Link to home
Create AccountLog in
Active Directory

Active Directory

--

Questions

--

Followers

Top Experts

Avatar of higgsy
higgsy

script to create AD user accounts including exchange mailbox
Hi

I was wondereing if there is a script or somthing that will allow me to create Active Directory user accounts and their exchange mailboxes at the same time.

An example of one would be great. Our domain consists of 2 windows 2003 domain controllers and 2 exchange 2003 servers.

Thanks

Zero AI Policy

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.


ASKER CERTIFIED SOLUTION
Avatar of KellyCraigKellyCraig

Link to home
membership
Log in or create a free account to see answer.
Signing up is free and takes 30 seconds. No credit card required.
Create Account

Avatar of KellyCraigKellyCraig

Others will be along to help you specifically if those links dont provide you with what you need.

SOLUTION
Link to home
membership
Log in or create a free account to see answer.
Signing up is free and takes 30 seconds. No credit card required.

SOLUTION
Avatar of Toni UranjekToni UranjekšŸ‡øšŸ‡®

Link to home
membership
Log in or create a free account to see answer.
Signing up is free and takes 30 seconds. No credit card required.

SOLUTION
Link to home
membership
Log in or create a free account to see answer.
Signing up is free and takes 30 seconds. No credit card required.

here is answer :
This script will create and configure a user including an Exchange mailbox, create and share home directory (with permissions) and put a user into AD groups.

It requires user input for user initials and a couple of other fields, but can easily be changed to read from a csv file.

'Option Explicit
Dim WshShell, fso
Set WSHShell = WScript.CreateObject("WScript.Shell")
Set fso = CreateObject("Scripting.FileSystemObject")
Set WshNetwork = WScript.CreateObject("WScript.Network")

DomainName = "EnterYourDomainName.com"
OUNamePt1 = "Windows 2000 Users"
OUNamePt2 = "Tunbridge Wells Users"
DefaultPassword = "EnterYourDefaultPassword"
Set dom = GetObject("LDAP://" &Ā DomainName)
InputPrompt1 = "Domain = "&DomainName&vbCrLf&"Container = "&OUName&vbCrLf&vbCrLf&"Enter Users Initials:"
InputPrompt2 = "Domain = "&DomainName&vbCrLf&"Container = "&OUName&vbCrLf&vbCrLf&"Enter Users First Name:"
InputPrompt3 = "Domain = "&DomainName&vbCrLf&"Container = "&OUName&vbCrLf&vbCrLf&"Enter Users Surname:"
InputPrompt4 = "Domain = "&DomainName&vbCrLf&"Container = "&OUName&vbCrLf&vbCrLf&"Enter Users Job Title:"
'InputPrompt5 = "Domain = "&DomainName&vbCrLf&"Container = "&OUName&vbCrLf&vbCrLf&"Please Enter F for Fee Earner or N for Non Fee Earner:"
UserName = InputBox(InputPrompt1, "UserInitials")
FirstName = InputBox(InputPrompt2, "FirstName")
Surname = InputBox(InputPrompt3, "Surname")
Department = InputBox(InputPrompt4, "Job Title")
UserStatus = WshShell.popup("Is this user a Fee Earner",,"User Type",4)
Set usr = dom.Create("user", "CN=" &Ā Surname &Ā ", "Ā & FirstName &Ā ",OU=" &Ā OUNamePt1 &Ā ",OU=" &Ā OUNamePt2)
Set ProfileServer = fso.GetFolder("EnterYourFileServerhome$")

'Create User
usr.put "samAccountName", LCase(UserName)
usr.put "userPrincipalName", FirstName &Ā "." &Ā Surname &Ā "@" &Ā DomainName
usr.put "givenName", FirstName
usr.put "sn", Surname
usr.put "displayName", Surname &Ā ", "Ā & FirstName
usr.put "initials", LCase(Mid(UserName,2,1))
usr.put "description", Department
usr.put "homeDirectory", "EnterYourFileServer" &Ā LCase(UserName) &Ā "$"
usr.put "homeDrive", "H:"
usr.put "profilePath", "EnterYourFileServerprofile$" &Ā LCase(UserName)
usr.setinfo
usr.setpassword DefaultPassword
usr.accountdisabled = False
usr.setinfo

'Create Users Mailbox
Dim oIADSUser
Dim MStore
strDefaultNC = "DC=EnterYourDomainName,DC=com"
Set oIADSUser = GetObject("LDAP://CN=" &Ā Surname &Ā ", "Ā & FirstName &Ā ",OU=Windows 2000 Users,OU=Tunbridge Wells Users,DC=EnterYourDomainName,DC=com")

