pleach85 Posted April 27, 2017 Posted April 27, 2017 Sorry, I see what I've missed you'll need to update the UPN value as well as the SAM value. If you use the same SAM name as the prefix for the UPN name this should do it $i = 1 while((Get-ADUser -Filter {sAMAccountName -eq $SAM}) -ne $null){ $SAM = $SAM + $i.ToString() $UPN = $SAM + '@' + ($UPN -split '@')[1] $i++ }
pleach85 Posted April 27, 2017 Posted April 27, 2017 I just looked at your script and you're currently setting the UPN to firstname.surname@... rather than the SAM@... so the above might need to be changed depending on your requirements. I also noticed you're using the UPN as the email... again this will need to be checked. Personally I would set $UPN = $SAM + "@test.com"
noelmm Posted April 28, 2017 Author Posted April 28, 2017 (edited) Firstly can I say thanks for the help. The code now works to create the duplicate account names with a 1 added onto the name however the script now fails to create any account for a SAM that is not already in AD, for example in the csv at the moment I have 5 entries for an account called test.user and 5 accounts are created called test.user1 - test.user5 as you would expect however in the same csv there are 2 accounts called jake.b and noel.m and these are not created however no errors are given. The script is also updating the first and last name of the accounts created with a 1 and I don't know why as these are read from the csv and not reliant upon the SAM (I might be wrong), for example the test.user2 account has the first name test2 and lastname user2. As a potential fix I amended the code to have the same made up of the the firstname.lastname rather than reading it from the csv as a seperate field and set your code to look for the surname as a filter and then add the number onto that however it doesn't work, I'm guessing I have coded it completely wrong.Below are is the way the code looks now, if you can advise as how I can solve this I would be grateful Noel ForEach ($User in $Users) { $Displayname = $User.Firstname + "." + $User.Lastname $UserFirstname = $User.Firstname $Lastname = $User.Lastname $OU = $User.OU $SAM = $User.Firstname + "." + $User.Lastname $UPN = $SAM + "@test.com" $Description = $User.Description $Password = $User.Password $Email = $SAM + "@test.com" $Company = "schoolname" $i = 1 while((Get-ADUser -Filter {Surname -filter $Lastname}) -ne $null) { $Lastname = surname + $i.ToString() $UPN = $SAM + "@test.com" #'@' + ($UPN -split '@')[1] $i++ } New-ADUser -Name "$Displayname" ` -DisplayName "$Displayname" ` -SamAccountName "$SAM" ` -UserPrincipalName "$UPN" ` -GivenName "$UserFirstname" ` -Surname "$Lastname" ` -Description "$Description" ` -AccountPassword (ConvertTo-SecureString $Password -AsPlainText -Force) -Enabled $true -ChangePasswordAtLogon $true -PasswordNeverExpires $false ` -Server test.com ` -Email "$Email" ` -Company "$Company" ` -homedrive "u:" -homedirectory \\servername\sharename\$SAM #-homedrive "u:" -homedirectory \\servername\sharename\%username% Get-ADUser $SAM | Move-ADObject -TargetPath "OU=Year 7,OU=Student,OU=Users,OU=BurtonBorough,DC=test,DC=com" Add-ADPrincipalGroupMembership $SAM students Add-ADPrincipalGroupMembership $SAM "All Years" # Add-ADPrincipalGroupMembership $SAM - Duplicate this line to add the user into more AD groups new-item "c:\users\$SAM" -ItemType Directory #This line can be replaced with the line below to determine the full unc path of the folder $acl = Get-Acl -Path "c:\users\$SAM" $permission = $SAM, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow' $permission2 = 'students', 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow' $permission3 = 'All Years', 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow' $rule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission $rule2 = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission2 $rule3 = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission3 $acl.AddAccessRule($rule) $acl.ADDAccessRule($rule2) $acl.ADDAccessRule($rule3) $acl | Set-Acl -Path "c:\users\$SAM" #new-item "\\servername\sharename\foldername" -ItemType Directory } Edited April 28, 2017 by noelmm
