Bulk creating simple AD users...

[googlemad]

I'm out of touch with this, I used to import thousands and thousands of students in a former life but now I work in the NHS and am involved in one of these new Nightingale hospitals who wants 958584939 generic user accounts generating by the end of...well yesterday!

 

All I need to do is:

 

Full name / username : ABCUA001 / ABCUA002 / ABCUA003 etc

Password : Same for every account initially

 

Place in the ABC Users OU and add to an AD group if possible 'ABC-Users_Group' although if not no big drama as I can do that afterwards

 

Just to add the cherry to the top, the user accounts have a matching domain PC account, e.g. ABCUA001 would log in to ABCPCA001 and we would like to set these user accounts up so under Account > Log On To we would like to limit them to logging in to their matching (but differently named) PC account if that makes any sense whatsoever, not sure if that can somehow be scripted too when creating them

 

I feel embarrased asking this as I used to do it daily for 7 years in education, but my mind is well and truly frazzled after a weekend of trying to implement what would be a 3 year project in 3 days! :/

[3s-gtech]

I'm sure it can be Powershelled, but that's a foreign language to me. This could fairly easily be achieved with Wisesoft Account Management which just uses Excel and some clever scripting. Pre-create the user list in Excel, copy and paste it into the table, and set it off.

[jthompson]

This could fairly easily be achieved with Wisesoft Account Management which just uses Excel and some clever scripting. Pre-create the user list in Excel, copy and paste it into the table, and set it off.

 

Was just going to suggest that for creating the accounts.

 

For setting up the 'logon to' attributes for each account, you might be able to use Wisesoft's Bulk AD Users, which lets you do some nice bulk updating of accounts using CSV input. It may be a little complicated with the 'Logon to' attribute being one of the multi-valued things, but I reckon it ought to be doable.

[jthompson]

Just tested the logon workstations thing with Wisesoft Bulk AD Users. The CSV file you'll need goes like this:

 

sAMAccountName,userWorkstations
ABCUA001,ABCPCA001
ABCUA002,ABCPCA002
ABCUA003,ABCPCA001;ABCPCA002;ABCPCA003

 

The last line is an example of how you'd add multiple computer names for an account, if you need to (; separator).

 

You'd use that in Bulk AD Users by going Update -> CSV Update, picking your file and applying. It'll tell you if it ran into any errors (e.g. can't match a username, etc.).

Edited April 6, 2020 by jthompson

[djm968]

PowerShell

 

$Users = Import-Csv -Path "C:\Userlist-sn.csv"

foreach ($User in $Users)

{

$Displayname = $User.'Firstname' + " " + $User.'Lastname'

$UserFirstname = $User.'Firstname'

$UserLastname = $User.'Lastname'

$OU = $User.'OU'

$SAM = $User.'SAM'

$UPN = $User.'Firstname' + "." + $User.'Lastname' + "@" + $User.'Maildomain'

$Description = $User.'Description'

$Password = $User.'Password'

New-ADUser -Name "$Displayname" -DisplayName "$Displayname" -SamAccountName $SAM -UserPrincipalName $UPN -GivenName "$UserFirstname" -Surname "$UserLastname" -Description "$Description" -AccountPassword (ConvertTo-SecureString $Password -AsPlainText -Force) -Enabled $true -Path "$OU" -ChangePasswordAtLogon $false –PasswordNeverExpires $true -server domain.loc

}

 

CSV file format.

 

Firstname | Lastname | Maildomain | SAM | OU | Password | Description

 

User | Test01 | contoso.com | utest01 | OU=Standard Users,OU=Users,DC=domain,DC=loc | P@ssw0rd| Test User

[googlemad]

Absolutely fantastic! Thanks

[BlueScreen]

A day light, and slightly different from above, but without importing the details from a CSV file. Ripped from my script used to create and reset generic visitor accounts so I've not fully test the code (I had to anonymize and add the group / workstation parts). You will be prompted to enter and then confirm the password.

You might need to adjust the userPrincipalNameSuffix if your internal domain is different from your external / email domain

If you don't need to create a network home folder (probably not with 1:1 computers), remove or comment out the home folder and home drive lines.

Remember to test first.

 

 

import-module ActiveDirectory

$first = 0
$last = 0
$accountPrefix = ""
$logonWorkStationsPrefix = ""
$cannotChangePassword = $False
$ADPath = 'OU=path,OU=to,OU=Users,OU=ou,DC=example,DC=com'
$emailSuffix = 'example.com' 
$userPrincipalNameSuffix = $emailSuffix
$driveLetter = 'N'
$ADGroupName = 'AD_Group'

$users = @()

##### Add the accounts to the $users list. If the account doesn't exist, create it#####
##### Add or remove the 0s on the the toString line to adjust the leading 0s####
foreach ($number in $($first)..$($last)) {
   $number = $number.toString("00")
   $user = "$accountPrefix-$number"
   $userPrincipalName = "$user@$emailSuffix"
   try { 
       $users += Get-ADUser -Identity $user -ErrorAction Stop 
   }
   catch {
       $userDetails = @{
           DisplayName = $user
           GivenName = $accountPrefix
           Name = $user
           userPrincipalName = $userPrincipalName
           Surname = $number
           SamAccountName = $user
           Path = $ADPath
           EmailAddress = "$user@$userPrincipalNameSuffix"
           LogonWorkstations = "$logonWorkStationsPrefix$number"
       }
       New-ADUser @userDetails
       
       $ADUser = Get-ADUser -Identity $user 
       Add-ADGroupMember -Identity $ADGroupName -Members $ADUser
       
       #### Optional
       #Sets their home directory
       Get-ADUser -Identity $user -Properties HomeDirectory | Set-ADObject -replace @{HomeDirectory="\\Server\Share$\Folder\$($user.Name)\Homefolder"}
       Get-ADUser -Identity $user -Properties HomeDrive | Set-ADObject -replace @{HomeDrive="$driveLetter`:"}
       #### end optional

       $users += Get-ADUser -Identity $user
   }
}

##### Get password to set the initial password of the accounts
do {
   $Password = Read-Host "Password" -AsSecureString
   $Compare = Read-Host "Re-enter Password" -AsSecureString
   }##### Compare the two entries. The backtick ` allows the comparison to be on 2 lines, the -cne makes it case sensitive ######
   while ([Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($Password))`
   -cne [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($Compare)))
$Compare = $null

#####Set Password and optionally set Cannot change own password, and password expiry
foreach($user in $users){ 
   Get-ADUser $user | Set-ADAccountPassword -NewPassword $Password -Reset
   $passwordDetails = @{
       ChangePasswordAtLogon = !$cannotChangePassword
       CannotChangePassword = $cannotChangePassword
       PasswordNeverExpires = $cannotChangePassword
   }
   Get-ADUser $user | Set-ADUser @passwordDetails
}

#######Enable the accounts
foreach($user in $users){
   Enable-ADAccount $user
}

Edited April 8, 2020 by BlueScreen