If UCase(Right(Username,1)) <= Chr(76) Then
Ā MStore = "Mailboxes A-L"
Else
Ā MStore = "Mailboxes M-Z"
End If

oIADSUser.CreateMailbox "LDAP://CN=" &Ā MStore &Ā ",CN=First Storage Group,CN=InformationStore,CN=EnterYourMailServer,CN=Servers,CN=EnterYourAdminGroup,CN=Administrative Groups,CN=EnterYourSMTPOrganisationName,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=EnterYourDomainName,DC=com"
oIADSUser.SetInfo

'Add member to groups
Const ADS_PROPERTY_APPEND = 3

Set objGroup = GetObject("LDAP://CN=Docs_Users,CN=Users,DC=EnterYourDomainName,DC=com")
objGroup.PutEx ADS_PROPERTY_APPEND, "member", Array("CN=" &Ā Surname &Ā ", "Ā & FirstName &Ā ",OU=Windows 2000 Users,OU=Tunbridge Wells Users,DC=EnterYourDomainName,DC=com")
objGroup.SetInfo

Set objGroup = GetObject("LDAP://CN=SuperScout All Users,CN=Users,DC=EnterYourDomainName,DC=com")
objGroup.PutEx ADS_PROPERTY_APPEND, "member", Array("CN=" &Ā Surname &Ā ", "Ā & FirstName &Ā ",OU=Windows 2000 Users,OU=Tunbridge Wells Users,DC=EnterYourDomainName,DC=com")
objGroup.SetInfo


If UserStatus = vbYes Then
Ā Set objGroup = GetObject("LDAP://CN=Fee Earners,CN=Users,DC=EnterYourDomainName,DC=com")
Ā objGroup.PutEx ADS_PROPERTY_APPEND, "member", Array("CN=" &Ā Surname &Ā ", "Ā & FirstName &Ā ",OU=Windows 2000 Users,OU=Tunbridge Wells Users,DC=EnterYourDomainName,DC=com")
Ā objGroup.SetInfo
Ā UserStatus = WshShell.popup("Is this user a Trainee Solicitor",,"User Type",4)
Ā 
Ā If UserStatus = vbYes Then
Ā  Set objGroup = GetObject("LDAP://CN=All Solicitors,OU=Exchange Mailing Lists,OU=Tunbridge Wells Users,DC=EnterYourDomainName,DC=com")
Ā  objGroup.PutEx ADS_PROPERTY_APPEND, "member", Array("CN=" &Ā Surname &Ā ", "Ā & FirstName &Ā ",OU=Windows 2000 Users,OU=Tunbridge Wells Users,DC=EnterYourDomainName,DC=com")
Ā  objGroup.SetInfo
Ā End If
Else
Ā UserStatus = WshShell.popup("Is this user a standard Non Fee Earner",,"User Type",4)

Ā If UserStatus = vbYes Then
Ā  Set objGroup = GetObject("LDAP://CN=Non Fee Earners,CN=Users,DC=EnterYourDomainName,DC=com")
Ā Else
Ā  UserStatus = WshShell.popup("Is this a member of IT",,"User Type",4)
Ā End If
End If

Wscript.quit

'Create users home directory
If fso.FolderExists(ProfileServer &Ā "" &Ā UserName) = False Then
Ā fso.CreateFolder(ProfileServer &Ā "" &Ā LCase(UserName))
Ā fso.CreateFolder(ProfileServer &Ā "" &Ā UserName &Ā "interface")
End If

'Share user home directory
AdminServer = "EnterYourAdminServer"
ShareName = LCase(Username) &Ā "$"
FolderName = "E:usershome" &Ā UserName
Set Services = GetObject("WINMGMTS:{impersonationLevel=impersonate,(Security)}!" &Ā AdminServer &Ā "ROOTCIMV2")
Set SecDescClass = Services.Get("Win32_SecurityDescriptor")
Set SecDesc = SecDescClass.SpawnInstance_()
Set Share = Services.Get("Win32_Share")
Set InParam = Share.Methods_("Create").InParameters.SpawnInstance_()
InParam.Properties_.Item("Access") = SecDesc
InParam.Properties_.Item("Description") = "Home Directory"
InParam.Properties_.Item("Name") = ShareName
InParam.Properties_.Item("Path") = FolderName
InParam.Properties_.Item("Type") = 0
Share.ExecMethod_"Create", InParam

If fso.FileExists("C:winntsystem32adssecurity.dll") = False Then
Ā fso.CopyFile("EnterYourFileServerinstallsoftwareadsiadssecurity.dll"),("c:winntsystem32")
Ā WshShell.Run("%comspec% /c regsvr32.exe /s C:winntsystem32adssecurity.dll")
Ā Wscript.sleep 50000
End If

ReplaceACL ProfileServer &Ā "" &Ā Username,"add(" &Ā UserName &Ā ":F)+add(domain admins:F)"

