Active directory tool for adding users

[steveo2000]

Hello,

 

I’m wondering if anyones got any suggestions for a simple tool that we can use to add users to active directory?

 

I’d like to be able to setup templates so that the team have a simple way of adding the user to the correct OU and additionally adding the correct security groups to the added user.

 

It’s to try and avoid user error when adding users onto the system. Bulk creation would be good to this would avoid the use of power shell.

 

Thanks

[3s-gtech]

There are lots of different systems for this. I did use a legacy system called https://wisedataman.com/account-management-spreadsheet and only stopped when we moved to Salamander, as it saves me so much time.

 

The spreadsheet system worked great for years - I used it from 2008 to 2020.

[FN-GM]

I have made my own tools using Powershell.

 

However, in the past I have used the above and it was great. I used it to move thousands of users from one domain to another. It was a god send!

[Jcx500]

Used this when in education a awesome network management tool

 

https://www.burconix.com/software/overview

 

Currently use our own powershell module on our AD platform to create / import users

[kevin_lane]

If you can look at salamander

[Norphy]

It might be like using a sledgehammer to crack a walnut, but ADManager Plus from ManageEngine is good:

 

https://www.manageengine.com/products/ad-manager/

[NeeeeeeT]

I am getting an access denied when I try and Add User using the spreadsheet, can anyone offer any ideas...? Thanks

 

EDIT

 

I need the adssecurity.dll anyone know where I can get a safe copy?

Edited November 7, 2022 by NeeeeeeT

[Davit2005]

At a previous employment setup and used PowerShell to process a CSV outputted from the MIS. We did have the advantage that we had a inhouse DB admin who could work with the MIS system database. This worked for both Staff and students. Many years back we used access DB to manipulate the fields.

 

The PowerShell was the most seamless and used to email me when it had ran and/or if it failed to create AD accounts. It was in a college so there was a big yearly intake of students and worth spending the time and effort to get it to work. For staff it added them to the correct groups from the CSV file.

 

At the end of the day you are going to get user/human error at some point even down to HR not typing the name correctly. So is it worth spending the effort to fully automate it is down to you.

[jezi55]

+1 for Salamander as it just works in the background. We use another app on a different site called DMS Netflow which I can highly recommend as well, costs about £1k a year and you get the Onedrive connect plugin as well.

[bknaggs]

The Solarwinds Active Directory tools are pretty good too.

https://www.solarwinds.com/free-tools/active-directory-admin-tools-bundle/registration

[kennysarmy]

Hello,

 

I’m wondering if anyones got any suggestions for a simple tool that we can use to add users to active directory?

 

I’d like to be able to setup templates so that the team have a simple way of adding the user to the correct OU and additionally adding the correct security groups to the added user.

 

It’s to try and avoid user error when adding users onto the system. Bulk creation would be good to this would avoid the use of power shell.

 

Thanks

 

How about this : https://dovestones.com/active-directory-user-import/

[jthompson]

I am getting an access denied when I try and Add User using the spreadsheet, can anyone offer any ideas...? Thanks

 

EDIT

 

I need the adssecurity.dll anyone know where I can get a safe copy?

 

Still have a copy of that dll so PM me if you need.

 

IIRC that dll is only required for setting user area permissions, so if you leave that part out, the spreadsheet should still work for everything else.

 

You'd obviously then have to set user area permissions some other way. A useful goto tool for doing that in bulk via GUI is NTFSFix. Again, that's quite an old tool but can be made to work.

.NET 2.0 is required to run NTFSFix (enable .NET 3.5 in Windows to get support for 2.0). The original installer requires .NET 1.1 so can no longer be run. However, if you extract the program's executable from the MSI and run that using dot NET 2.0, without any installation, you're good.

 

msiexec /a c:\setup.msi /qb TARGETDIR=c:\temp\test

 

Run NTFSFix as an admin to avoid crashes when applying permissions.

[NeeeeeeT]

Solarwinds is what I've always used previously but now it isnt taking PAsswords and refuses to map networked home folders. ��

 

My power shell knowledge is 0 and as we're a Primary we can't be spending £1k a year on Salmander or other such software.

 

Thanks for all responses, if anyone has a power shell script that creates users with home folders please feel free to share. I wouldn't be adverse to learning...

 

Neil

[LeMarchand]

Solarwinds is what I've always used previously but now it isnt taking PAsswords and refuses to map networked home folders.

 

I use Solarwinds here and set up the new intake this year with passwords and home folders.

[NeeeeeeT]

on mine all the passwords are blank even though they are set in the CSV and home folders are created but doesn't apply permissions. When I looked on forum others had said similar with no solutions...

