Solved

Create AD user from client and not server with powershell

Posted on 2016-08-04
4
58 Views
Last Modified: 2016-08-04
I have not tested yet, but would I be able to create AD users from a workstation and not directory from the domain controller desktop using powershell?  Here is the script I have. It looks to work well on the server. I have not tried it from a workstation yet. Just wanted to get some advice first.  Would I need to have RSAT tools installed to do this from the workstation?


import-module activedirectory
$Input = Read-Host -Prompt "Input the user name as 'LastName, FirstName'"
$EmployeeID = Read-Host -Prompt "EmployeeID"
$Description = Read-Host -Prompt "Description"
$Department = Read-Host -Prompt "Department"
If ($Input -notmatch '\A\s*(?<LastName>\w+)\s*,\s*(?<FirstName>\w+)\s*\Z') {
	"Invalid input '$($Input)'" | Write-Error
	Exit 1
}
$LastName = $Matches['LastName']
$FirstName = $Matches['FirstName']

$ADUser = [ordered]@{}
$ADUser['Name'] =					"$($FirstName[0])$($LastName)"
$ADUser['SamAccountName'] =			"$($FirstName[0])$($LastName)"
$ADUser['GivenName'] =				$FirstName
$ADUser['Surname'] =				$LastName
$ADUser['DisplayName'] =			"$($FirstName) $($LastName)"
$ADUser['UserPrincipalName'] =		"$($FirstName[0])$($LastName)@homelab.com"
$ADUser['Path'] =					'OU=Staff,DC=homelab,DC=com'
$ADUser['AccountPassword'] =		ConvertTo-SecureString -AsPlainText 'P@ssw0rd' -Force
$ADUser['ChangePasswordAtLogon'] =	$True
$ADUser['Department'] =				$Department
$ADUser['Description'] =			$Description
$ADUser['EmailAddress'] =			"$($FirstName[0])$($LastName)@homelab.com"
$ADUser['Office'] =				$employeeID
$ADUser['Enabled'] =				$True
$ADUser['HomeDirectory'] =			"\\127.0.0.1\Share\$($ADUser['SamAccountName'])"
$ADUser['HomeDrive'] =				'H:'

"Creating a new user with the following properties:"
$ADUser.GetEnumerator() | Format-Table
New-ADUser @ADUser
Add-ADGroupMember "googleapps" –Member $($ADUser['SamAccountName'])
Add-ADGroupMember "yard-staff" –Member $($ADUser['SamAccountName'])

New-Item -type directory -path "\\127.0.0.1\Share\$($ADUser['SamAccountName'])"
$Acl = Get-Acl "\\127.0.0.1\Share\$($ADUser['SamAccountName'])"
$Ar = New-Object system.security.accesscontrol.filesystemaccessrule("$($FirstName[0])$($LastName)","FullControl","Allow")
$Acl.SetAccessRule($Ar)
Set-Acl "\\127.0.0.1\Share\$($ADUser['SamAccountName'])" $Acl

Open in new window

0
Comment
Question by:Roccat
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 22

Accepted Solution

by:
Joseph Moody earned 500 total points
ID: 41743045
Yes. With RSAT installed, you would have the powershell ActiveDirectory module as well.
0
 

Author Comment

by:Roccat
ID: 41743056
Would I need to specify a server in the code or will it just work with the domain that the computer is joined to?
0
 
LVL 22

Expert Comment

by:Joseph Moody
ID: 41743059
You don't have to specify a DC or domain.
0
 

Author Closing Comment

by:Roccat
ID: 41743180
Thank you!
0

Featured Post

Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
Here's a look at newsworthy articles and community happenings during the last month.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

615 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question