Set WshShell = Nothing
Set fso = Nothing
Set WshNetwork = Nothing
Set usr = Nothing
Set NewShare = Nothing
Set Services = Nothing
Set SecDescClass = Nothing
Set SecDesc = Nothing
Set Share = Nothing
Set InParam = Nothing
Set sec = Nothing
Set sd = Nothing
Set dacl = Nothing
Set ace = Nothing
Set oIADSUser = Nothing
Set objGroup = Nothing

MsgBox "The creation of user: "Ā & FirstName &Ā " "Ā & Surname &Ā VbCrLf &_
Ā  "has completed without error"


'Functions

'Set permissions on users home directory
Function ReplaceACL(foldernm, permspart)
Ā foldernm = ProfileServer &Ā "" &Ā Username
Ā If fso.FolderExists(foldernm)= False Then
Ā  MsgBox "Sorry this folder is not present on the server"
Ā Else
Ā  ChangeACLS foldernm, permspart, "REPLACE", "FOLDER"
Ā End If
End Function

'Edit ACLS of specified folder
Function ChangeAcls(FILE,PERMS,REDIT,FFOLDER)

Ā Const ADS_ACETYPE_ACCESS_ALLOWED = 0
Ā Const ADS_ACETYPE_ACCESS_DENIED = 1
Ā Const ADS_ACEFLAG_INHERIT_ACE = 2
Ā Const ADS_ACEFLAG_SUB_NEW = 9
Ā  Ā  Ā 
Ā Set sec = Wscript.CreateObject("ADsSecurity")
Ā Set sd = sec.GetSecurityDescriptor("FILE://" &Ā FILE)
Ā Set dacl = sd.DiscretionaryAcl

Ā If UCase(REDIT)="REPLACE" Then
Ā  For Each existingAce In dacl
Ā  dacl.removeace existingace
Ā  Next
Ā End If
Ā  Ā  Ā 
Ā 'break up Perms into individual actions
Ā cmdArray=split(perms,"+")
Ā  Ā 
Ā For x=0 to ubound(cmdarray)
Ā tmpVar1=cmdarray(x)
Ā If UCase(left(tmpVar1,3))="DEL" Then
Ā  ACLAction="DEL"
Ā Else
Ā  ACLAction="ADD"
Ā End If

Ā tmpcmdVar=left(tmpVar1,len(tmpVar1)-1)
Ā tmpcmdVar=right(tmpcmdVar,len(tmpcmdVar)-4)
Ā cmdparts=split(tmpcmdVar,":")
Ā nameVar=cmdparts(0)
Ā rightVar=cmdparts(1)

Ā If ACLAction="ADD" Then
Ā  If UCase(FFOLDER)="FOLDER" Then
Ā  Ā addace dacl, namevar, rightvar, ADS_ACETYPE_ACCESS_ALLOWED, ADS_ACEFLAG_SUB_NEW
Ā  Ā addace dacl, namevar, rightvar, ADS_ACETYPE_ACCESS_ALLOWED, ADS_ACEFLAG_INHERIT_ACE
Ā  Else
Ā  Ā addace dacl, namevar, rightvar, ADS_ACETYPE_ACCESS_ALLOWED,0
Ā  End If
Ā End If
Ā Next

Ā For Each ace in dacl
Ā  If instr(ucase(ace.trustee),"NT AUTHORITY") then
Ā  Ā newtrustee=right(ace.trustee, len(ace.trustee)-instr(ace.trustee, ""))
Ā  Ā ace.trustee=newtrustee
Ā  End If
Ā Next

Ā sd.DiscretionaryAcl = dacl
Ā sec.SetSecurityDescriptor sd

End Function

Function addace(dacl,trustee, maskvar, acetype, aceflags)
Ā ' add ace to the specified dacl
Ā Const RIGHT_READ = &H80000000
Ā Const RIGHT_EXECUTE = &H20000000
Ā Const RIGHT_WRITE = &H40000000
Ā Const RIGHT_DELETE = &H10000
Ā Const RIGHT_FULL = &H10000000
Ā Const RIGHT_CHANGE_PERMS = &H40000
Ā Const RIGHT_TAKE_OWNERSHIP = &H80000
Ā  Ā  Ā 
Ā Set ace = CreateObject("AccessControlEntry")
Ā ace.Trustee = trustee
Ā 
Ā Select Case UCase(MaskVar)
Ā Case "F"
Ā ace.AccessMask = RIGHT_FULL
Ā Case "C"
Ā ace.AccessMask = RIGHT_READ or RIGHT_WRITE or RIGHT_EXECUTE or RIGHT_DELETE
Ā Case "R"
Ā ace.AccessMask = RIGHT_READ or RIGHT_EXECUTE
Ā End Select

Ā ace.AceType = acetype
Ā ace.AceFlags = aceflags
Ā dacl.AddAce ace
End Function

Source : http://searchwincomputing.techtarget.com/tip/0,289483,sid68_gci1089792,00.html

Reward 1Reward 2Reward 3Reward 4Reward 5Reward 6

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.


