Importing users into Active Directory
Published 27 October, 2016When you need to create a single user in Active Directory Domain Services (AD DS), the tendency is to just "do it" in the GUI - either Active Directory Users and Computers (ADUC) or Active Directory Administrative Center (ADAC). But if you've got 25 users to add, or even 5 users to add, that's just painful. Plus, having this scripted ensures that each user is correctly entered following the same format.
For me, the easiest way to do this is by putting the users in a spreadsheet and then leveraging PowerShell's Import-CSV command. So, for the sake of argument, let's assume I have 8 new users to add to my TreyResearch.net domain. I open Excel, and create a spreadsheet with the following information for each user: Name, Given Name, Surname, Display Name, SamAccountName, and Description. The spreadsheet would look like this:
We'll save that as "TreyUsers.csv", and ignore any warnings about formatting, etc. This gives us a file with:
Name,GivenName,Surname,DisplayName,SAMAccountName,Description David Guy,David,Guy,Dave R. Guy,Dave,Customer Appreciation Manager Alfredo Fettucine,Alfredo,Fettuccine,Alfie NoNose,Alfie,Shop Foreman Stanley Behr,Stanley,Behr,Stanley T. Behr, Stanley,Webmaster Priscilla Catz,Priscilla,Catz,Dame Priscilla,Priscilla,Shop Steward Harold Catz,Harold,Catz,Harold S. Catz,Harold,Engineering Manager William Wallace,William,Wallace,Sir William Wallace,Wally,Marketing Manager Trey Barksdale,Trey,Barksdale,Lord Barksalot,Trey,Sales Manager Charlie Derby,Charles,Derby,Sparky,Sparky,Chief Security Officer
Now, we use PowerShell's Import-CSV to import this set of users into a variable $TreyUsers.
$TreyUsers = Import-CSV TreyUsers.csv
To create the users, we'll use a simple ForEach loop:
foreach ($user in $TreyUsers ) {
New-ADUser -DisplayName $User.DisplayName `
-Description $user.Description `
-GivenName $user.GivenName `
-Name $User.Name `
-SurName $User.SurName `
-SAMAccountName $User.SAMAccountName `
-Enabled $True `
-ChangePasswordAtLogon $True `
-PasswordNeverExpires $False `
-UserPrincipalName $user.SAMAccountName `
-AccountPassword (ConvertTo-SecureString `
-AsPlainText `
-Force `
-String 'P@ssw0rd!' ) 2>$NULL
}
(If you find that plain text password a bit problematic, use a Read-Line -AsSecureString early in the script to prompt you for an initial password. )
Finally, if you want to copy the security groups of an existing template user, stay tuned -- I'll cover that shortly
ETA: To correct ill-advised use of double-quotes in ConvertTo-SecureString.
PowerShell: Get-Credential from a file
Published 4 October, 2016If you routinely have to log into a separate domain, it can be a nuisance to always have to run Get-Credential. Plus writing scripts with a -Credential parameter is a nuisance because if you call Get-Credential in the script, it will always prompt you.
I run a separate lab network here, with an Active Directory domain of TreyResearch.net. I got tired of always having scripts prompt me for credentials, or even more annoying, have routine PowerShell commands against computers in the lab fail because I didn't have credentials for that domain. The answer is pretty simple -- first, I stored my password securely in a file with:
Read-Host -AsSecureString `
| ConvertFrom-SecureString `
| Out-File $Home\Documents\WindowsPowerShell\TCred.txt
Now, I can use that password to create a PSCredential object that I can pass into a script.
$tPW = Get-Content $home\Documents\WindowsPowerShell\TCred.txt `
| ConvertTo-SecureString
$tCred = New-Object -TypeName System.Management.Automation.PSCredential `
-ArgumentList "TreyResearch\Charlie",$tPW
Because of the way SecureString works, and how Windows encrypts and decrypts objects, this password can only be read from the account that created it. Now, if I want to add a -Credential parameter to my scripts, I use the following:
[CmdletBinding()]
Param([Parameter(Mandatory=$false,ValueFromPipeLine=$True)]
[PSCredential]
$Credential = $NULL
)
if ( $Credential ) {
$tCred = $Credential
} else {
$tPW = Get-Content $home\Documents\WindowsPowerShell\TCred.txt `
| ConvertTo-SecureString
$tCred = New-Object -TypeName System.Management.Automation.PSCredential `
-ArgumentList "TreyResearch\Charlie",$tPW
}
ETA: if you create a script for this, you'll need to "dot source" the script to add the credential to your environment, but you can use that script in the pipeline to insert a credential into the pipeline. Or, add the relevant lines into your $Profile, and the credential is then available in your environment.