Photo by Andrea Beggi
Photo by Andrea BeggiToday I was asked to create accounts for several users in several of our domains.   After asking several people it turns out that although we are an enterprise environment, we have been creating accounts manually.

After some google-ing I found http://gallery.technet.microsoft.com/scriptcenter/PowerShell-Create-Active-7e6a3978.  While that code works, it does have syntax errors.  I fixed those and added the ability to add the new user to the same groups as an existing user.

While I have tested this, I still suggest running this in dev first and validating the results.

Save as Create-ADUsers.ps1

###########################################################
# AUTHOR  : Shai Perednik / Hican - http://www.hican.nl - @hicannl
# DATE    : 11/15/2012
# COMMENT : This script creates new Active Directory users
#           including different kind of properties based
#           on an input_create_ad_users.csv.
# Based on : http://gallery.technet.microsoft.com/scriptcenter/PowerShell-Create-Active-7e6a3978
###########################################################
Import-Module ActiveDirectory
# Get current directory and set import file in variable
$path     = Split-Path -parent $MyInvocation.MyCommand.Definition
$newpath  = $path + "\import_create_ad_users.csv"
# Define variables
$log      = $path + "\create_ad_users.log"
$date     = Get-Date
$i        = 0
# Change this to the location you want the users to be created in your AD
# FUNCTIONS
Function createUsers
{
"Created following users (on " + $date + "): " | Out-File $log -append
"--------------------------------------------" | Out-File $log -append
Import-CSV $newpath | ForEach-Object {
# A check for the country, because those were full names and need
# to be landcodes in order for AD to accept them. I used Netherlands
# as example
If($_.CO -eq "United States")
{
$_.CO = "US"
}
# Replace dots / points (.) in names, because AD will error when a
# name ends with a dot (and it looks cleaner as well)
$replace = $_.CN.Replace(".","")
If($replace.length -lt 4)
{
$lastname = $replace
}
Else
{
$lastname = $replace.substring(0,4)
}
# Create sAMAccountName according to this 'naming convention':
# <FirstLetterInitials><FirstFourLettersLast<span class="wp-decoratr-image"><img src="http://farm3.static.flickr.com/2056/2269753565_222e3ede4b_m.jpg" alt="user vrusnak logging off domain FOLEY one last time" />
<a href="http://www.flickr.com/photos/61239744@N00/2269753565" rel="external nofollow">Photo by V'ron</a></span>Name> for example
# hhica
#$sam = $_.Initials.substring(0,1).ToLower() + $lastname.ToLower()
$sam = $_.LogOnName
Try   { $exists = Get-ADUser -LDAPFilter "(sAMAccountName=$sam)" }
Catch { }
If(!$exists)
{
$i++
# Set all variables according to the table names in the Excel
# sheet / import CSV. The names can differ in every project, but
# if the names change, make sure to change it below as well.
$setpass = ConvertTo-SecureString -String $_.Password -AsPlainText -force
New-ADUser -Name $sam -GivenName $_.FirstName -Initials $_.Initials -Surname `
$_.LastName -DisplayName $_.DisplayName -Office $_.OfficeName -Description `
$_.Description -EmailAddress $_.Mail -StreetAddress $_.StreetAddress -City `
$_.L -PostalCode $_.PostalCode -Country $_.CO -UserPrincipalName `
$_.UPN -Company $_.Company -Department $_.Department -EmployeeID `
$_.ID -Title $_.Title -OfficePhone $_.Phone -AccountPassword $setpass

# Set an ExtensionAttribute
$dn  = (Get-ADUser $sam).DistinguishedName
$ext = [ADSI]"LDAP://$dn"
#      $ext.Put("extensionAttribute1", $_.ExtensionAttribute1)
#      $ext.SetInfo()

# Move the user to the OU you set above. If you don't want to
# move the user(s) and just create them in the global Users
# OU, comment the string below
Move-ADObject -Identity $dn -TargetPath $_.Location

# Rename the object to a good looking name (otherwise you see
# the 'ugly' shortened sAMAccountNames as a name in AD. This
# can't be set right away (as sAMAccountName) due to the 20
# character restriction
$newdn = (Get-ADUser $sam).DistinguishedName
Rename-ADObject -Identity $newdn -NewName $_.CN

#Add the user to groups if InheritGroupsFromUser is declared in the csv
if ($_.InheritGroupsFromUser) {
SetupGroupMemberships -InheritGroupsFromUser $_.InheritGroupsFromUser -UsertoModify $newdn
}

$output  = $i.ToString() + ") Name: " + $_.CN + "  sAMAccountName: "
$output += $sam + "  Pass: " + $_.Password
$output | Out-File $log -append
}
Else
{
"SKIPPED - ALREADY EXISTS OR ERROR: " + $_.CN | Out-File $log -append
}
}
"----------------------------------------" + "`n" | Out-File $log -append
}
function SetupGroupMemberships{
param ([string]$InheritGroupsFromUser, [string]$UsertoModify)
#get the group membership of an example user
$ADGroups = (Get-ADUser -Identity $InheritGroupsFromUser -Properties MemberOf | Select-Object MemberOf).MemberOf
#Loop through the retrevied groups and add them to the user created in the createUsers function
foreach ($ADGroup in $ADGroups) {
Add-ADGroupMember -Identity $ADGroup -Member $sam
}
}

# RUN SCRIPT
createUsers
#Finished

In the same directory create a csv file with the following columns.

Tags: active directory, directory users, Windows PowerShell