pleach85 Posted April 28, 2017 Posted April 28, 2017 I've modified your script as below but I can't see any reason why the first name is getting a number appended, I would not search in the where by surname as that does not guarantee a unique SAM/UPN which is what you need. I've moved every variable that is dependent on the SAM to after we find a unique SAM. This script does however assume that in your current directory all UPN and SAM are the same, I also noticed a bug so whereby I wasn't using the original SAM so I've fixed that and commented to hopefully make it clear. Can you post your CSV so I can have a look at that, can't think of any reason why jake.b/noel.m wouldn't be created by the script. ForEach ($User in $Users) { $Displayname = $User.Firstname + "." + $User.Lastname $UserFirstname = $User.Firstname $Lastname = $User.Lastname $OU = $User.OU $Description = $User.Description $Password = $User.Password $Company = "schoolname" $SAM = $User.Firstname + "." + $User.Lastname # create SAM from first . last name $i = 1 # reset number to append variable $originalSAM = $SAM # keep the original SAM in a separate variable (easier to increment number) while((Get-ADUser -Filter {sAMAccountName -eq $SAM}) -ne $null){ # check if SAM exists $SAM = $originalSAM + $i.ToString() # If not add number to the end of original SAM $i++ # increment number } # repeat while SAM exists # Now we have a unique SAM set any variable dependant on it $Email = $SAM + "@test.com" $UPN = $SAM + "@test.com" New-ADUser -Name "$Displayname" ` -DisplayName "$Displayname" ` -SamAccountName "$SAM" ` -UserPrincipalName "$UPN" ` -GivenName "$UserFirstname" ` -Surname "$Lastname" ` -Description "$Description" ` -AccountPassword (ConvertTo-SecureString $Password -AsPlainText -Force) -Enabled $true -ChangePasswordAtLogon $true -PasswordNeverExpires $false ` -Server test.com ` -Email "$Email" ` -Company "$Company" ` -homedrive "u:" -homedirectory \\servername\sharename\$SAM #-homedrive "u:" -homedirectory \\servername\sharename\%username% Get-ADUser $SAM | Move-ADObject -TargetPath "OU=Year 7,OU=Student,OU=Users,OU=BurtonBorough,DC=test,DC= com" Add-ADPrincipalGroupMembership $SAM students Add-ADPrincipalGroupMembership $SAM "All Years" # Add-ADPrincipalGroupMembership $SAM - Duplicate this line to add the user into more AD groups new-item "c:\users\$SAM" -ItemType Directory #This line can be replaced with the line below to determine the full unc path of the folder $acl = Get-Acl -Path "c:\users\$SAM" $permission = $SAM, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow' $permission2 = 'students', 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow' $permission3 = 'All Years', 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow' $rule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission $rule2 = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission2 $rule3 = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission3 $acl.AddAccessRule($rule) $acl.ADDAccessRule($rule2) $acl.ADDAccessRule($rule3) $acl | Set-Acl -Path "c:\users\$SAM" #new-item "\\servername\sharename\foldername" -ItemType Directory }
noelmm Posted April 28, 2017 Author Posted April 28, 2017 Hi, I have used the modified script and this time only 1 test user account was created and the Jake B account was created. I do receive a lot of errors now though so they may give some information as to what's not working Move-ADObject : An attempt was made to add an object to the directory with a name that is already in use At D:\V16 - Modified Code.ps1:98 char:19 + Get-ADUser $SAM | Move-ADObject -TargetPath "OU=Year 7,OU=Student,OU=Users,OU=Bu ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (CN=Test.User,CN=Users,DC=test,DC=com:ADUser) [Move-ADObject], ADException + FullyQualifiedErrorId : ActiveDirectoryServer:8305,Microsoft.ActiveDirectory.Management.Commands.MoveADObject d---- 28/04/2017 09:57 Test.User1 New-ADUser : An attempt was made to add an object to the directory with a name that is already in use At D:\V16 - Modified Code.ps1:72 char:1 + New-ADUser -Name "$Displayname" ` + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (CN=noel.m,CN=Users,DC=test,DC=com:String) [New-ADUser], ADException + FullyQualifiedErrorId : ActiveDirectoryServer:8305,Microsoft.ActiveDirectory.Management.Commands.NewADUser Get-ADUser : Cannot find an object with identity: 'noel.mFm' under: 'DC=test,DC=com'. At D:\V16 - Modified Code.ps1:98 char:1 + Get-ADUser $SAM | Move-ADObject -TargetPath "OU=Year 7,OU=Student,OU=Users,OU=Bu ... + ~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (noel.m:ADUser) [Get-ADUser], ADIdentityNotFoundException + FullyQualifiedErrorId : ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException,Microsoft.ActiveDirectory.Management.Commands.GetADUser Add-ADPrincipalGroupMembership : Cannot find an object with identity: 'noel.m' under: 'DC=test,DC=com'. At D:\V16 - Modified Code.ps1:100 char:1 + Add-ADPrincipalGroupMembership $SAM students + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (noel.m:ADPrincipal) [Add-ADPrincipalGroupMembership], ADIdentityNotFoundException + FullyQualifiedErrorId : SetADPrincipalGroupMembership:ProcessRecordOverride,Microsoft.ActiveDirectory.Management.Commands.AddADPrincipalGroupMembership Add-ADPrincipalGroupMembership : Cannot find an object with identity: 'noel.m' under: 'DC=test,DC=com'. At D:\V16 - Modified Code.ps1:101 char:1 + Add-ADPrincipalGroupMembership $SAM "All Years" + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (noel.m:ADPrincipal) [Add-ADPrincipalGroupMembership], ADIdentityNotFoundException + FullyQualifiedErrorId : SetADPrincipalGroupMembership:ProcessRecordOverride,Microsoft.ActiveDirectory.Management.Commands.AddADPrincipalGroupMembership d---- 28/04/2017 09:57 noel.m Exception calling "AddAccessRule" with "1" argument(s): "Some or all identity references could not be translated." At D:\V16 - Modified Code.ps1:134 char:1 + $acl.AddAccessRule($rule) + ~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: ( [], MethodInvocationException + FullyQualifiedErrorId : IdentityNotMappedException d---- 28/04/2017 09:57 Jake.b New-ADUser : An attempt was made to add an object to the directory with a name that is already in use At D:\V16 - Modified Code.ps1:72 char:1 + New-ADUser -Name "$Displayname" ` + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (CN=noel.m,CN=Users,DC=test,DC=com:String) [New-ADUser], ADException + FullyQualifiedErrorId : ActiveDirectoryServer:8305,Microsoft.ActiveDirectory.Management.Commands.NewADUser Get-ADUser : Cannot find an object with identity: 'noel.m' under: 'DC=test,DC=com'. At D:\V16 - Modified Code.ps1:98 char:1 + Get-ADUser $SAM | Move-ADObject -TargetPath "OU=Year 7,OU=Student,OU=Users,OU=Bu ... + ~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (noel.m:ADUser) [Get-ADUser], ADIdentityNotFoundException + FullyQualifiedErrorId : ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException,Microsoft.ActiveDirectory.Management.Commands.GetADUser Add-ADPrincipalGroupMembership : Cannot find an object with identity: 'noel.m' under: 'DC=test,DC=com'. At D:\V16 - Modified Code.ps1:100 char:1 + Add-ADPrincipalGroupMembership $SAM students + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (noel.m:ADPrincipal) [Add-ADPrincipalGroupMembership], ADIdentityNotFoundException + FullyQualifiedErrorId : SetADPrincipalGroupMembership:ProcessRecordOverride,Microsoft.ActiveDirectory.Management.Commands.AddADPrincipalGroupMembership Add-ADPrincipalGroupMembership : Cannot find an object with identity: 'noel.m' under: 'DC=test,DC=com'. At D:\V16 - Modified Code.ps1:101 char:1 + Add-ADPrincipalGroupMembership $SAM "All Years" + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (noel.m:ADPrincipal) [Add-ADPrincipalGroupMembership], ADIdentityNotFoundException + FullyQualifiedErrorId : SetADPrincipalGroupMembership:ProcessRecordOverride,Microsoft.ActiveDirectory.Management.Commands.AddADPrincipalGroupMembership new-item : An item with the specified name C:\users\noel.m already exists. At D:\V16 - Modified Code.ps1:122 char:1 + new-item "c:\users\$SAM" -ItemType Directory #This line can be replaced with the ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ResourceExists: (C:\users\noel.m:String) [New-Item], IOException + FullyQualifiedErrorId : DirectoryExist,Microsoft.PowerShell.Commands.NewItemCommand Exception calling "AddAccessRule" with "1" argument(s): "Some or all identity references could not be translated." At D:\V16 - Modified Code.ps1:134 char:1 + $acl.AddAccessRule($rule) + ~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: ( [], MethodInvocationException + FullyQualifiedErrorId : IdentityNotMappedException csv import.txt I have attached the csv although I have had to save it as a text file as I couldn't upload a csv file. Thanks for all of the help and time you have put into this. Noel
