Powershell AD / Homedir / Profiledir / Mailbox?

[mdench]

Have had a nose around several different posts to do with powershell and creating users from a CSV. I think i got the basic sorted ie Name, Surname, Username, Password, Enabled account. I'm wondering if i can use powershell to populate the home directory and profile directory along with the employee ID attribute? then after all that is it possible to have the script create exchange mailboxes or is that pushing it to far?

 

Cheers for the help

[old_n07]

You can use the script to create the folder and set the path and drive letter in AD

 

We use this to create the users home folder with a hidden "redirected" folder in the home folder ($userhomfolder is a variable for the folder path)

 

           # Create folders ------


           if(Test-Path $userhomefolder){}

           else

           {
           New-Item $userhomefolder -type directory
           New-Item $redirected -type directory
           Set-ItemProperty -path $redirected -name Attributes -Value ([system.IO.FileAttributes]::Hidden)
           }

 

To set the folder path and drive letter in AD

 

           Set-ADUser $username `
                      -HomeDirectory $userhomefolder `
                      -HomeDrive "H:" `
                      -ProfilePath $userprofilefolder `

 

Setting permissions on the created folders

 

# Set folder permissions ----------------------------------------------------------------------------------------

           $FC = "FullControl"
           $Mod = "Modify"

           #Users--

           $domAdmin = $Shortdom + "domain admins"
           $locadmin = "builtin\Administrators"
           $sys = "NT Authority\System"
           $user = $Shortdom + $username

           # Permissions on Home folder ---
                   
           $acl = Get-Acl $userhomefolder
           if ($acl.AreAccessRulesProtected) { $acl.Access | % {$acl.purgeaccessrules($_.IdentityReference)} }
           else {
           		$isProtected = $true 
           		$preserveInheritance = $false
           		$acl.SetAccessRuleProtection($isProtected, $preserveInheritance) 
           	 }

           $account1 = $domadmin
           $rights1=[system.Security.AccessControl.FileSystemRights]::$FC
           $inheritance1=[system.Security.AccessControl.InheritanceFlags]"ContainerInherit,ObjectInherit"
           $propagation1=[system.Security.AccessControl.PropagationFlags]::None
           $allowdeny1=[system.Security.AccessControl.AccessControlType]::Allow
           $dirACE1=New-Object System.Security.AccessControl.FileSystemAccessRule ($account1,$rights1,$inheritance1,$propagation1,$allowdeny1)
           $ACL.AddAccessRule($dirACE1)

           $account2 = $locadmin
           $rights2=[system.Security.AccessControl.FileSystemRights]::$FC
           $dirACE2=New-Object System.Security.AccessControl.FileSystemAccessRule ($account2,$rights2,$inheritance1,$propagation1,$allowdeny1)
           $ACL.AddAccessRule($dirACE2)

           $account3 = $sys
           $rights3=[system.Security.AccessControl.FileSystemRights]::$FC
           $dirACE3=New-Object System.Security.AccessControl.FileSystemAccessRule ($account3,$rights3,$inheritance1,$propagation1,$allowdeny1)
           $ACL.AddAccessRule($dirACE3)

           $account4 = $user
           $rights4=[system.Security.AccessControl.FileSystemRights]::$Mod
           $dirACE4=New-Object System.Security.AccessControl.FileSystemAccessRule ($account4,$rights4,$inheritance1,$propagation1,$allowdeny1)
           $ACL.AddAccessRule($dirACE4)

           Set-Acl -aclobject $ACL -Path $userhomefolder
           # Write-Host $userhomefolder Permissions added

           # Permissions on redirected folder ---

           $Racl = Get-Acl $redirected

           $account = $user
           $rights=[system.Security.AccessControl.FileSystemRights]::TakeOwnership
           $allowdeny=[system.Security.AccessControl.AccessControlType]::Allow
           $dirACE=New-Object System.Security.AccessControl.FileSystemAccessRule ($account,$rights,$allowdeny)
           $ACL.AddAccessRule($dirACE)

           Set-Acl -aclobject $ACL -Path $redirected
           # Write-Host $redirected Permissions added

 

To create the mailbox

 

           # Create Mailbox ----

           Enable-mailbox -Identity $username `
                                  -Alias $username `

Edited August 23, 2012 by old_n07

[mdench]

Is this all within one script?