[LeMarchand]

Hmmmm... Not likely to have time this week, but will try to create a fake user via Solarwinds when I do. Our home folders are \\SERVER\Students$\StudentName\Documents. You can select all newbies and map to \\SERVER\Students$\StudentName and Apply then append the \Documents. Doesn't help with the passwords in your case, though.

[jthompson]

Thanks for all responses, if anyone has a power shell script that creates users with home folders please feel free to share. I wouldn't be adverse to learning...

 

Neil

 

I recently did this, cobbling together enough PowerShell to automate the provisioning (and deprovisioning) of our student accounts. It was a really interesting and rewarding learning curve.

 

My advice would be to start by looking at the New-ADUser cmdlet and working out which parameters you're going to need for a creating a student account, and then build out step by step from there. Learn about creating functions that use parameter sets (good info here), so that you can have a function to, say, generate a username according to whatever username convention you use.

 

Creating user folders is easy (New-Item cmdlet), but I discovered that updating its permissions was surprisingly fiddly.

[jthompson]

Not wanting to share much of my PowerShell stuff because a decent amount of it is going to be speecific to how things are structured here, but here's how you would have a script take either a CSV file as input or individual values from the command line.

 

[CmdletBinding(DefaultParameterSetName = 'Manual')]
param(
   [Parameter(Mandatory, ParameterSetName = 'CSV')]
   [string] $InputFile,
   [Parameter(Mandatory, ParameterSetName = 'Manual')]
   [string] $FirstName,
   [Parameter(Mandatory, ParameterSetName = 'Manual')]
   [string] $LastName,
   [Parameter(Mandatory, ParameterSetName = 'Manual')]
   [string] $YearGroup
)

if ($PSCmdlet.ParameterSetName -eq 'CSV') {
   # CSV file provided by command line argument, with column headings of e.g. forename, surname, yeargroup.
   $Users = Import-CSV $InputFile
   foreach ($User in $Users)
   {
       # Create a user account based on $User.forename $User.surname and $User.yeargroup
   }
}
else {
   # Values are being provided directly from command line.
   # Create a user account based on $FirstName $LastName and $YearGroup
}

 

So you would run either "MyScript.PS1 -InputFile somestudents.csv" or run it without any parameters and be prompted for a first name, last name and year group to make a single user.

[LeMarchand]

Hmmmm... Not likely to have time this week, but will try to create a fake user via Solarwinds when I do. Our home folders are \\SERVER\Students$\StudentName\Documents. You can select all newbies and map to \\SERVER\Students$\StudentName and Apply then append the \Documents. Doesn't help with the passwords in your case, though.

 

Had a quick play, password seemed to be fine but I had to use the above method to create the home folder. Solarwinds seemed to map the drive letter and the folder but not create it.

[browolf]

this is my bulk creation script - I'm sure it could be condensed - I've noticed some things.

 

 

$thisyear = "2022"
$inputf = "sims$($thisyear).csv"
$output = "$($thisyear).csv"

if (test-path -Path ".\$($output)"){
   remove-item $output
}


function Get-Pass {
   #set arrays of words
   $colours = @('Wild','Bright','Busy','Green','Blue','Purple','Pink','Clever', "Cold","Happy","Sleepy","Brave","Short","Tall", "Helpful", "Clean", "Cute", "Super", "Sporty", "Silver", "Gold", "Fast")
   $animals = @('goat','elephant','penguin','donkey','snake','horse','rabbit','shark','mouse','tiger', 'zebra', 'panda', 'cabbage', 'potato', 'whale', 'bear', 'pencil', 'tree', 'fish', "frog", "toad")
   #make new password
   $col = Get-Random -InputObject $colours
   $ani = Get-Random -InputObject $animals
   return "1" + $col + $ani
}

import-csv $inputf | ForEach-Object {
   $password = Get-Pass
   $securepass = ConvertTo-SecureString -String $password -AsPlainText -Force
   #write-output "Processing $($_.firstName) $($_.surName)"
 
   #remove non characters
   $pattern="[^a-zA-Z]"
   $firstname = $_.firstName -replace $pattern
   $surname = $_.surName -replace $pattern
   $office = $_.adno

  
   #construct username
   $username = "$(get-date -Format 'yy')$($firstname.substring(0,1))$($surname)"
   $res = ([ADSISearcher] "sAMAccountName=$username").FindOne()

