SIMS > Active Directory

[ModeratelyGruntled]

Hi

 

I'm interested to hear if anyone is doing something similar to this:

 

I'd like to automate our user creation process. This means pupil AD accounts are created (probably on a nightly schedule) as they're added to SIMS, in the correct OU for their year group.

 

At the moment I have a powershell script to create users in a specific OU from a csv, including setting a password. The CSV from SIMS requires some work - concatenating usernames from surname/firstname columns and adding the year of entry, and checking for duplicates. I modify the script to point at the newly-created 'Year of entry OU' and run it. This takes an hour or two over the summer. For students that join after this day, we're relying on discover updates and emails from data manager.

 

I've made a start on writing this - commandreporter dumps the first name, surname, year, UPN etc of pupils who've joined since today's date to a csv. As above, I already have a powershell script to bring everything into AD. We then use AAD connect to create 365 accounts - so the manual process of editing the CSV before it is imported into our local AD is missing, and I would ideally like the new accounts to be sorted into the right OU for their year group.

 

I realise you can buy products to sort this and things like class lists to AD group, but I don't feel like I'm a million miles away from getting it running.

 

1. Any ideas on how I automate the concatenation of names/year of entry into usernames?

2. How do I go about selecting an OU in our local AD based on year of entry (from CSV)?

3. How can I get some sort of prompt (via email if poss - O365 user here, no local exchange) to tell us/staff when a new user is created?

 

All input/ideas welcome!

 

Many Thanks

[Boredguy]

We use a scheduled task to run a SIMS report each morning that exports students on roll, and student leavers.

a few minutes later we have a powershell script that then reads the on roll CSV, checks the AD to see if their admission number already exists. If it does it updates any information that might have changed since the previous day (names, tutor group etc). If a number is not found it stores that and at the end of the CSV it then creates the new users accounts on the correct server (including creating the home folders & permissions) then e-mails the tutor that students logon details.

Any leavers that are detected are added to a "Leavers" group and disabled (plus moved to a different OU)

 

During the day we have another powershell script that runs hourly that updates O365 for any unlicenced users that are AD Sync'd. If the account matches a student or staff account, it sets the licences/mailbox policies as required.

[Boredguy]

Below is a quick snippit of how we get the OU set in our script

$ListOfAccounts=IMPORT-CSV \\server\scripts$\manual.csv -Header ("LastName","FirstName","Gender","Password","YearGroup","TutorGroup","EnrollNo","Username","EntryType","FileServer")
FOREACH ($Account in $ListOfAccounts)
{
$path = "OU=" + $Account.EntryType + ",OU=Students,OU=XXX,OU=Establishments,DC=XXX,DC=internal"
New-ADUser -Name $Account.Username `
-Path $path `
}

[forkies]

Effectively the same as @Boredguy but we do it for all our staff too, we have a udf in sims which when ticked does export staff as we don't want account for some such as cleaners. Then it goes into Ou based on the cncyear out of sims.

I know a lot of people use software like salamandersoft which I would strongly recommend if you have the budget rather than constantly editing scripts when you want new features (such as email creation, shared folder permissions setup, moving user docs and so on) which has taken me a while to build ours up (now something like 1400 lines in power shell).

[markwilfan]

We just use salamander to do all this. Best money I spend out of my budget. Can do all this and more

[ModeratelyGruntled]

Hi

 

Thanks for the input all. My preference was to write this script over a third party tool - as well as budgets being tight I did feel as if I wasn't far away from getting something working, and I seem to have made progress.

 

Hopefully this makes sense - I appreciate it doesn't look very pretty but this is the first powershell script of note I've written and a fair amount of trial and error has gone into the below!

 

At present it creates all new accounts under the 'pupils' OU - which I'm going to look at next, along with some proper logging of account creation and hopefully then an email notification when a new account is created.

 

AAD sync then creates our 365 accounts so it's starting to turn into a bit more of a seamless process!

 

Any input appreciated as always.

 

Ta

 

MG!

 

# Runs report that outputs new pupils since 31-01-17 to csv
("C:\Program Files (x86)\SIMS\SIMS .net\CommandReporter.exe"" /USER:reportgenerator"" /PASSWORD:******"" /REPORT:New-pupils-since-310117")

# Imports raw CSV from of SIMS.net, generates SamAccountname, exports to csv 2
$CSV = Import-CSV 'c:\Scripts\all-pupils-auto-export.csv' | Select-Object *
$i=0
$CSV | Foreach-Object {Add-Member -InputObject $CSV[$i] -name SamAccountName -Value ($_.Entry+$_.LastName+$_.Firstname.Substring(0,1)) -membertype NoteProperty; $i++}
$CSV | Export-Csv "c:\Scripts\amended-pupils-auto-export.csv"

# Imports CSV 2 to AD
Import-Csv 'c:\scripts\amended-pupils-auto-export.csv' | foreach-object { New-ADUser -Name $_.DisplayName -SamAccountName $_.SamAccountName 
-UserPrincipalName (“{0}@{1}” -f $_.SamAccountName,”domain.org”) -DisplayName $_.Displayname -GivenName $_.FirstName -SurName $_.LastName 
-AccountPassword (ConvertTo-SecureString "Changeme!" -AsPlainText -force) -Enabled $True -ChangePasswordAtLogon $True -PassThru 
-Path 'OU=Pupils,OU=SIH-Users,DC=domain,DC=ORG'}

Edited February 7, 2017 by ModeratelyGruntled