Bulk creation of AD users

[Brave_heart]

I used to use a product called Ranger which had a lovely little feature that allowed bulk creation of users accounts. We have had to drop this product because RM no longer appear to want to support it.

Does anyone know of or can recommend an alternative tool that will allow me the bulk creation of AD users using a CSV? There seems to be a lot of choice generally and I need something simple.

[SHimmer45]

powershell is your friend spend a little time and you can get it to do all that you need.

 

Import-Csv import.csv | Foreach-object {
New-ADUser -Name $_.DisplayName -UserPrincipalName $_.UserPrincipalName -SamAccountName $_.Username -GivenName $_.GivenName -DisplayName $_.DisplayName -Surname $_.Surname -Description $_.Description -Path $_.Path -ScriptPath $_.ScriptPath -HomeDirectory $_.Homedirectory -HomeDrive $_.HomeDrive -AccountPassword (ConvertTo-SecureString $_.Password -AsPlainText -Force) -Enabled $True -PasswordNeverExpires $True -PassThru }

 

it doesnt handle group memberships (something i need to work at adding)

 

CSV has headers and the script reads from the headers downwards.

[Brave_heart]

Thanks for this.

Does it automatically create the user home folder or simply tell AD where it is?

[Gibbo]

If you're finding PS a little hard going, this is a really good program:

 

https://www.dovestones.com/active-directory-user-import/

[Brave_heart]

Yes, i looked at this but it seemed a bit pricey for my budgets. PS will probably work for me once i have gotten my head round it.

[Snoochieboochies]

PowerShell Script is defiantly the way to go.

[SHimmer45]

Thanks for this.

Does it automatically create the user home folder or simply tell AD where it is?

 

in our case it doesnt create the folder but if you are using folder redirection it should do.

[Brave_heart]

Thanks for this.

I will give PS a crack and see how we get on.

[Duke5A]

Another vote for PS! I took a couple of days putting this script together because I wanted an automated solution I could use with a scheduled task. This script will place users in organizational units based off of graduation year, create home folders and set permissions. Now, I'm completely new to PS, so to the pros on this forum I know I'm a butcher. lol. This is obviously customized to our needs, but it should help.

 

$WorkingDir = "c:\scripts"
$GoogleDomain = "GoogleAppsDomain.org"
$ADDomain = "OurDomain.com"
$Password = "password"
$BaseOU = "ou=Grad Year,ou=Students,ou=OurUsers,dc=OuRDomain,dc=com"
#$BaseHome = "\\FileServer\Students$\"
$HomeDrive = "H:"
$UserCount = 0


$LogPath = $WorkingDir + "Log $($LogDate).txt"
$LogDate = Get-Date -UFormat "%Y-%m-%d.%H.%M.%S"
$PSExportPath = $WorkingDir + "PSExport2.txt"
$UserExportPath = $WorkingDir + "User $($LogDate).txt"
$TimeStart = Get-Date

"Processing started on $($TimeStart)" | Out-File $LogPath -append 
"--------------------------------------------" | Out-File $LogPath -append 
"" | Out-File $LogPath -append 

Try{Import-Module ActiveDirectory -ErrorAction Stop}
Catch{
   "[CRITICAL] Active Directory module not loaded! Aborting." | Out-File $LogPath -append 
   "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append
   "`t $($_.Exception.Message)" | Out-File $LogPath -Append
   Exit
}


$FileExists = Test-Path $PSExportPath 
If ($FileExists -eq $False){
   "[CRITICAL] User export not found! Aborting." | Out-File $LogPath -append 
   Exit
}

$PSExportFile = Get-Item $PSExportPath
$Limit = (Get-Date).AddHours(-12)
If ($PSExportFile.LastWriteTime -lt $Limit){
   "[CRITICAL] User export is more than 12 hours old! Aborting." | Out-File $LogPath -append 
   Exit
}

Copy-Item $PSExportPath $UserExportPath | Out-Null

Try{$Users = Import-Csv -Delimiter "`t" -Path $UserExportPath -ErrorAction Stop}
Catch{
   "[CRITICAL] Export not formatted properly! Aborting." | Out-File $LogPath -append
   "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append
   "`t $($_.Exception.Message)" | Out-File $LogPath -Append 
   Exit
}

If ($TimeStart.Month -gt 7) {$FiscalYear = $TimeStart.Year + 1}
Else {$FiscalYear = $TimeStart.Year}


AddUsers

Function AddUsers{

   foreach ($User in $Users) {

       $i++

       $UserFirstname = $User.Firstname
       $UserLastname = $User.Lastname
       $PSNumber = $User.PSNumber
       $Grade = $User.Grade

       If (($UserFirstname -eq "") -Or ($UserLastname -eq "") -Or ($PSNumber -eq "") -Or ($Grade -eq "")){

           "[ERROR] Information missing.  Check source line $($i)." | Out-File $LogPath -Append
           Continue
       }

       $UserLastname = $UserLastname.Replace(".","")
       $UserLastname = $UserLastname.Replace(" ","")
       $UserLastname = $UserLastname.Replace("'","")
       $UserLastname = $UserLastname.Replace("-","")

       $Displayname = $User.Firstname + " " + $User.Lastname
       $SAM = $UserLastname.Substring(0,4) + $PSNumber.Substring(6,4)
       $UPN = $SAM + "@" + $ADDomain
       $GApps = $SAM + "@" + $GoogleDomain

