ACTIVE DIRECTORY: MANAGING USERS AND GROUPS WITH POWERSHELL

Automate Active Directory PowerShell scripts

"To use the Microsoft cmdlets, you must have a Windows Server 2008 R2 domain controller (DC), or you can download and install the Active Directory Management Gateway Service on legacy DCs."

“Download Remote Server Administration Tools on client machine”

Open Programs in Control Panel and select Turn Windows Features On or Off. Scroll down to Remote Server Administration Tools and expand Role Administration Tools D DS and AD LDS Tools > Active Directory Module for Windows PowerShell. Enable Active Directory Module.

Open the PowerShell console and type the following command to see which commands are in the module:

PS> Get-Command -Module ActiveDirectory

"User name Taken for the below commands -Tmantra"

 

·       Find Users

PS> Get-AdUser -Identity 'Tmantra'

·       Create Users

$NewUserParameters = @{
    'GivenName' = 'Tech'
    'Surname' = 'Mantra'
    'Name' = 'Tmantra'
    'AccountPassword' = (ConvertTo-SecureString 'p@$$w0rd10' -AsPlainText -Force)
    'ChangePasswordAtLogon' = $true
}

New-AdUser @NewUserParameters

·       Add users to Groups

Add-AdGroupMember -Identity 'Manager' -Members 'Tmantra'

·       Delete a User

Remove-ADUser Tmantra -whatif

·       Reset a User Password

PS C:\> $newpwd = Read-Host "Enter the new password" -AsSecureString

 Enter the new password:

PS C:\> Set-ADAccountPassword Tmantra -NewPassword $newpwd –Reset

·       Disable and Enable User account

PS C:\> Disable-ADAccount Tmantra

PS C:\> Enable-ADAccount Tmantra

·       Unlock User Account

PS C:\> Unlock-ADAccount Tmantra

Automate Creation of Users

We can combine these commands when the human resources department provides a CSV file that lists new users to create in Active Directory. The CSV file might look like this:

"FirstName","LastName","UserName"
"Adam","Bertram","abertram"
"Joe","Jones","jjones"

To create these users, write a script that invokes the New-AdUser command for each user in the CSV file. Use the built-in Import-Csv command and a foreach loop in PowerShell to go through the file and give users the same password.

Import-Csv -Path C:\Employees.csv | foreach {

    $NewUserParameters = @{

        'GivenName' = $_.FirstName

        'Surname' = $_.LastName

        'Name' = $_.UserName

        'AccountPassword' = (ConvertTo-SecureString 'p@$$w0rd10' -AsPlainText -Force)

    }

    New-AdUser @NewUserParameters

}