This is the last post in my series on scripting user and Home Folder management (see Part 1, Part 2, Part 3, and Part 4 and Part 5 for reference) — it was a lot of ground to cover, but we did it!  Thanks for hanging in there with me.  We’ve created the user and attributes, built the folder, set permissions, added the Home Folder attribute on the user object; all with PowerShell.  You don’t get much more real-world than that!

Now, as promised, it’s time to pull it all together into one example script.

Of course, now that we’re putting all the concepts from the previous posts together, we need to be smart and add a few smart/standard script things; like good use of variables, error checking, and so forth.  Specifically, the new things I’m introducing in this post are:

• Use of variables  – To make the script portable and easily modifiable
• Use of command line arguments – To accept the new user’s name as input arguments
• Use of SubString – To generate a “UserName” (a.k.a. SamAccountName) from a first and last name
• Check for pre-existing – To make sure we don’t attempt to create an already-existing user name

All of the items above are in the first section of the script below, and the remaining sections are where I pull in the concepts from the previous posts to get it all done.  I don’t want to go into great detail on these new items, but they are necessary to make the script flow correctly and be usable right away as-is.

So, here you go.  You can paste this right into a file (something like provisionNewUser.ps1), launch a PowerShell session, and run it with the new user’s First Name and Last Name on the command line (as explained early in the body of the script). 

And here’s my warning: Don’t ever do what people on the Internet tell you to do; if this script is scary to you, don’t run it.  In fact, only run this in a test lab, until you are comfortable with the specifics.  So there.

# Home Folder Provisioning Demo Script
# Jeremy Pavlov, Coretek Services, 20121003
#
# Execute in a powershell session, with the new user's First and Last names after the command, like this:
# .\provisionNewUser.ps1 Jeremy Pavlov
#
# Make sure you run this if not already loaded, for AD-based commands
Import-Module ActiveDirectory
#
# Read in the first name and last name from command line inputs
$FirstName = $args[0]
$FirstInitial = $FirstName.Substring(0,1)
$LastName = $args[1]
$LastInitial = $LastName.Substring(0,1)
$UserName = "$FirstInitial$LastName"
$MyDomain = "CoretekServices.local"
$HomePrefix = "\\$MyDomain\Corp\Homes"
$DefaultUserOu = "ou=New Users,dc=CoretekServices,dc=local"
#
write "First name will be: $FirstName"
write "Last name will be: $LastName"
write "User name will be: $UserName"
write "Home Folder will be: $HomePrefix\$LastInitial\$UserName"
write ""
#
# See if the user exists
$CheckUser = Get-ADUser -ldapFilter "(SamAccountName=$UserName)"
#
#If user exists, exit!
if ($CheckUser -ne $Null)
{
  write "User $UserName already exists! Exiting..."
  write ""
  exit 
}
#
write "Creating $UserName..."
write ""
New-ADUser -Path "$DefaultUserOu" -SamAccountName "$UserName" -Enabled $true -Name "$FirstName $LastName" -GivenName "$FirstName" -Surname "$LastName" -AccountPassword (ConvertTo-SecureString –AsPlaintext "ChangeMe123!" –Force) -ChangePasswordAtLogon $true
#
write "Create $HomePrefix\$LastInitial\$UserName ..."
write ""
New-Item -type directory -path $HomePrefix\$LastInitial\$UserName
#
write "Setting permissions on the $HomePrefix\$LastInitial\$UserName ..."
write ""
$acl = Get-Acl $HomePrefix\$LastInitial\$UserName
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$MyDomain\$UserName", "DeleteSubdirectoriesAndFiles, Modify, Synchronize", "ContainerInherit, ObjectInherit", "None", "Allow")
$acl.AddAccessRule($rule)
Set-Acl $HomePrefix\$LastInitial\$UserName $acl
#
write "Setting the Home Folder attribute for $UserName"
write ""
Set-ADUser -identity "$UserName" -homeDrive h: -homeDir "$HomePrefix\$LastInitial\$UserName"
#
write "...Complete!"
write ""
#

…and there you have it.  Now, of course, I could have dumped in a lot of other good practice stuff like input validations and things, or other additional neat features, but I’m only trying to demonstrate the core concepts here from our previous posts in this series.  I don’t want to over-whelm the example and make it difficult or — heaven forbid — boring (gasp!) to read.

But please, if you have a better way of doing it, make sure to drop a comment or two and help out others…

Now go create some users!

Tags: asdi, dsadd, Home Folder, ldap, Powershell, script, scripting, user creation, user management

In this post, I’m following up on Part 1 of this series where I showed you how to create users (and set a few attributes) the basic way with Powershell.  Now, I’m going to show you an easier way to create users thanks to the new(ish) Powershell modules that came along in Windows Server 2008 R2.  In the up-coming parts of this series, we’ll continue on to Home Folder creation/management concepts and automation.  But for now, let’s get that user created…

To be honest with you, I have to admit that most of the time when I’m building a script loop and just need an easy output that looks nice, I’d just do the DSAdd tool like this:

dsadd user "cn=Jeremy Pavlov,ou=Demo,dc=CoretekServices,dc=local" -samId JPavlov -disabled no -fn Jeremy -ln Pavlov -pwd ChangeMe123! -mustchpwd yes

…but the future is here, and the future is PowerShell; and you and I have to get over it.  Powershell gives us better portability, variable management, etc., etc…  So onward and upward. 

And with recent versions of Windows 2008 R2, Microsoft provides the new “ActiveDirectory” module; making user creation/management activities as easy to do as the DSAdd/DSMod tools.  Here’s what I mean…

Open a Powershell session, and import the ActiveDirectory module like this:

Import-Module ActiveDirectory

Note: You need to have network access to an Active Directory server running AD Web Services for this module to work. 

Loading this module is the equivalent of launching the “Active Directory Module for Windows PowerShell” option on Windows 7 and Server 2008, but if you’re scripting you’ll want to make sure you load the module explicitly.  And, as a result, you have a ton of new AD tools available to you. 

You can get a good look at the majority of the new AD tools by using this command:

Get-Command *-AD*

Finally, using the New-ADUser command, we create that user with what is pretty much the equivalent of the DSAdd above (I used the same options to help clarify):

New-ADUser -Path "ou=Demo,dc=CoretekServices,dc=local" -SamAccountName "JPavlov" -Enabled $true -Name "Jeremy Pavlov" -GivenName "Jeremy" -Surname "Pavlov" -AccountPassword (ConvertTo-SecureString –AsPlaintext "ChangeMe123!" –Force) -ChangePasswordAtLogon $true

And that’s it!  You have a new user with your standard attributes set correctly.  I like this one-line method because it looks much cleaner when you are building import scripts that must be distributed to other folks, or when you want to insert some other command between each line (if you’re looping), etc.; it’s neat.

On a side note, there’s also a way to read in the contents of a formatted CSV, and pump it into the New-ADUser command; but my goal here is to show you concepts that ultimately can be combined into an multifaceted script.

Next time…  Home Folder creation and permission assignment.  See you then!

Tags: asdi, dsadd, Home Folder, ldap, Powershell, script, scripting, user creation, user management