The easiest way to create a new user object in the Active Directory domain is to use MMC graphical snap-in ADUC (Active Directory Users and Computers). But if you need to create multiple user accounts in the domain, doing it manually can be a tiresome task for an administrator. In this article, we’ll consider an example automating the creation of user accounts in AD using the New-ADUser PowerShell cmdlet.
Using New-ADUser Cmdlet to Create New Active Directory User Account
New-ADUser cmdlet is a part of Active Directory for PowerShell module. To use this module, you must install RSAT version corresponding to your OS version and enable Active Directory Module for Windows PowerShell component.
To import the module to your PowerShell session, run this command:
Import-Module activedirectory
You can get the full syntax of New-ADUser cmdlet using the command:
Get-Command New-ADUser –Syntax
In the minimum version, to create a new account it’s enough to specify just the name of the AD user:
New-ADUser testuser1
As you can see, a new user account has been created in the default Users container and is disabled. To use this account, you must enable it (Enable-ADAccount cmdlet), set its password (Set-ADAccountPassword cmdlet) and/or other attributes (if necessary).
To create a full-featured user account in the specific AD container of the domain (OU) with the password and immediately enable the user’s object, use this command:
New-ADUser -Name "Albert Schmidt" -GivenName "Albert" -Surname "Schmidt" -SamAccountName "a.schmidt" -UserPrincipalName "a.schmidt@woshub.com" -Path "OU=Users,OU=Accounts,OU=Berlin,OU=DE,DC=woshub,DC=com" -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true
The command will prompt you to set a password (protected) for a new user at once.
You can get the information about the created domain user object with Get-ADUser cmdlet:
Get-ADUser a.schmidt
Bulk Create AD Users from a CVS File Using PowerShell Script
If you have to create multiple Active Directory users at once, it’s easier to save the list of users in the format of CSV (Excel) file and then run a special PowerShell script. In this file, you must fill in all significant user attributes.
For example, my Excel file of users consists of 8 columns and has the following header format:
FirstName;LastName;SamAccountName;Phone;Department;JobTitle;Password;OU
Fill in the user data and save the Excel file into the CSV format with commas as separating character. The encoding must be set to UTF-8 (it’s important!). The values of the OU column contain commas, so you must use double quotes.
Now you can import this CSV file (create_new_ad_users.csv) and create new users in the AD domain. The code of the ready PowerShell script is shown below:
Import-Module activedirectory
Import-Csv "C:\ps\create_new_ad_users.csv" | ForEach-Object {
$upn = $_.SamAccountName + “@woshub.com”
$uname = $_.LastName + " " + $_.FirstName
New-ADUser -Name $uname `
-DisplayName $uname `
-GivenName $_.FirstName `
-Surname $_.LastName `
-OfficePhone $_.Phone `
-Department $_.Department `
-Title $_.JobTitle `
-UserPrincipalName $upn `
-SamAccountName $_.samAccountName `
-Path $_.OU `
-AccountPassword (ConvertTo-SecureString $_.Password -AsPlainText -force) -Enabled $true
}
After you have run the script, open the ADUC console, expand the specified AD container and make sure that new user accounts have appeared in the AD. (You can track user account creation in the AD accounts as follows: Get Active Directory Accounts Created in the Last X Hours / Days.)
You can add the created accounts to the specific AD group using Add-AdGroupMember cmdlet. To do it, modify the script by adding this line to the For-Each loop:
Add-AdGroupMember -Identity AllowInternetAccess-Members $_.samAccountName
Or you can set user photo in AD to display it in Outlook and Lync using the Set-ADUser cmdlet:
Set-ADUser $_.samAccountName -Replace @{thumbnailPhoto=([byte[]](Get-Content "C:\ps\l.wolf.jpg" -Encoding byte))}
6 comments
script doesnt work
New-ADUser : Cannot validate argument on parameter ‘Path’. The argument is null or empty. Provide an argument that is not null or empty, and
then try the command again.
At line:14 char:7
+ -Path $_.OU `
+ ~~~~~
+ CategoryInfo : InvalidData: (:) [New-ADUser], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.ActiveDirectory.Management.Commands.NewADUser
Show me your whole New-ADUser command
Import-Csv “C:\Users\cammy\Desktop\BULKCREATE.xlsx” | ForEach-Object $upn = $_.SamAccountName + “@mydomain.com” $uname = $_.LastName + ” ” + $_.FirstName New-ADUser -Name $uname ` -DisplayName $uname ` -GivenName $_.FirstName ` -Surname $_.LastName ` -UserPrincipalName $upn ` -SamAccountName $_.samAccountName ` -Path $_.OU ` -AccountPassword (ConvertTo-SecureString $_.Password -AsPlainText -force) -Enabled $true
New-ADUser : Cannot bind parameter ‘AccountPassword’. Cannot convert the
“User@cbps123!” value of type “System.String” to type
“System.Security.SecureString”.
At line:19 char:18
+ -AccountPassword $_.Password `
+ ~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [New-ADUser], ParameterBindi
ngException
+ FullyQualifiedErrorId : CannotConvertArgumentNoMessage,Microsoft.ActiveDi
rectory.Management.Commands.NewADUser
don’t use
@
character as a part of user password in your powershell scripts. This is a special character. Or change it to`@
Do you need Excel running if you run this on the DC?