Start-Transcript -Path c:\psscript\log.txt
clear
Import-Module activedirectory
#Script to add users 

#Function list

function ftpexport {
#get ftp export.csv
cd c:\psscript
start C:\psscript\psftp.exe -ArgumentList "-batch -b ftpcmd.txt <ip/fqdn> -l <yourusername> -pw <yourpassword>" -Wait
#end function
}

function report {
#send report

$table |Sort-Object -Property Action | Export-Csv "c:\psscript\report.csv" -NoTypeInformation
$table | Select-Object Name, Year, Action | Sort-Object Action | ConvertTo-Html | Out-File  c:\psscript\report.html 
$mail.IsBodyHtml = "True"
$body = $table | Select-Object Name, Year, Action |Sort-Object Action| ConvertTo-Html 
#$body = Get-Content c:\report.html 
$mail.body = $body 
$mail.Attachments.Add("c:\psscript\report.html")
$smtp.send($mail)
#END Function
}



#set constant vars
$domain ="school.fqdn";$nbdomain = "school"; $edomain = "@school.mail"

$p0 = ConvertTo-SecureString "Password0" -AsPlainText -Force 
$p1 = ConvertTo-SecureString "Password1" -AsPlainText -Force 
$p2 = ConvertTo-SecureString "Password2" -AsPlainText -Force 
$p3 = ConvertTo-SecureString "Password3" -AsPlainText -Force 
$p4 = ConvertTo-SecureString "Password4" -AsPlainText -Force 
$p5 = ConvertTo-SecureString "Password5" -AsPlainText -Force 
$password = ConvertTo-SecureString "Password1" -AsPlainText -Force 

$homepathroot = "serverfqdn\share\students";$homedrive = "S:"
$elemyear = 2024

#Setup Email Report
$mail = New-Object system.net.Mail.MailMessage 
$mail.From  = "Aduserscript@yourdomain.school"
$mail.To.add("you@yourdomain.school")
$mail.Subject = "Script Results" #+ {get-date)
$mail.Body = $table 
$smtp = new-object system.Net.Mail.SmtpClient("your.smtp.server")

# Create Data Table for Reporting
$table = New-Object system.Data.DataTable "Account Report"
$table.Columns.Add("Name", [string]) | Out-Null ;$table.Columns.Add("Year",[string]) | Out-Null ;$table.Columns.Add("Action",[string]) | Out-Null 


#CSV Setup
#powerschool feild list 
@"
last_name
first_name
student_number
grade_level
city
state
zip
schoolid
zz_Internet_Access_Allowed
"@

ftpexport

$csvfile = "C:\psscript\exportAD.csv"
if ((Get-Content $csvfile ) -eq $null )
{
$row = $table.NewRow();$row.Name ='Null File'; $row.Year = 'check ftp' ; $row.Action = "export file is blank exit and check files "
$table.Rows.Add($row)
report

Copy-Item  c:\psscript\exportAD.csv c:\psscript\$date-exportAD.csv
del c:\psscript\exportAD.csv
exit
}
$csvusers = import-csv  $csvfile -Header lastname,firstname,postofficebox,grade,City,State,PostalCode,schoolid,internet


#current Date
$date = Get-Date 


function varcleanup {
#Varible Clean up
$script:a = $null 
$script:csvuser = $null 
$script:lastname = $null 
$script:user = $null 
$script:bld = $null 
$script:year = $null 
$script:parDN = $null 
$script:groupid = $null 
$script:dname = $null 
$script:upn = $null 
$script:homepath = $null 
$script:homepath = $null 
$script:aduser  = $null 
$script:row = $null 
$script:desc = $null 
$script:user = $null 
$script:GR = $null
$script:grade = $null


}

ForEach ($csvuser in $csvusers){

$a = $csvuser.postofficebox;$a = $a.substring($a.length - 4, 4)
$lastname = $csvuser.lastname.split("-")
$user = $lastname[0].tolower() + $csvuser.firstname.substring(0,1).tolower() + $a
$user = $user -replace ' ' ,'' 
if ($csvuser.schoolid -eq 123) {continue} #electronic
if ($csvuser.schoolid -eq 456) {$bld = "HS"} #High School
if ($csvuser.schoolid -eq 789) {$bld = "MS"} #Middle School
if ($csvuser.schoolid -eq 987) {$bld = "ES"} #Elementary


if ($csvuser.grade -eq "KG") {continue}
$grade = [int]$csvuser.grade
if ($grade -eq 13) {continue}
if ($grade -eq -1) {continue}
if ($grade -eq 14) {$grade = 12}
if ($grade -lt 10) {$GR = "GR0$grade"}
if ($grade -ge 10) {$GR = "GR$grade"}
#if ([int]$csvuser.grade -lt 5) {continue} #Uncommnet to exclude elementary 
if ($date.month -lt 7 )
{
$year = (12 - [int]$grade + $date.year)
}
else {$year = (12 - [int]$grade + $date.year + 1)}