Avatar of sunilswainsunilswainšŸ‡®šŸ‡³

When you manually create user accounts and mailboxes in Exchange 5.5, two possible scenarios exist. In one scenario, you create an NT user account, then create the mailbox. In the other scenario, you create an AD domain user account, then the Active Directory Connector (ADC) automatically creates the mailbox. In either case, Exchange 5.5 automatically assigns the user account SID to a mailbox attribute. When you use CrUM55 to programmatically create user accounts and mailboxes in Exchange 5.5, the script automatically creates the user account and mailbox. CrUM55 uses the user account SID that NT or AD creates to link the account and mailbox.

Before running CrUM55, you need to perform three minor tasks on the client computer on which you intend to run the script. First, you must make sure that you can manually create a user account and mailbox from the client computer.

Second, you must install WSH 5.6. You need version 5.6 because the script uses WSH 5.6's improved method of managing command-line arguments and its XML file format; earlier WSH versions don't support either feature. Windows XP includes WSH 5.6. You can download the WSH 5.6 upgrade for Win2K, NT, Windows Me, and Windows 98 at (http://msdn.microsoft.com/library/default.asp?url=/downloads/list/webdev.asp).

Finally, you need to copy and register AcctCrt.dll on the client computer on which CrUM55 will run. AcctCrt.dll contains the AcctMgmt class, which the utility needs to associate a user account with an Exchange 5.5 mailbox and to generate a Security Descriptor (SD) for the mailbox. The SD gives the user account permission to use the mailbox. The DLL's source code is part of the Exchange 5.5 SDK. I've compiled the source code for the x86 platform and included it in the CrUM55_Utility.zip file, which you can download from http://www.exchangeadmin.com, InstantDoc ID 39177. After you download CrUM55_Utility.zip, copy AcctCrt.dll to the \%systemroot%\system32 folder on a computer running an NT-based OS, such as XP, Win2K, or NT. Then, from a command line, type

regsvr32 acctcrt.dll
and press Enter.

The Script Basics
The CrUM55 utility consists of two files: CrUM55.wsf, which contains the XML-based command-line Help for running the script, and CrUM55.vbs, which contains the VBScript code to complete the creation tasks. The version of this tool that I wrote for creating Exchange 2000 mailboxes and AD user accounts consists of only one file—a .wsf file. However, for creating Exchange 5.5 mailboxes and NT or AD user accounts, I found that separating the VBScript code from the XML code made the utility easier with which to work. For more information about the .wsf file format, see "The Script Basics" section of "Script User Account and Mailbox Creation."

You can run CrUM55.wsf from either WScript (the WSH graphical interface) or CScript (the command-line interface). For command-line help with CrUM55.wsf, type

crum55.wsf /?
or

crum55.wsf
and press Enter.

When you run CrUM55.wsf from WScript, the .wsf file displays status and Help information in a message box, as Figure 1 shows. When you run CrUM55.wsf from CScript, the .wsf file displays the same information in a command window, as Figure 2 shows.

Whether the Help information appears in a message box or command window depends on which script host you've configured as the default. WScript is the default script host unless you specifically configure WSH to use CScript. To configure CScript as your default script host, type the following code at the command line:

cscript //h:cscript
and press Enter.

CrUM55.wsf requires five parameters (i.e., /a, /u, /d, /f, and /l) to create an NT domain user account and Exchange 5.5 mailbox and six parameters (i.e., /a, /u, /d, /c, /f, and /l) to create an AD domain user account and Exchange 5.5 mailbox. Figure 1 and Figure 2 describe the values you specify for each parameter. For example, if you want to create a mailbox and an AD domain user account named EthanW for Ethan Wilansky in the Scripters OU below the IT OU of the adatum.com domain, you'd type

Crum55.wsf /a:ad /u:EthanW
/f:Ethan /l:Wilansky
/c:ou=scripters,ou=it,
dc=adatum,dc=com
/d:adatum
and press Enter
Active Directory

Active Directory

--

Questions

--

Followers

Top Experts

Active Directory (AD) is a Microsoft brand for identity-related capabilities. InĀ the on-premises world, Windows Server AD provides a set of identity capabilitiesĀ and services, and is hugely popular (88% of Fortune 1000 and 95% of enterprisesĀ use AD). This topic includes all things Active Directory including DNS, GroupĀ Policy, DFS, troubleshooting, ADFS, and all other topics under the Microsoft ADĀ and identity umbrella.