_.Value -match ".*$($Template_Obj.SAMAccountName).*" -and $_.Name -ne "SAMAccountName" -and $_.IsSettable -eq $True } | ForEach { Try{ $_.Value = $_.Value -replace "$($Template_Obj.SamAccountName)","$SAM" }#Try Catch { #DoNothing }#Catch }#ForEach #ADUser parameters $params = @{ "Instance"=$Template_Obj "Name"=$DisplayName "DisplayName"=$DisplayName "GivenName"=$UserFirstname "SurName"=$UserLastname "Initials"=$UserInitial "AccountPassword"=$Password_SS "Enabled"=$True "ChangePasswordAtLogon"=$True "UserPrincipalName"=$UserPrincipalName "SAMAccountName"=$SAM "Path"=$OU "OfficePhone"=$OfficePhone "EmailAddress"=$Email "Company"=$UserCompany "Department"=$UserDepartment "Description"=$Description "Title"=$UserJobTitle }#params $AddressPropertyNames | foreach {$params.Add("$_","$($Template_obj."$_")")} New-ADUser @params Set-AdUser "$SAM" -Manager $FindSuperV -Replace @{Info="$Info"} $TempMembership = Get-ADUser -Identity $Template -Properties MemberOf $TempMembership = $TempMembership | Select -ExpandProperty MemberOf $TempMembership | Add-ADGroupMember -Members $SAM }