$parDN = "OU=$year," +"OU=$GR," + "OU=$bld," + "OU=Students," + $domainbase  
$userDN = "CN=$user,"+ $parDN 
$groupid= "Students$year"; $groupid =  Get-ADGroup -Filter {name -eq  $groupid }
$dname = $csvuser.Firstname + " " + $csvuser.Lastname
$upn = $user+$edomain; $email =$user+$edomain
$homepath = $homepathroot + "\" + $year + "\" + $user
$noiaf = "CN=noIAF,OU=Groups,DC=school,DC=fqdn,DC=local"
$domainbase = "DC=school,DC=fqdn,DC=local"
$stuou = Get-ADOrganizationalUnit -Filter {name -eq $year}
#check if CSV record is vailed by checking state extra commas
if ($csvuser.State -ne "mystate" ) {
$row = $table.NewRow();$row.Name =$dname ; $row.Year = $year ; $row.Action = "01CHECK FOR EXTRA COMMAS"
$table.Rows.Add($row)
continue
}


#Array of CSV user to  test AD users agaist
[array]$csvtest = $csvtest + $user
#chek if user is in AD
$pobox = $csvuser.postofficebox
$aduser = Get-ADUser -filter {pobox -eq  $pobox} -Properties  postofficebox,displayname,description,memberof,city,homedirectory
if ($aduser.SamAccountName -eq $user)
{
#user is in AD
#Grace period August
#commented out stop aup check
#if ($date.month -ne 8){
#test for NO AUP
#[string]$group = $aduser.Memberof 
#if ($group -notlike  "*noIAF*" -and $csvuser.internet -eq "" ) {
#Set-ADUser -Identity $user -HomePage "Disabled No AUP" -Fax "NO AIF" -Enabled $false
#add-ADGroupmember -Identity $noiaf -Member $aduser
#$row = $table.NewRow();$row.Name =$aduser.DisplayName  ; $row.Year = $year ; $row.Action = "NO AUP Account Disabled"
#$table.Rows.Add($row)
#continue}}




# Disabled group if students are in this group script will ignore them

if ($aduser.MemberOf -like "*disabled*"  ) {continue}

#check for disabled accout returning student
if ($aduser.Enabled -eq $false){
#user is in AD with disabled account

#Grace period August

#commented out stop aup check
#if ($date.month -ne 8){
#test for NO AUP
#check for Internet AUP
#if ($csvuser.internet -eq "") 
#user does not have form skip to next user
#{varcleanup; continue}}


#commented out stop aup check
#Check for disabled accounts with allow internet
#if ($group -like "*noIAF*"){
#Set-ADUser -Identity $aduser -Fax " "  -HomePage "Enable has AUP"  -Enabled $true 
#remove-ADGroupmember -Identity $noiaf -Member $aduser -Confirm:$false
 
#$row = $table.NewRow();$row.Name =$aduser.DisplayName ; $row.Year = $year ; $row.Action = "Has AUP Account Enabled"
#$table.Rows.Add($row)
#continue
#}

#student account is enabled and active
 
Set-ADUser -Identity $aduser -HomePage "returned via script" -Enabled $true 
#report Line
$row = $table.NewRow();$row.Name =$aduser.DisplayName ; $row.Year = $year ; $row.Action = "Returning Student Account Enabled"
$table.Rows.Add($row)}


#Update User Info
#Update city
if ($aduser.City -ne $csvuser.City){
set-ADUser -Identity $user  -City $csvuser.City  -PostalCode $csvuser.postalcode -State $csvuser.State
Add-ADGroupMember -Identity $groupid -Member $userdn
$row = $table.NewRow();$row.Name =$aduser.DisplayName ; $row.Year = $year ; $row.Action = "student info update to " + $csvuser.City  
$table.Rows.Add($row)}


#update year
$desc = $aduser.Description 
$desc = $desc.substring($desc.length - 4, 4)
#set old group
$oldgroupid= "Students$desc"; $oldgroupid =  Get-ADGroup -Filter {name -eq  $oldgroupid }


if ($desc -ne $year){
set-ADUser -Identity $user -Description "Students$year"
Add-ADGroupMember -Identity $groupid -Member $aduser 
Remove-ADgroupMember   $oldgroupid -Members $aduser -Confirm:$false
Move-Item $aduser.HomeDirectory -Destination "$homepathroot\$year\" 
set-ADUser -Identity $user -HomeDirectory $homepath 
Move-ADObject -Identity $aduser -TargetPath  $stuou 
$row = $table.NewRow();$row.Name =$aduser.DisplayName ; $row.Year = $year ; $row.Action = "update Year From " + $desc  
$table.Rows.Add($row)}

}



if ( $aduser.samaccountname -eq $null)
{#Create User info


#Create AD account
New-ADUser -Path  $stuou -Name $user -SamAccountName $user -Surname  $csvuser.LastName -GivenName  $csvuser.FirstName -City $csvuser.City -State $csvuser.State -PostalCode $csvuser.PostalCode -Pobox $csvuser.PostofficeBox -Description "Students$year"  -AccountPassword $password -DisplayName $dname -UserPrincipalName $upn -Email $email -HomeDrive $homedrive -HomeDirectory $homepath -Company "Your School" -Country "US" -ChangePasswordAtLogon $true -Enabled $true