[old_n07]

Yes, they are parts taken from one script

[mdench]

Just been working on this some more so im hoping that i have got below will take the details out of a CSV and create our new intake users in AD. Does this look correct so far?

 

import-Csv \\martha\intake07\mdench\intake12\one.csv | foreach-object {

$userhomefolder = '\\matrix\intake12\'+$_.SamAccoutName
$userprofilefolder = '\\matrix\profiles\intake12\'+$_.SamAccountName

New-ADUser  
           -SamAccountName $_.SamAccountName
           -DisplayName $_.SamAccountName 
           -GivenName $_.FirstName 
           -Surname $_.LastName 
           -EmployeeID $_.EmployeeID
           -Path "OU=Users,DC=domain,DC=internal" 
           -AccountPassword (ConvertTo-SecureString "google" -AsPlainText -force) 
           -Enabled $True 
           -ChangePasswordAtLogon $True -PassThru
           -HomeDirectory $userhomefolder
           -HomeDrive "N:"
           -ProfilePath $userprofilefolder                
            }

 

 

How do you use the enable-mailbox to create a new mailbox for each user? Does it need any extra code to connect to an exchange etc? or does it do something entirely different?

[old_n07]

Are you running your code on the DC or remotely?

 

If you want to run it remotely add this to the top of the script to create remote sessions to your DC and \ or exchange server

 

# Connect to exchange server
if ( (Get-PSSession -ComputerName email.someschool.ac.uk -ErrorAction SilentlyContinue) -eq $null)
{
$Sessemail = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://email.someschool.ac.uk/PowerShell/ -Authentication Kerberos
Import-PSSession $Sessemail
}

# Connect to DC
if ( (Get-PSSession -ComputerName DC.someschool.ac.uk -ErrorAction SilentlyContinue) -eq $null)
{
$SessDC02 = New-PSSession  -computername DC.someschool.ac.uk -Authentication Kerberos
Import-Module ActiveDirectory
}

 

The enable-mailbox commandlet needs Exchange 2007 or newer, as long as you have created a powershell session to the exchange server with your script you can run the command as part of the main script, you may need to put a 5 or 10 second wait into the script so the new account replicates to the exchange server or you may get an account not found error

 

Start-Sleep -s 5
Enable-mailbox -Identity $_.SamAccountName -Alias $_.SamAccountName -Database "ExchangeDatabaseName"  #creates the exchange account in the named exchange database.

[mdench]

This is now what we have for our Script but it is throwing up an error when connecting to the exchange

 

# Connect to exchange server
if ( (Get-PSSession -ComputerName exchange.domain.internal) -eq $null)
{
$Sessemail = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://exchange.domain.internal/PowerShell/ -Authentication Kerberos
Import-PSSession $Sessemail
}

# Connect to DC
if ( (Get-PSSession -ComputerName bex.domain.internal) -eq $null)
{
$SessDC02 = New-PSSession  -computername bex.domain.internal -Authentication Kerberos
Import-Module ActiveDirectory
}

import-Csv one.csv | foreach-object {

$UserName   = $_.SamAccountName
$FirstName  = $_.FirstName
$LastName   = $_.LastName
$EmployeeID = $_.EmployeeID

echo $UserName
echo $FirstName
echo $LastName
echo $EmployeeID

$userhomefolder = '\\matrix\intake12\'+$UserName
$userprofilefolder = '\\matrix\profiles\intake12\'+$UserName

New-ADUser -SamAccountName $UserName `
           -DisplayName $UserName  `
           -Name $UserName `
           -GivenName $FirstName  `
           -Surname $LastName  `
           -EmployeeID $EmployeeID `
           -AccountPassword (ConvertTo-SecureString "google" -AsPlainText -force)  `
           -Enabled $True  `
           -ChangePasswordAtLogon $True -PassThru `
           -HomeDirectory $userhomefolder `
           -HomeDrive "N:" `
           -ProfilePath $userprofilefolder `


#   -Path "OU=Users,DC=domain,DC=internal"  `
}
#Start-Sleep -s 5
#Enable-mailbox 
#            -Identity $_.SamAccountName 
#            -Alias $_.SamAccountName 
#            -Database "The Weald Exchange - Students Db1"  #creates the exchange account in the named exchange database.