pleach85 Posted April 28, 2017 Posted April 28, 2017 No problem. Check the Users OU as you'll probably spot some of the accounts in there. The problem was we were using the display name as the "name" parameter in the new-aduser cmd. Therefore when you then tried to move the new user into the year7 OU it couldn't as there was already an object with that name in the ou, i.e the previous one we'd created. The solution (hopefully)... use the unique SAM as the Name field, I've also added the path field to the command as you can just create the user in the OU you want, you don't have to create the user and them move them. ForEach ($User in $Users) { $Displayname = $User.Firstname + "." + $User.Lastname $UserFirstname = $User.Firstname $Lastname = $User.Lastname $OU = $User.OU $Description = $User.Description $Password = $User.Password $Company = "schoolname" $SAM = $User.Firstname + "." + $User.Lastname # create SAM from first . last name $i = 1 # reset number to append variable $originalSAM = $SAM # keep the original SAM in a separate variable (easier to increment number) while((Get-ADUser -Filter {sAMAccountName -eq $SAM}) -ne $null){ # check if SAM exists $SAM = $originalSAM + $i.ToString() # If not add number to the end of original SAM $i++ # increment number } # repeat while SAM exists # Now we have a unique SAM set any variable dependant on it $Email = $SAM + "@test.com" $UPN = $SAM + "@test.com" New-ADUser -Name "$SAM" ` -DisplayName "$Displayname" ` -SamAccountName "$SAM" ` -UserPrincipalName "$UPN" ` -GivenName "$UserFirstname" ` -Surname "$Lastname" ` -Description "$Description" ` -AccountPassword (ConvertTo-SecureString $Password -AsPlainText -Force) -Enabled $true -ChangePasswordAtLogon $true -PasswordNeverExpires $false ` -Server test.com ` -Email "$Email" ` -Company "$Company" ` -homedrive "u:" -homedirectory \\servername\sharename\$SAM ` -path "OU=Year 7,OU=Student,OU=Users,OU=BurtonBorough,DC=test,DC= com" #-homedrive "u:" -homedirectory \\servername\sharename\%username% #Get-ADUser $SAM | Move-ADObject -TargetPath "OU=Year 7,OU=Student,OU=Users,OU=BurtonBorough,DC=test,DC= com" Add-ADPrincipalGroupMembership $SAM students Add-ADPrincipalGroupMembership $SAM "All Years" # Add-ADPrincipalGroupMembership $SAM - Duplicate this line to add the user into more AD groups new-item "c:\users\$SAM" -ItemType Directory #This line can be replaced with the line below to determine the full unc path of the folder $acl = Get-Acl -Path "c:\users\$SAM" $permission = $SAM, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow' $permission2 = 'students', 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow' $permission3 = 'All Years', 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow' $rule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission $rule2 = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission2 $rule3 = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $permission3 $acl.AddAccessRule($rule) $acl.ADDAccessRule($rule2) $acl.ADDAccessRule($rule3) $acl | Set-Acl -Path "c:\users\$SAM" #new-item "\\servername\sharename\foldername" -ItemType Directory }
noelmm Posted April 28, 2017 Author Posted April 28, 2017 Hi, That worked, all of the user accounts are now being created along with all folders and permissions assigned. Thanks for all of the help you have given, I'm now going to through the script to fully understand and learn the changes you put in and why they work. Noel
pleach85 Posted April 28, 2017 Posted April 28, 2017 No problem, glad we've got there in the end. If you can't follow any of it let me know and I'll try and explain. Peter
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now