Add-ADGroupMember -Identity $groupid -Member $userdn
#Set-ADUser -Identity $user -UserMustChangePassword $true -ObjectAttributes @{c='US';userAccountControl=512;}
#if elementary password never expires and user can't change password
if ($year -gt $elemyear) 
{

switch ($grade){
0 {Set-ADAccountPassword -Identity $user -Reset -NewPassword  $p0}
1 {Set-ADAccountPassword -Identity $user -Reset -NewPassword $p1}
2 {Set-ADAccountPassword -Identity $user -Reset -NewPassword $p2}
3 {Set-ADAccountPassword -Identity $user -Reset -NewPassword $p3}
4 {Set-ADAccountPassword -Identity $user -Reset -NewPassword $p4}
5 {Set-ADAccountPassword -Identity $user -Reset -NewPassword $p5}
default {Set-ADAccountPassword -Identity $user -Reset -NewPassword $p1}

}}

$row = $table.NewRow();$row.Name = $dname ; $row.Year = $year ; $row.Action = "New Student Account Created"
$table.Rows.Add($row)
#folder info
if (!(test-path -path $homepath )){ 
#Create Home Directories
New-Item -ItemType directory $homepath
#Assign Access Rights
$account=$nbdomain + "\"+$user
$rights=[System.Security.AccessControl.FileSystemRights]::FullControl
$inheritance=[System.Security.AccessControl.InheritanceFlags]"ContainerInherit,ObjectInherit"
$propagation=[System.Security.AccessControl.PropagationFlags]::None
$allowdeny=[System.Security.AccessControl.AccessControlType]::Allow
$dirACE=New-Object System.Security.AccessControl.FileSystemAccessRule ($account,$rights,$inheritance,$propagation,$allowdeny)
$dirACL=Get-Acl $homepath
$dirACL.AddAccessRule($dirACE)
Set-Acl $homepath $dirACL
#Report Lne
$row = $table.NewRow();$row.Name =$dname ; $row.Year = $year ; $row.Action = "Home Folder Created"
$table.Rows.Add($row)}
continue
}

#updated name if username differs
if ($aduser.samaccountname -ne $user ){

Move-Item -Path  $aduser.HomeDirectory -Destination $homepath

Set-ADUser -Identity $aduser -SamAccountName $user -Surname  $csvuser.LastName -GivenName $csvuser.FirstName -City $csvuser.City -State $csvuser.State -PostalCode $csvuser.PostalCode -pobox $csvuser.PostofficeBox -Description "Students$year"  -DisplayName $dname -UserPrincipalName $upn -Email $email -HomeDrive $homedrive -HomeDirectory $homepath -Company "Your School" 
Rename-ADObject -Identity $aduser -NewName $user 

$row = $table.NewRow();$row.Name =$aduser.DisplayName ; $row.Year = $year ; $row.Action = "0Renamed  "  + $user + $user.displayname 
$table.Rows.Add($row)
continue
}

#check for first name change
if ($aduser.givenname -ne $csvuser.FirstName ){

Set-ADUser -Identity $aduser  -GivenName $csvuser.FirstName  -DisplayName $dname  

$row = $table.NewRow();$row.Name =$aduser.DisplayName ; $row.Year = $year ; $row.Action = "0changed first name from "  + $aduser.givenname + " to " + $csvuser.FirstName
$table.Rows.Add($row)
continue}



}

#Get AD Users 
$studentsOU = Get-ADOrganizationalUnit -Filter {name -eq "Students"}

$ADusers = get-aduser  -SearchScope subtree -SearchBase $studentsOU -Properties memberof, displayname -Filter *
echo "ad loop"
#Disable accounts not is CSV
foreach ($aduser in $ADusers){
#commented out stop aup check
#if ($aduser.MemberOf -like "*noiaf*" -and $aduser.Enabled -eq $true ) 
#user does not have form disable account
#{disable-ADaccount -Identity $aduser
#Set-ADUser -Identity $aduser -HomePage "Disabled by Script NO AUP"

#}
#if ($aduser.MemberOf -like "*renamed*" ){continue}


if ($csvtest -notcontains  $aduser.SamAccountName){
if ($aduser.Enabled -eq $false) {Continue}
if ($aduser.MemberOf -like "*General Accounts*"  ) {continue}
#summertime use bring in new kg without disabling seniors
if ($aduser.MemberOf -like "*students2017*") {continue}

if ($aduser.MemberOf -like "*disabled*"  ) {continue}
disable-ADaccount -Identity $aduser 
Set-ADUser -Identity $aduser -HomePage  "Disabled by Script"
$year = $aduser.Description 

#Report Line
$row = $table.NewRow();$row.Name =$aduser.DisplayName ; $row.Year = $year  ; $row.Action = "Withdrawn Student Account Disabled"
$table.Rows.Add($row)}}

report
$date = get-date -UFormat %Y-%m-%d

Copy-Item  c:\psscript\exportAD.csv c:\psscript\$date-exportAD.csv
del c:\psscript\exportAD.csv

Stop-Transcript