 

This is the error

 

Get-PSSession : Remote Session is not available for exchange.domain.internal.
At C:\Users\msweet\memememememe.ps1:2 char:20
+ if ( (Get-PSSession <<<<  -ComputerName exchange.domain.internal) -eq $null)
   + CategoryInfo          : InvalidArgument: (exchange.domain.internal:String) [Get-PSSession], ArgumentException
   + FullyQualifiedErrorId : RemoteRunspaceNotAvailableForSpecifiedComputer,Microsoft.PowerShell.Commands.GetPSSessionCommand

[exchange.domain.internal] Connecting to remote server failed with the following error message : The WinRM client received an HTTP status code of 403 from the remote WS-Management service. For m
ore information, see the about_Remote_Troubleshooting Help topic.
   + CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [], PSRemotingTransportException
   + FullyQualifiedErrorId : PSSessionOpenFailed
Import-PSSession : Cannot validate argument on parameter 'Session'. The argument is null. Supply a non-null argument and try the command again.
At C:\Users\msweet\memememememe.ps1:5 char:17
+ Import-PSSession <<<<  $Sessemail
   + CategoryInfo          : InvalidData: ( [import-PSSession], ParameterBindingValidationException
   + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.ImportPSSessionCommand

 

Is there something really stupid I am missing? Powershell Novice... A quick google gave me this link Connect Remote Exchange Management Shell to an Exchange Server: Exchange 2010 Help

[old_n07]

That is basically the guide we followed, have you installe The Windows management framework on exchange and allowed port 80 through the firewall?

 

Is "exchange.domain.internal" the FQDN of your exchange server?

 

Edit:

 

As a test try disabling the server firewall and try running the script to see if it is a port issue.

Edited September 3, 2012 by old_n07

[glennda]

Exchange is easy for bulk creating from the console - all you need to do is select new and find all the users which havn't been given a mailbox yet (you can filter to whatever) and the just hit go

[emboha]

Import-Module ActiveDirectory
import-csv "c:\aduser3.csv"

# Import list of Users From CSV into $Userlist
$userlist=import-csv "c:\aduser3.csv"

# Step through Each Item in the List
FOREACH ($user in $UserList) { 
$user.GivenName
$user.Surname

# Build Username from First name and Last name
$Username=$user.GivenName + $user.Surname.substring(0)
$Username 

# Put our Domain name into a Placeholder
$Domain=’@sintvictor.local’

#specify the homefolder
$homedirectory="\\SVSERVER\Home$\$username"
$redirected="\\SVSERVER\Home$\redirected"

# Build the User Principal Name Username with Domain added to it
$UPN=$Username+$Domain

# Create the Displayname
$Name=$user.GivenName + ” “ + $user.Surname

if(Test-Path $homedirectory){}
           else

           {
           New-Item $homedirectory -type directory
           New-Item $redirected -type directory
           Set-ItemProperty -path $redirected -name Attributes -Value ([system.IO.FileAttributes]::Hidden)
           }

# Create User in Active Directory$($user.samaccountname)
new-ADUser –GivenName $user.GivenName –Surname $user.Surname –Name $Name –SamAccountName $Username –AccountPassword (ConvertTo-SecureString "abc123+" -AsPlaintext -Force) –UserPrincipalName $UPN –Path ‘OU=SVA,DC=sintvictor,DC=local’ -enabled $true -ChangePasswordAtLogon $true -Homedrive H: -HomeDirectory $homedirectory

}

 

 

 

 

Why isn't my H drive visible on the client? All the folders are getting created correctly....

thx