       Switch ($Grade) {

           12 {$GradYear = $FiscalYear + 0}
           11 {$GradYear = $FiscalYear + 1}
           10 {$GradYear = $FiscalYear + 2}
           9 {$GradYear = $FiscalYear + 3}
           8 {$GradYear = $FiscalYear + 4}
           7 {$GradYear = $FiscalYear + 5}
           6 {$GradYear = $FiscalYear + 6}
           5 {$GradYear = $FiscalYear + 7}
           4 {$GradYear = $FiscalYear + 8}
           3 {$GradYear = $FiscalYear + 9}
           2 {$GradYear = $FiscalYear + 10}
           1 {$GradYear = $FiscalYear + 11}
           0 {$GradYear = $FiscalYear + 12}
           Default {"[ERROR] Grade not valid.  Check source line  $($i)." | Out-File $LogPath -Append
           Continue}

           }

       $HomeFolder =  $BaseHome + $GradYear + "\" + $SAM
       $OU = "ou=" + $GradYear + "," + $BaseOU
       $GroupName = "Students_" + $GradYear

       Try   {$UserExists = Get-ADUser -LDAPFilter "(sAMAccountName=$SAM)"}
       Catch {
               "[ERROR] Unable to check for duplicate user $(SAM)  Source line  $($i)." | Out-File $LogPath -Append
               "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append
               "`t $($_.Exception.Message)" | Out-File $LogPath -Append
               Continue
       }

       If(!$UserExists){
           
           Try{
               New-ADUser -Name $DisplayName -DisplayName $Displayname -SamAccountName $SAM -UserPrincipalName $UPN -GivenName $UserFirstname -Surname $UserLastname -HomePhone $PSNumber -Description $GradYear -City $GApps -AccountPassword (ConvertTo-SecureString $Password -AsPlainText -Force) -Enabled $true -ChangePasswordAtLogon $true -PasswordNeverExpires $false -Path $OU -HomeDirectory $HomeFolder -HomeDrive $HomeDrive -ErrorAction Stop
           }
           Catch{
               "[ERROR] User $($SAM) not created.  Source line  $($i)." | Out-File $LogPath -Append
               "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append
               "`t $($_.Exception.Message)" | Out-File $LogPath -Append
               Continue
           }

           $UserCount = $UserCount + 1
           "[sUCCESS] User $($SAM) created.  Source line  $($i)." | Out-File $LogPath -Append

           Try{Add-ADGroupMember -Identity $GroupName -Members $SAM -ErrorAction Stop}
           Catch{
               "[ERROR] User $($SAM) not added to group $($GroupName).  Source line  $($i)." | Out-File $LogPath -Append
               "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append
               "`t $($_.Exception.Message)" | Out-File $LogPath -Append
               Continue
           }

           "[sUCCESS] User $($SAM) added to group $($GroupName).  Source line  $($i)." | Out-File $LogPath -Append

           Try{
               New-Item -ItemType "Directory"  -Path $HomeFolder -ErrorAction Stop
               $Acl = (Get-Item $HomeFolder).GetAccessControl('Access')
               $Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($SAM, "Modify",'ContainerInherit,ObjectInherit', 'None', 'Allow')
               $Acl.SetAccessRule($Ar)
               Set-Acl -path $HomeFolder -AclObject $Acl
               }
           Catch{
           "[ERROR] User $($SAM) home folder messed up.  Source line  $($i)." | Out-File $LogPath -Append
           "`t $($_.Exception.ItemName)" | Out-File $LogPath -Append
           "`t $($_.Exception.Message)" | Out-File $LogPath -Append
           Continue
           }
           
           "[sUCCESS] User $($SAM) home folder created.  Source line  $($i)." | Out-File $LogPath -Append
       }
       Else{
           "[iNFO] User $($SAM) already exists.  Source line  $($i)." | Out-File $LogPath -Append
           Continue
       }
   }
}

$TimeEnd = Get-Date
$ElapsedTime = $TimeEnd - $TimeStart
"" | Out-File $LogPath -Append
"Processing Finished on: $($TimeEnd)" | Out-File $LogPath -Append
"Total processing time:  $($ElapsedTime)"  | Out-File $LogPath -Append
"Users created:          $($UserCount)"  | Out-File $LogPath -Append

[jmak]

Bit late to the party, but in case you don't get on with the Powershell, I use the free Solarwinds tool:

 

http://www.solarwinds.com/free-tools/active-directory-admin-tools-bundle/

[ADMaster]

Yes PS will do everything you want and more. I've added features to mine over the years.

Create users + home directories in correct OU by grad year.

Disable withdrawn students

rename students if their name has changed, and their home folder

move them to a new OU / sub folder if grad year changes

re enable account if they return

send me an email summary of changes

I used to have it disable / enable if they did not have their permission forms in, but since forms are now electronic that put us in a catch 22

I also used to have it update city, moodle required that but we don't use it anymore.

 

Start with basic user creation and add features as you go.

[FN-GM]

I have used this in the past. All done in Excel, dead easy to use!

 

Account Management Spreadsheet

[Mistert89]

We have used ActivMan for a few years. Not expensive and does much of what you want.

[Brave_heart]

Thanks everyone for the advice - few things to try here.