   #if use name exists  = bad
   if ($res -ne $null) {
       #need to find an acceptable username
       $prefix=2

       while ($true) {
           $testuser = $username + $prefix
           #write-output ("testing $($testuser)")
           $res = ([ADSISearcher] "sAMAccountName=$testuser").FindOne()
           if ($res -ne $null) {
               #bad
               $prefix++}
           else {
               $username = $testuser
               break

           }    
       }
   } 
   
   $Displayname = "$($_.firstName) $($_.surName)"
   #test if CN name exists 
   $res = ([ADSISearcher] "cn=$displayname").FindOne()

   #if displayname exists
   if ($res -ne $null) {
       #need to find an acceptable display name
       $prefix=2

       while ($true) {
           $testdisplayname = $displayname + $prefix
           #write-output ("testing $($testuser)")
           $res = ([ADSISearcher] "cn=$testdisplayname").FindOne()
           if ($res -ne $null) {
               #bad
               $prefix++}
           else {
               $displayname = $testdisplayname
               break

           }    
       }
   } 



   
   #fields
   $email = "$($username)@schooldomain".ToLower() 
   $homedirectory = "\\pupilserver\share$\$($username)"
   $samaccountname = "$($username)".ToLower()
   

  
   $error.clear()
   try {New-ADUser -name $Displayname `
       -AccountPassword $securepass `
       -AccountNotDelegated $false `
       -Description "Year starting $($thisyear)" `
       -DisplayName $Displayname `
       -EmailAddress $email `
       -GivenName $_.firstName `
       -Surname $_.surName `
       -HomeDirectory $homedirectory `
       -HomeDrive "Z:" `
       -PasswordNeverExpires $false `
       -SamAccountName $samaccountname `
       -UserPrincipalName $email `
       -Office $office `
       -path "OU=Azure,OU=pupils,DC=school" `
       -enabled $true `
       -scriptPath "pupilscript.bat"
       }
   catch {
       write-output "Error adding $($firstname) $($surname)"
       Write-Output $error
       exit
   }

   #adduser to 365 students
   $error.Clear()
   try {
       Add-ADGroupMember -identity "365Students" -members $samaccountname
   } catch {
       Write-Output "Error adding user to 365Students"  
   }

   #adduser to allstudentsecurity
   $error.Clear()
   try {
       Add-ADGroupMember -identity "allstudentsecurity" -members $samaccountname
   } catch {
       Write-Output "Error adding user to allstudentsecurity"  
   }

   #adduser to allstudentTeam
   $error.Clear()
   try {
       Add-ADGroupMember -identity "AllStudentTeam" -members $samaccountname
   } catch {
       Write-Output "Error adding user to AllStudentTeam"  
   }


   #create folder
   $User = Get-ADUser -Identity $samaccountname
   $homeshare = new-item -path $homedirectory -ItemType Directory -Force
   $acl = Get-Acl $homeshare
   $FileSystemRights = [system.Security.AccessControl.FileSystemRights]"Modify"
   $AccessControlType = [system.Security.AccessControl.AccessControlType]::Allow
   $InheritanceFlags = [system.Security.AccessControl.InheritanceFlags]"ContainerInherit, ObjectInherit"
   $PropagationFlags = [system.Security.AccessControl.PropagationFlags]"InheritOnly"
   $AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule ($User.SID, $FileSystemRights, $InheritanceFlags, $PropagationFlags, $AccessControlType)
   $acl.AddAccessRule($AccessRule)

   try { Set-Acl -Path $homeShare -AclObject $acl }
   catch { write-output "Error creating $($homeshare): $($error)"}

   If (!$error) {write-output "$homedirectory created"}
   
   Write-Output "Name: $($_.firstName) $($_.surName),Username:$($username) Password:$($password) Email: $($email) "

   $userOBJ = New-Object -TypeName psobject -Property @{
       'firstname' = $_.firstName
       'surname' = $_.surName
       'username' = $samaccountname
       'password' = $password
       'email' = $email
       #'form' = $_.form
       'cclass' = $_.cclass
   }

   $userOBJ | Export-Csv $output -Append -NoTypeInformation



}

[NicholasEsping]

Solarwinds is what I've always used previously but now it isnt taking PAsswords and refuses to map networked home folders. ��

 

My power shell knowledge is 0 and as we're a Primary we can't be spending £1k a year on Salmander or other such software.

 

Thanks for all responses, if anyone has a power shell script that creates users with home folders please feel free to share. I wouldn't be adverse to learning...

 

Neil

Here is the PowerShell I use to create new accounts from a CSV file. I don't use home drives, but I did add it to the script for you.

