Problem with home directory on AD

[swpmre]

Hi all,

I've got a script that creates active directory users from a CSV file. It's based on a pretty standard script that I've found here.

 

The script works fine, the accounts are created with all the right information and the script also creates the home folder properly and assigns the permissions that the script wants.

 

The problem is that when I logon with the new account I cannot see the Home folder, until I go into the user on AD and force it to change the permissions on the home folder by making a minor edit to the Home folder path on the Profile tab, and changing it back, then pressing Apply.

 

This then adds a new line of security permissions to the folder (see attachment) identical to that which has been created by the script - now the H drive is visible. I must have an error somewhere, but I cannot see what it is. Any ideas anyone?

 

 

The script is below:

Import-Module ActiveDirectory

 

$Domain="@maes.prv"

 

$UserOu="OU=DigitalSkillsStudents,DC=maes,DC=prv"

 

$NewUsersList=Import-CSV "C:\import\new_ds_users.csv"

 

ForEach ($User in $NewUsersList) {

 

$FullName=$User.FullName

 

$Company=$User.company

 

$Department=$User.department

 

$Description=$User.description

 

$givenName=$User.givenName

 

$title=$User.title

 

$City=$User.City

 

$telephoneNumber=$User.telephoneNumber

 

$sAMAccountName=$User.sAMAccountName

 

$sn=$User.sn

 

$userPrincipalName=$User.sAMAccountName+$Domain

 

$userPassword=$User.Password

 

$HomeDrive=$User.HomeDrive

 

# $HomeDirectory="\\maes.prv\dfs\StudentHome\$($user.sAMAccountname)"

$HomeDirectory = "\\maes-data\StudentHomeFolders\{0}" -f $user.sAMAccountname

 

$homeShare = "Home share path"

 

$expire=$null

 

New-ADUser -PassThru -Path $UserOu -Enabled $True -ChangePasswordAtLogon $True -AccountPassword (ConvertTo-SecureString $userPassword -AsPlainText -Force) -CannotChangePassword $False -City $City -Company $Company -Department $Department –title $title –OfficePhone $telephoneNumber -DisplayName $FullName -GivenName $givenName -Name $FullName -SamAccountName $sAMAccountName -Surname $sn -UserPrincipalName $userPrincipalName -HomeDrive $HomeDrive -HomeDirectory $HomeDirectory

 

$user2 = Get-ADUser $user.sAmAccountName

 

$fullpath = "\\maes-data\StudentHomeFolders\{0}" -f $user.sAMAccountname

$homeShare = New-item –path $fullPath -ItemType Directory -force -ea Stop

 

$acl = Get-Acl $homeShare

$FileSystemRights = [system.Security.AccessControl.FileSystemRights]"FullControl"

$AccessControlType = [system.Security.AccessControl.AccessControlType]::Allow

$InheritanceFlags = [system.Security.AccessControl.InheritanceFlags]"ContainerInherit, ObjectInherit"

$PropagationFlags = [system.Security.AccessControl.PropagationFlags]"NoPropagateInherit"

$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule ($User2.SID, $FileSystemRights, $InheritanceFlags, $PropagationFlags, $AccessControlType)

$acl.AddAccessRule($AccessRule)

Set-Acl -Path $homeShare -AclObject $acl -ea Stop

}

[swpmre]

I've worked it out.

I'm missing a Set-AdUser command. I assume this forces the new AD user to have set the permissions. However it works I've got it working by adding

 

Set-ADUser $User2 -HomeDrive $DriveLetter -HomeDirectory $fullpath -ea Stop

 

before the Get-Acl line.