Import-Module activedirectory

#Store the data from ADUsers.csv in the $ADUsers variable
$ADUsers = Import-csv "C:\oneroster\newadaccounts.csv"

#Loop through each row containing user details in the CSV file
foreach ($User in $ADUsers)
{    
#Read user data from each field in each row and assign the data to a variable as below

   $Firstname  = $User.givenName
   $Lastname   = $User.familyName
   $Username   = $User.username
   $Password   = $User.password
   $OU         = $User.ou#This field refers to the OU the user account is to be created in
   $userprincipalname = $user.email
   $displayname = $user.displayname
   $jobtitle = $user.jobtitle
   $department = $user.department
   $Group = "Students"
   $homedrive = $user.homedrive  
   

   #Check to see if the user already exists in AD
   if (Get-ADUser -F {SamAccountName -eq $Username})
   {
        #If user does exist, give a warning
        Write-Warning "A user account with username $Username already exist in Active Directory."
   }
   else
   {
       Write-host
        #User does not exist then proceed to create the new user account
       #Account will be created in the OU provided by the $OU variable read from the CSV file
   New-ADUser -Name $displayname -SamAccountName $Username -UserPrincipalName $userprincipalname  -GivenName $Firstname -Surname $Lastname -Enabled $True -DisplayName $displayname -EmailAddress $userprincipalname -Description $jobtitle -Title $jobtitle -Department $department -HomeDrive $homedrive -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -changepasswordatlogon $true -Path "$OU"
   Get-ADUser -Identity $displayname | %{set-aduser -identity $_ -add @{proxyaddresses = ("SMTP:"+$userprincipalname)};}
   Get-ADUser -Identity $displayname | %{set-aduser -identity $_ -add @{targetaddress = ("SMTP:"+$userprincipalname)}; write-host account has been created for $displayname}
   Add-ADGroupMember -Identity $Group -Members $username    }} #end function

[jthompson]

Our student username convention includes the cohort intake year (calendar year in which that cohort started at the school), whereas our MIS report for new starters will include the year group (year 10, year 11, etc.). To generate a username, I wrote the following couple of PowerShell functions. Get-CohortIntakeYear computes a student's cohort intake year, based on their current year group and the current date. The $baseYearGroup value will need to be set to whatever year group your school starts at (e.g. year 7).

 

The Generate-StudentUsername function then makes use of the ouput of that in constructing a username. This function would obviously need to be adapted to whatever username convention you need it to produce.

 

# Function to compute cohort's intake year from it's current year group.
# Returns an integer value of the intake year (yyyy).
# Year group for a cohort is year 9, year 10, etc. and will therefore change over time for a particular cohort.
# Intake year is the year that a cohort would have first started attending the school, so will therefore not change over time.
function Get-CohortIntakeYear {
   [CmdletBinding()]
   param(
       [Parameter(Mandatory)]
       [ValidateSet(7,8,9,10,11,12,13,14)]
       [int] $YearGroup
   )
   [int]$baseYearGroup = 7 # lowest year group in the school.
   [int]$month = Get-Date -Format MM
   [int]$year = Get-Date -Format yyyy
   if ($month -gt 8) {
       # August to December
       $cohortIntakeYear = $year - ($YearGroup - $baseYearGroup)
   } else {
       # January to July
       $cohortIntakeYear = $year - 1 - ($yeargroup - $baseYearGroup)
   }
   return $cohortIntakeYear
}

 

# Function to generate a student username.
# Takes as input a student's first name, last name, admission number and cohort intake year.
# Returns a string which is the username.
# Username convention is {cohort intake year (2 digits)}{legal surname (12 chars, spaces removed)}{legal forename (1 char)}{admission number (last 2 chars)}
function Generate-StudentUsername {
   [CmdletBinding()]
   param(
       [Parameter(Mandatory)]
       [string] $FirstName,
       [Parameter(Mandatory)]
       [string] $LastName,
       [Parameter(Mandatory)]
       [string] $AdmissionNumber,
       [Parameter(Mandatory)]
       [string] $cohortIntakeYear
   )

   # Remove any spaces from last name and then limit length to max 12 characters
   $LastNameNoSpace = $LastName -replace '\s',''
   if ($LastNameNoSpace.length -gt 12) {
       $LastNameTrunc = $LastNameNoSpace.substring(0,12)
   }
   else {
       $LastNameTrunc = $LastNameNoSpace
   }
   # Username is 2 digit intake year plus up to 12 chars of surname (after removing any spaces) plus first initial plus final two digits of the admission number.
   $username = $cohortIntakeYear.substring($cohortIntakeYear.length - 2) + $LastNameTrunc + $FirstName.substring(0,1) + $AdmissionNumber.substring($AdmissionNumber.length - 2)
   return $username
}